CVE-2025-12589

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12589", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-31T22:34:41.036Z", "datePublished": "2025-11-11T03:30:40.408Z", "dateUpdated": "2026-04-08T16:56:15.087Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:15.087Z"}, "affected": [{"vendor": "baronen", "product": "WP-Walla", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.5.3.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 0.5.3.5. This is due to missing nonce verification on the settings page and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}], "title": "WP-Walla <= 0.5.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5ed9f7a1-54ef-4f88-b89c-756b8b646254?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-walla/tags/0.5.3.5/wpwalla_admin.php#L2"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-walla/tags/0.5.3.5/wpwalla_admin.php#L83"}, {"url": "https://developer.wordpress.org/plugins/security/nonces/"}, {"url": "https://developer.wordpress.org/reference/functions/esc_attr/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2025-11-10T15:07:10.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-12T15:54:36.257429Z", "id": "CVE-2025-12589", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T20:06:36.152Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12589", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T15:54:36.257429Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T15:58:44.637Z"}}], "cna": {"title": "WP-Walla <= 0.5.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "baronen", "product": "WP-Walla", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.5.3.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-10T15:07:10.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5ed9f7a1-54ef-4f88-b89c-756b8b646254?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-walla/tags/0.5.3.5/wpwalla_admin.php#L2"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-walla/tags/0.5.3.5/wpwalla_admin.php#L83"}, {"url": "https://developer.wordpress.org/plugins/security/nonces/"}, {"url": "https://developer.wordpress.org/reference/functions/esc_attr/"}], "descriptions": [{"lang": "en", "value": "The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 0.5.3.5. This is due to missing nonce verification on the settings page and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:15.087Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12589", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:56:15.087Z", "dateReserved": "2025-10-31T22:34:41.036Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-11T03:30:40.408Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP-Walla", "vendor": "baronen", "versions": [{"lessThanOrEqual": "0.5.3.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 0.5.3.5. This is due to missing nonce verification on the settings page and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin WP-Walla para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n en sitios cruzados a cross-site scripting almacenado en todas las versiones hasta la 0.5.3.5, inclusive. Esto se debe a la falta de verificaci\u00f3n de nonce en la p\u00e1gina de configuraci\u00f3n y a la sanitizaci\u00f3n insuficiente de la entrada y al escape insuficiente de la salida. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en las p\u00e1ginas a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-12589", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12589", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-12T15:54:36.257429Z", "version": "2.0.3"}}]}, "published": "2025-11-11T04:15:47.230", "references": [{"source": "security@wordfence.com", "url": "https://developer.wordpress.org/plugins/security/nonces/"}, {"source": "security@wordfence.com", "url": "https://developer.wordpress.org/reference/functions/esc_attr/"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-walla/tags/0.5.3.5/wpwalla_admin.php#L2"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-walla/tags/0.5.3.5/wpwalla_admin.php#L83"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5ed9f7a1-54ef-4f88-b89c-756b8b646254?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:30:25.486062+00:00", "value": {"mitigation_remediation": ["Upgrade WP\u2011Walla to the latest version that includes nonce verification and proper output sanitization.", "If an upgrade is not immediately possible, remove the WP\u2011Walla plugin from the site to eliminate the attack surface.", "Monitor administrative activity and user sessions for suspicious requests that could indicate a successful CSRF attempt."], "summary": {"action": "Immediate Patch", "impact": "Stored XSS via CSRF"}, "threat_synthesis": {"affected_systems": "WordPress websites that have the WP\u2011Walla plugin from vendor baronen, in versions 0.5.3.5 and all earlier releases.", "description_and_impact": "The WP\u2011Walla plugin does not validate nonces on its settings page, allowing an unauthenticated user to submit a forged request that an administrator may unknowingly execute. Input supplied in that request is saved without proper sanitization, and when the plugin later outputs the stored setting, the embedded script runs in visitors\u2019 browsers. This stored cross\u2011site scripting, enabled by a CSRF weakness (CWE\u2011352), gives an attacker a powerful vector to inject arbitrary code into the site and potentially manipulate or deface content for all users.", "risk_and_exploitability": "The CVSS score of 6.1 indicates moderate severity, and the EPSS score of less than 1% shows that actual exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to lure an administrator into clicking a crafted link or submitting a form that triggers the settings update, after which the injected script becomes part of the page content for all visitors."}}}}, "created": "2025-11-12T12:47:56.097374+00:00", "updated": "2026-04-21T18:30:27.592045+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}