CVE-2025-64237
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The Quick Interest Slider plugin (versions up to and including 3.1.5) contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this to perform unauthorized operations in the context of a logged-in user.
Risk Assessment
The risk includes the possibility of changing plugin settings or performing other actions without administrator consent, which could compromise site integrity.
Recommendation
It is recommended to update the Quick Interest Slider plugin to a version newer than 3.1.5 if available, and implement CSRF protection mechanisms.
Other vulnerabilities in Quick Interest Slider
See all- CVE-2026-56039High
The vulnerability allows an unauthenticated attacker to perform XSS attacks in Quick Interest Slider versions up to and including 3.1.6.
- CVE-2025-62153Medium
Quick Interest Slider plugin (versions up to 3.1.7) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user can perform actions reserved for privileged roles.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in Graham Quick Interest Slider quick-interest-slider allows Cross Site Request Forgery.This issue affects Quick Interest Slider: from n/a through <= 3.1.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS