uxper Civi Framework vulnerabilities

Latest uxper Civi Framework CVEs

Newest publication first

1. CVE-2026-65525 WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability

   Published 2026-07-23

   Medium·CVSS 5.3 EPSS 0.29%

   Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.

2. CVE-2025-49511 WordPress Civi Framework plugin <= 2.1.6 - Cross Site Request Forgery (CSRF) to User Deactivation vulnerability

   Published 2025-06-10

   High·CVSS 7.1 EPSS 0.19%

   Cross-Site Request Forgery (CSRF) vulnerability in uxper Civi Framework civi-framework allows Cross Site Request Forgery.This issue affects Civi Framework: from n/a through <= 2.1.6.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.