CVE-2025-10588

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10588", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-16T22:42:49.411Z", "datePublished": "2025-10-22T06:40:57.974Z", "dateUpdated": "2026-04-08T16:53:10.613Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:53:10.613Z"}, "affected": [{"vendor": "pixelyoursite", "product": "PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "11.1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 11.1.2. This is due to missing or incorrect nonce validation on the adminEnableGdprAjax() function. This makes it possible for unauthenticated attackers to modify GDPR settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "PixelYourSite <= 11.1.2 \u2013 Cross-Site Request Forgery to GDPR Options Modification", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53c25e24-fac6-404c-be6c-678a383b48a1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3379001/pixelyoursite"}, {"url": "https://research.cleantalk.org/cve-2025-10588/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2025-10-10T09:23:52.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-21T17:47:54.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-22T13:32:43.549408Z", "id": "CVE-2025-10588", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-22T13:32:51.903Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10588", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-22T13:32:43.549408Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-22T13:32:47.552Z"}}], "cna": {"title": "PixelYourSite <= 11.1.2 \u2013 Cross-Site Request Forgery to GDPR Options Modification", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "pixelyoursite", "product": "PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "11.1.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-10T09:23:52.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-21T17:47:54.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53c25e24-fac6-404c-be6c-678a383b48a1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3379001/pixelyoursite"}, {"url": "https://research.cleantalk.org/cve-2025-10588/"}], "descriptions": [{"lang": "en", "value": "The PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 11.1.2. This is due to missing or incorrect nonce validation on the adminEnableGdprAjax() function. This makes it possible for unauthenticated attackers to modify GDPR settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-18T17:54:14.999Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10588", "state": "PUBLISHED", "dateUpdated": "2025-12-18T17:54:14.999Z", "dateReserved": "2025-09-16T22:42:49.411Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-22T06:40:57.974Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager", "vendor": "pixelyoursite", "versions": [{"lessThanOrEqual": "11.1.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 11.1.2. This is due to missing or incorrect nonce validation on the adminEnableGdprAjax() function. This makes it possible for unauthenticated attackers to modify GDPR settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin PixelYourSite - Your smart PIXEL (TAG) & API Manager para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 11.1.2, inclusive. Esto se debe a la validaci\u00f3n de nonce faltante o incorrecta en la funci\u00f3n adminEnableGdprAjax(). Esto hace posible que atacantes no autenticados modifiquen la configuraci\u00f3n de GDPR a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-10588", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10588", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-22T13:32:43.549408Z", "version": "2.0.3"}}]}, "published": "2025-10-22T07:15:32.603", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3379001/pixelyoursite"}, {"source": "security@wordfence.com", "url": "https://research.cleantalk.org/cve-2025-10588/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53c25e24-fac6-404c-be6c-678a383b48a1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T13:02:24.761522+00:00", "value": {"mitigation_remediation": ["Upgrade the PixelYourSite plugin to a version newer than 11.1.2, which contains proper nonce validation for GDPR controls.", "Restrict access to the WordPress admin area to a trusted IP range or enforce two\u2011factor authentication so that only legitimate administrators can reach the GDPR settings.", "Educate site administrators to verify that any hyperlink before clicking it comes from a trusted source and to avoid opening unfamiliar links that could trigger forged requests."], "summary": {"action": "Monitor", "impact": "Cross\u2011Site Request Forgery"}, "threat_synthesis": {"affected_systems": "All installations of the PixelYourSite plugin for WordPress with a version number of 11.1.2 or earlier are affected. The vulnerability exists in the admin interface that manages GDPR options; any site running those plugin versions could be impacted if an attacker convinces an administrator to follow a forged link.", "description_and_impact": "The PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager plugin for WordPress suffers a Cross\u2011Site Request Forgery flaw caused by missing or incorrect nonce verification on the adminEnableGdprAjax() function. This defect allows an unauthenticated attacker to modify GDPR settings, potentially changing how user data is handled or disclosed. The weakness is categorized as CWE\u2011352 and may compromise the integrity of the site\u2019s privacy compliance.", "risk_and_exploitability": "The CVSS score for this vulnerability is 4.3, indicating a moderate risk. The EPSS score is below 1%, and it is not listed in CISA\u2019s KEV catalog, suggesting exploitation activity is unlikely at present. However, the attack vector relies on a CSRF attack, so an adversary needs to trick an administrator into clicking a malicious link; once that occurs, they can change GDPR settings without any authentication."}}}}, "created": "2025-10-23T10:07:54.191246+00:00", "updated": "2026-04-22T13:15:17.838378+00:00", "vendors": ["pixelyoursite", "pixelyoursite$PRODUCT$pixelyoursite", "wordpress", "wordpress$PRODUCT$wordpress"]}