CVE-2025-13362

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13362", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-18T16:46:15.761Z", "datePublished": "2025-12-05T04:29:11.690Z", "dateUpdated": "2026-04-08T17:02:58.138Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:58.138Z"}, "affected": [{"vendor": "jevgenisultanov", "product": "Norby AI", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Norby AI plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Norby AI <= 1.0.3 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc6f6e2-6777-4056-95d0-e3d3e7ad7a22?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/norby-ai/trunk/api/save.php#L23"}, {"url": "https://plugins.trac.wordpress.org/browser/norby-ai/tags/1.0.3/api/save.php#L23"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "timeline": [{"time": "2025-12-04T16:26:16.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-05T16:04:58.929736Z", "id": "CVE-2025-13362", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T16:06:56.944Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13362", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T16:04:58.929736Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T16:06:19.920Z"}}], "cna": {"title": "Norby AI <= 1.0.3 - Cross-Site Request Forgery to Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "jevgenisultanov", "product": "Norby AI", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-04T16:26:16.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc6f6e2-6777-4056-95d0-e3d3e7ad7a22?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/norby-ai/trunk/api/save.php#L23"}, {"url": "https://plugins.trac.wordpress.org/browser/norby-ai/tags/1.0.3/api/save.php#L23"}], "descriptions": [{"lang": "en", "value": "The Norby AI plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:58.138Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13362", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:58.138Z", "dateReserved": "2025-11-18T16:46:15.761Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-05T04:29:11.690Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Norby AI", "vendor": "jevgenisultanov", "versions": [{"lessThanOrEqual": "1.0.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Norby AI plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Norby AI para WordPress es vulnerable a la Cross-Site Request Forgery en todas las versiones hasta la 1.0.3, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce en la funcionalidad de actualizaci\u00f3n de ajustes. Esto hace posible que atacantes no autenticados actualicen los ajustes del plugin e inyecten scripts web maliciosos a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-13362", "lastModified": "2026-09-25T23:10:00.463", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13362", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-05T16:04:58.929736Z", "version": "2.0.3"}}]}, "published": "2025-12-05T05:16:58.010", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/norby-ai/tags/1.0.3/api/save.php#L23"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/norby-ai/trunk/api/save.php#L23"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc6f6e2-6777-4056-95d0-e3d3e7ad7a22?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:46:44.089224+00:00", "value": {"mitigation_remediation": ["Install the latest Norby AI plugin version (\u22651.0.4) which implements nonce validation for the settings update endpoint.", "Verify that the endpoint now requires a valid nonce before processing changes; test by attempting a CSRF request or inspecting the code.", "Harden WordPress by limiting administrative accounts to necessary users, enabling core security features, and monitoring for unexpected configuration changes."], "summary": {"action": "Patch Now", "impact": "Unauthorized alteration of plugin settings and potential injection of malicious scripts via cross\u2011site request forgery"}, "threat_synthesis": {"affected_systems": "All installations of the Norby AI plugin distributed by jevgenisultanov that are version 1.0.3 or earlier are affected. Any WordPress site that has deployed one of these versions is at risk.", "description_and_impact": "The Norby AI plugin for WordPress suffers from a CSRF flaw caused by missing nonce validation on its settings update endpoint. This allows an unauthenticated attacker, by tricking an administrative user into clicking a crafted link, to change the plugin\u2019s configuration and inject arbitrary JavaScript. The vulnerability falls under CWE\u2011352. The compromised site can then serve malicious scripts to visitors, potentially leading to defacement or further attacks.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate impact; the EPSS score of less than 1% implies a very low likelihood of exploitation today. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires social engineering to persuade an authenticated administrator to perform the forged request, meaning that while the attack is technically straightforward, it relies on human manipulation and is therefore less likely to occur automatically."}}}}, "created": "2025-12-05T10:51:47.602698+00:00", "updated": "2026-04-21T18:00:11.705639+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}