{"id":"CVE-2025-49966","aliases":["EUVD-2025-28334","GHSA-8v84-mv9p-rj4g"],"status":"published","title":"WordPress Oganro Travel Portal Search Widget for HotelBeds APITUDE API plugin \u003c= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability","description":"Cross-Site Request Forgery (CSRF) vulnerability in Oganro Oganro Travel Portal Search Widget for HotelBeds APITUDE API oganro-travel-portal-search-widget-for-hotelbeds-apitude-api allows Cross Site Request Forgery.This issue affects Oganro Travel Portal Search Widget for HotelBeds APITUDE API: from n/a through \u003c= 1.0.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00149,"percentile":0.04165,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2025-06-20T15:04:22Z","modified":"2026-06-17T09:32:13Z","products":[{"vendor":"oganro","product":"oganro travel portal search widget for hotelbeds apitude api"}],"references":[{"url":"https://patchstack.com/database/Wordpress/Plugin/oganro-travel-portal-search-widget-for-hotelbeds-apitude-api/vulnerability/wordpress-oganro-travel-portal-search-widget-for-hotelbeds-apitude-api-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49966"},{"url":"https://patchstack.com/database/wordpress/plugin/oganro-travel-portal-search-widget-for-hotelbeds-apitude-api/vulnerability/wordpress-oganro-travel-portal-search-widget-for-hotelbeds-apitude-api-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"},{"url":"https://github.com/advisories/GHSA-8v84-mv9p-rj4g"}],"sources":{"cve":[{"id":"CVE-2025-49966","title":"WordPress Oganro Travel Portal Search Widget for HotelBeds APITUDE API plugin \u003c= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability","description":"Cross-Site Request Forgery (CSRF) vulnerability in Oganro Oganro Travel Portal Search Widget for HotelBeds APITUDE API oganro-travel-portal-search-widget-for-hotelbeds-apitude-api allows Cross Site Request Forgery.This issue affects Oganro Travel Portal Search Widget for HotelBeds APITUDE API: from n/a through \u003c= 1.0.","status":"published","published":"2025-06-20T15:04:22.175Z","modified":"2026-04-28T16:13:14.041Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:32:24.473448Z"}],"euvd":[{"id":"EUVD-2025-28334","description":"Cross-Site Request Forgery (CSRF) vulnerability in Oganro Oganro Travel Portal Search Widget for HotelBeds APITUDE API oganro-travel-portal-search-widget-for-hotelbeds-apitude-api allows Cross Site Request Forgery.This issue affects Oganro Travel Portal Search Widget for HotelBeds APITUDE API: from n/a through \u003c= 1.0.","status":"published","published":"2025-06-20T15:04:22Z","modified":"2026-04-28T16:13:14Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:05:38.931525Z"}],"ghsa":[{"id":"GHSA-8v84-mv9p-rj4g","title":"Cross-Site Request Forgery (CSRF) vulnerability in Oganro Oganro Travel Portal Search Widget for...","description":"Cross-Site Request Forgery (CSRF) vulnerability in Oganro Oganro Travel Portal Search Widget for HotelBeds APITUDE API allows Cross Site Request Forgery. This issue affects Oganro Travel Portal Search Widget for HotelBeds APITUDE API: from n/a through 1.0.","status":"published","published":"2025-06-20T15:30:38Z","modified":"2025-06-20T15:30:48Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:02:46.307418Z"}],"nvd":[{"id":"CVE-2025-49966","description":"Cross-Site Request Forgery (CSRF) vulnerability in Oganro Oganro Travel Portal Search Widget for HotelBeds APITUDE API oganro-travel-portal-search-widget-for-hotelbeds-apitude-api allows Cross Site Request Forgery.This issue affects Oganro Travel Portal Search Widget for HotelBeds APITUDE API: from n/a through \u003c= 1.0.","status":"published","published":"2025-06-20T15:15:21.43Z","modified":"2026-06-17T09:32:13.567Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:11:14.091082Z"}]}}