CVE-2025-12416

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12416", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-28T15:45:10.914Z", "datePublished": "2025-11-04T04:27:13.744Z", "dateUpdated": "2026-04-08T16:37:24.988Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:24.988Z"}, "affected": [{"vendor": "mahype", "product": "Pagerank tools", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Pagerank Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the pr_save_settings() function and insufficient input sanitization. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected scripts will execute whenever a user accesses the plugin's settings page."}], "title": "Pagerank Tools <= 1.1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/177900d6-c52e-4ac4-a74d-412e453f9d05?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/pagerank-tools/tags/1.1.5/functions.inc.php#L176"}, {"url": "https://plugins.trac.wordpress.org/browser/pagerank-tools/tags/1.1.5/functions.inc.php#L192"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2025-11-03T15:37:53.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-04T20:56:29.746440Z", "id": "CVE-2025-12416", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T20:56:39.593Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12416", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-04T20:56:29.746440Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T20:56:35.187Z"}}], "cna": {"title": "Pagerank Tools <= 1.1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "mahype", "product": "Pagerank tools", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.1.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-03T15:37:53.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/177900d6-c52e-4ac4-a74d-412e453f9d05?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/pagerank-tools/tags/1.1.5/functions.inc.php#L176"}, {"url": "https://plugins.trac.wordpress.org/browser/pagerank-tools/tags/1.1.5/functions.inc.php#L192"}], "descriptions": [{"lang": "en", "value": "The Pagerank Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the pr_save_settings() function and insufficient input sanitization. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected scripts will execute whenever a user accesses the plugin's settings page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-04T04:27:13.744Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12416", "state": "PUBLISHED", "dateUpdated": "2025-11-04T20:56:39.593Z", "dateReserved": "2025-10-28T15:45:10.914Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-04T04:27:13.744Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Pagerank tools", "vendor": "mahype", "versions": [{"lessThanOrEqual": "1.1.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Pagerank Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the pr_save_settings() function and insufficient input sanitization. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected scripts will execute whenever a user accesses the plugin's settings page."}, {"lang": "es", "value": "El plugin Pagerank Tools para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de Cross-Site Request Forgery en todas las versiones hasta la 1.1.5, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce en la funci\u00f3n pr_save_settings() y a una sanitizaci\u00f3n de entrada insuficiente. Esto hace posible que atacantes no autenticados inyecten scripts web maliciosos a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace. Los scripts inyectados se ejecutar\u00e1n cada vez que un usuario acceda a la p\u00e1gina de configuraci\u00f3n del plugin."}], "id": "CVE-2025-12416", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12416", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-04T20:56:29.746440Z", "version": "2.0.3"}}]}, "published": "2025-11-04T05:16:13.717", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/pagerank-tools/tags/1.1.5/functions.inc.php#L176"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/pagerank-tools/tags/1.1.5/functions.inc.php#L192"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/177900d6-c52e-4ac4-a74d-412e453f9d05?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T21:21:45.892233+00:00", "value": {"mitigation_remediation": ["Upgrade the Pagerank Tools plugin to the latest available version, which includes the missing nonce validation and proper input sanitization that removes this vulnerability.", "If an upgrade cannot be performed immediately, limit access to the plugin\u2019s settings page to authenticated administrators only and add an additional nonce check or IP\u2011whitelisting to guard against CSRF attempts.", "Scan the settings page for any injected scripts and delete them, ensuring that no malicious code remains on the site after remediation."], "summary": {"action": "Patch Now", "impact": "Cross\u2011Site Scripting via CSRF"}, "threat_synthesis": {"affected_systems": "All installations of the Pagerank Tools plugin from its initial release up to and including version\u202f1.1.5 are affected. The vendor listed is mahype:Pagerank Tools.", "description_and_impact": "The Pagerank Tools plugin for WordPress contains a stored cross\u2011site scripting flaw that is triggered by a cross\u2011site request forgery attack. The flaw arises from the pr_save_settings() function lacking nonce validation and performing insufficient input sanitization. An attacker who can persuade an administrator to submit a forged request can inject malicious scripts that execute for every user who later visits the plugin\u2019s settings page, compromising confidentiality and integrity of the site\u2019s data. This weakness is identified as CWE\u2011352.", "risk_and_exploitability": "The CVSS score of 6.1 indicates a moderate to high level of risk. The EPSS score of less than 1% suggests that so far the vulnerability has a very low exploitation probability, and it is not cataloged in the CISA KEV list. The likely attack vector requires an unauthenticated visitor to trick an administrator into clicking a malicious link or otherwise triggering a crafted HTTP request that bypasses the plugin\u2019s missing CSRF protection. Because the vulnerability leads to stored XSS, it can affect any user who logs into the site after the injection. The vulnerability can be exploited remotely without requiring privileged credentials, making the threat surface broad for sites that use this plugin."}}}}, "created": "2025-11-04T16:33:05.140429+00:00", "updated": "2026-04-22T21:30:27.817262+00:00", "vendors": ["mahype", "mahype$PRODUCT$pagerank_tools", "wordpress", "wordpress$PRODUCT$wordpress"]}