CVE-2025-48361

MediumCVSS 5.3

Published: 28/08/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

22th percentile - higher than 22% of all known CVEs

Summary

The Hesabfa Accounting plugin for WordPress (versions up to and including 2.2.5) contains an Insertion of Sensitive Information Into Sent Data vulnerability, allowing retrieval of embedded sensitive data.

Risk Assessment

This may lead to disclosure of sensitive information, such as accounting data or credentials, to unauthorized parties.

Recommendation

Update the Hesabfa Accounting plugin to a version later than 2.2.5 or disable it if no fix is available.

Other vulnerabilities in Hesabfa Accounting

CVE-2025-48362Medium
The Hesabfa Accounting plugin (hesabfa-accounting) in versions up to and including 2.2.5 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows unauthorized actions on behalf of a logged-in user.

Original NVD description (English source)

Insertion of Sensitive Information Into Sent Data vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Retrieve Embedded Sensitive Data.This issue affects Hesabfa Accounting: from n/a through <= 2.2.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS