CVE-2025-23922

Severity

CRITICAL

CVSS

10.0

EPSS

0.01074

Risk score

40.38

CISA KEV

PoC

Published

2025-01-16

Modified

2026-04-28

First seen

2026-08-07

Aliases

EUVD-2025-3537, GHSA-226X-XGH7-2WWC

Products

Harsh:iSpring Embedder 0 ≤1.0

Sources

euvd EUVD-2025-3537

Description

Cross-Site Request Forgery (CSRF) vulnerability in Harsh iSpring Embedder embed-ispring allows Upload a Web Shell to a Web Server.This issue affects iSpring Embedder: from n/a through <= 1.0.

References

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-3537
https://patchstack.com/database/Wordpress/Plugin/embed-ispring/vulnerability/wordpress-ispring-embedder-plugin-1-0-csrf-to-arbitrary-file-upload-vulnerability?_s_id=cve