CVE-2025-12590

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12590", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-31T22:37:48.878Z", "datePublished": "2025-11-11T03:30:42.295Z", "dateUpdated": "2026-04-08T17:02:15.805Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:15.805Z"}, "affected": [{"vendor": "andreaferracani", "product": "YSlider", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.1. This is due to missing nonce verification on the content configuration page and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a forged request granted they can trick an administrator into performing an action such as clicking on a link. The injected scripts will execute whenever a user accesses an injected page."}], "title": "YSlider <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/79f03bfe-dd7e-47e7-9e6f-4539d26cc101?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/yslider/tags/1.1/content-config.php#L2"}, {"url": "https://plugins.trac.wordpress.org/browser/yslider/tags/1.1/content-config.php#L48"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2025-11-10T14:57:45.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-14T15:21:10.894666Z", "id": "CVE-2025-12590", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T15:31:43.208Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12590", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-14T15:21:10.894666Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T15:21:11.531Z"}}], "cna": {"title": "YSlider <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "andreaferracani", "product": "YSlider", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-10T14:57:45.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/79f03bfe-dd7e-47e7-9e6f-4539d26cc101?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/yslider/tags/1.1/content-config.php#L2"}, {"url": "https://plugins.trac.wordpress.org/browser/yslider/tags/1.1/content-config.php#L48"}], "descriptions": [{"lang": "en", "value": "The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.1. This is due to missing nonce verification on the content configuration page and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a forged request granted they can trick an administrator into performing an action such as clicking on a link. The injected scripts will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:15.805Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12590", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:15.805Z", "dateReserved": "2025-10-31T22:37:48.878Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-11T03:30:42.295Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "YSlider", "vendor": "andreaferracani", "versions": [{"lessThanOrEqual": "1.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.1. This is due to missing nonce verification on the content configuration page and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a forged request granted they can trick an administrator into performing an action such as clicking on a link. The injected scripts will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin YSlider para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n en sitios cruzados a cross-site scripting almacenado en todas las versiones hasta la 1.1, inclusive. Esto se debe a la falta de verificaci\u00f3n de nonce en la p\u00e1gina de configuraci\u00f3n de contenido y a la sanitizaci\u00f3n insuficiente de la entrada y al escape de salida insuficiente. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador para que realice una acci\u00f3n, como hacer clic en un enlace. Los scripts inyectados se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-12590", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12590", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-14T15:21:10.894666Z", "version": "2.0.3"}}]}, "published": "2025-11-11T04:15:47.393", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/yslider/tags/1.1/content-config.php#L2"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/yslider/tags/1.1/content-config.php#L48"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/79f03bfe-dd7e-47e7-9e6f-4539d26cc101?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:29:17.559238+00:00", "value": {"mitigation_remediation": ["Install the latest YSlider release (greater than 1.1) to remove the CSRF and XSS flaw.", "If an upgrade is not immediately possible, deactivate or uninstall the YSlider plugin to eliminate the attack surface.", "Ensure that only trusted administrators have access to the site and that they are instructed to avoid clicking suspicious links; consider adding a security plugin that blocks CSRF attacks."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Andreaferracani YSlider, all releases up to and including version 1.1, installed on WordPress sites.", "description_and_impact": "The YSlider plugin for WordPress lacks nonce verification on its content configuration page and fails to sanitize user input or escape output. This flaw lets an unauthenticated attacker send a forged request that, once an administrator unknowingly submits it, injects arbitrary JavaScript into a stored page. The injected script runs whenever a visitor loads the affected page, enabling front\u2011end code injection and potential credential theft or session hijacking.", "risk_and_exploitability": "The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low current exploitation probability and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to trick an administrator into performing a specific action; once the forged request is processed, malicious script is stored and later executed for any user who visits the compromised page."}}}}, "created": "2025-11-12T12:47:50.507435+00:00", "updated": "2026-04-21T18:30:27.591042+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}