{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://wordpress.org/plugins","packageName":"codeflavors-vimeo-video-post-lite","product":"Vimeotheque","source":"CNA: Patchstack","vendor":"Constantin Boiangiu","versions":[{"changes":[{"at":"2.3.6","status":"unaffected"}],"lessThanOrEqual":"2.3.5.2","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2025-68584","cwes":["CWE-352"],"description":"Cross-Site Request Forgery (CSRF) vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows Cross Site Request Forgery.This issue affects Vimeotheque: from n/a through <= 2.3.5.2.","epss":{"date":"2026-11-03","percentile":0.02695,"score":0.00131},"exploits":[],"kev":null,"metrics":[{"score":4.3,"severity":"medium","source":"CNA: Patchstack","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1793751296323,"publishedAt":1766581841424,"references":[{"source":"CNA: Patchstack","tags":["vdb-entry"],"url":"https://patchstack.com/database/Wordpress/Plugin/codeflavors-vimeo-video-post-lite/vulnerability/wordpress-vimeotheque-plugin-2-3-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}],"remediation":[],"revision":"11bad2f8e2b0f6967438e15c30ab05116bb00316e2257a8b5dae8b2832067b1a","sources":[{"modifiedAt":1793751296323,"name":"CNA: Patchstack","retrievedAt":1793754631293,"url":"https://www.cve.org/CVERecord?id=CVE-2025-68584"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793748134207,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68584"}],"ssvc":{"assessedAt":1777315680903,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"WordPress Vimeotheque plugin <= 2.3.5.2 - Cross Site Request Forgery (CSRF) vulnerability","updatedAt":1793754631293}