CVE-2025-59467 is a cross-site scripting flaw in the UCRM Argentina AFIP invoices plugin version 1.2.0 and earlier, scored CVSS 7.5 (high). An administrator tricked into visiting a crafted page could be exposed to privilege escalation. Update the plugin to 1.3.0 or later.
What's affected
The NVD record, quoting the vendor bulletin, lists the UCRM Argentina AFIP invoices plugin version 1.2.0 and earlier as affected. The stated mitigation is to update to version 1.3.0 or later.
The record adds that the plugin is disabled by default, which narrows the exposure to installations where someone turned it on. The vendor bulletin is Security Advisory Bulletin 057 on the Ubiquiti community site, which returned an access error when I tried to fetch it.
How to check if you're exposed
In the UCRM admin area, open the plugins list and look for the AFIP invoices plugin. If it is not listed or not enabled, this CVE does not affect you in practice. If it is enabled, read the version number and compare it with 1.3.0.
Plugin pages are admin only, so the risk is mostly about what your administrators browse while signed in.
What to do now
- Check the UCRM plugin list for the AFIP invoices plugin.
- If you do not need it, disable or remove it.
- If you do need it, update it to 1.3.0 or later.
- Remind administrators not to follow links from untrusted emails or messages while signed in.
- Use a separate browser profile for administration if your policy allows it.
Why it matters
The class is CWE-79, cross-site scripting. Page output includes content the application did not neutralize, so script can run in the administrator's session. Because that session has high rights, the record calls out privilege escalation.
The condition that an administrator must be tricked into visiting a page means a person is part of the chain, so awareness and plugin hygiene both help. Plugins add code to a platform, and every enabled plugin adds to what you must patch. The KEV flag is false.
Quick check
Do I need to act if the plugin is disabled?
The record says the plugin is disabled by default. If it is off in your install, the issue does not apply, but updating or removing it avoids a later surprise.
Sources
Last reviewed: 19 October 2026.
