CVE-2025-63060
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The KALLYAS plugin (by hogash) is vulnerable to Cross-Site Request Forgery (CSRF). This issue affects KALLYAS versions from n/a through < 4.25.0.
Risk Assessment
An attacker can force a logged-in administrator to perform unwanted actions within their session, potentially leading to unauthorized changes on the site. The risk is real if an administrator is logged in and clicks a malicious link.
Recommendation
Update the KALLYAS plugin to version 4.25.0 or later. Additionally, enforce least privilege and educate administrators not to click unknown links.
Other vulnerabilities in KALLYAS
See all- CVE-2025-63061Medium
The KALLYAS theme (versions below 4.25.0) contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be executed in the user's browser through DOM manipulation.
- CVE-2025-62018Medium
Missing Authorization vulnerability in hogash KALLYAS kallyas. This issue affects KALLYAS from n/a through <= 4.22.0.
- CVE-2025-62017Medium
The KALLYAS theme for WordPress is vulnerable to missing authorization in versions up to and including 4.22.0. This vulnerability may allow unauthorized access to functions or data.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in hogash KALLYAS kallyas allows Cross Site Request Forgery.This issue affects KALLYAS: from n/a through < 4.25.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS