CVE-2025-14062

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14062", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-04T20:06:50.535Z", "datePublished": "2025-12-12T03:20:55.825Z", "dateUpdated": "2026-04-08T17:21:21.424Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:21.424Z"}, "affected": [{"vendor": "tekafran", "product": "Animated Pixel Marquee Creator", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Animated Pixel Marquee Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery via the 'marquee' parameter in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the marquee deletion function. This makes it possible for unauthenticated attackers to delete arbitrary marquees via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Animated Pixel Marquee Creator <= 1.0.0 - Cross-Site Request Forgery via 'marquee' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c727ab41-c091-4fff-8abe-f52a904cd9f0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/animated-pixel-marquee-creator/trunk/admin/marquees_list.php#L44"}, {"url": "https://plugins.trac.wordpress.org/browser/animated-pixel-marquee-creator/tags/1.0.0/admin/marquees_list.php#L44"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Camilla Flocco"}], "timeline": [{"time": "2025-12-11T14:25:34.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-12T16:21:54.053880Z", "id": "CVE-2025-14062", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T16:22:06.688Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14062", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T16:21:54.053880Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T16:22:01.500Z"}}], "cna": {"title": "Animated Pixel Marquee Creator <= 1.0.0 - Cross-Site Request Forgery via 'marquee' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Camilla Flocco"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "tekafran", "product": "Animated Pixel Marquee Creator", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-11T14:25:34.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c727ab41-c091-4fff-8abe-f52a904cd9f0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/animated-pixel-marquee-creator/trunk/admin/marquees_list.php#L44"}, {"url": "https://plugins.trac.wordpress.org/browser/animated-pixel-marquee-creator/tags/1.0.0/admin/marquees_list.php#L44"}], "descriptions": [{"lang": "en", "value": "The Animated Pixel Marquee Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery via the 'marquee' parameter in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the marquee deletion function. This makes it possible for unauthenticated attackers to delete arbitrary marquees via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:21.424Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14062", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:21:21.424Z", "dateReserved": "2025-12-04T20:06:50.535Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-12T03:20:55.825Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Animated Pixel Marquee Creator", "vendor": "tekafran", "versions": [{"lessThanOrEqual": "1.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Animated Pixel Marquee Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery via the 'marquee' parameter in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the marquee deletion function. This makes it possible for unauthenticated attackers to delete arbitrary marquees via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Animated Pixel Marquee Creator para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados a trav\u00e9s del par\u00e1metro 'marquee' en todas las versiones hasta la 1.0.0, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce en la funci\u00f3n de eliminaci\u00f3n de marquesinas. Esto hace posible que atacantes no autenticados eliminen marquesinas arbitrarias a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-14062", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14062", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-12T16:21:54.053880Z", "version": "2.0.3"}}]}, "published": "2025-12-12T04:15:46.883", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/animated-pixel-marquee-creator/tags/1.0.0/admin/marquees_list.php#L44"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/animated-pixel-marquee-creator/trunk/admin/marquees_list.php#L44"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c727ab41-c091-4fff-8abe-f52a904cd9f0?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:29:35.681513+00:00", "value": {"mitigation_remediation": ["Upgrade Animated Pixel Marquee Creator to a version that implements nonce validation for marquee deletion", "Disable or remove the plugin if an upgrade is not yet available", "Implement a site\u2011wide CSRF filter or WAF rule that blocks unauthorized delete requests to /admin/marquees_list.php"], "summary": {"action": "Update Plugin", "impact": "Unauthorized Deletion of Marquee Content"}, "threat_synthesis": {"affected_systems": "Any WordPress installation running tekafran\u2019s Animated Pixel Marquee Creator version 1.0.0 or earlier is affected. The vulnerability targets the marquees_list.php deletion functionality exposed to all users with administrative privileges.", "description_and_impact": "The plugin\u2019s marquee deletion endpoint lacks nonce validation, allowing a Cross\u2011Site Request Forgery attack. An unauthenticated adversary can create a forged request that, when triggered by a site administrator\u2014such as clicking a malicious link\u2014removes any marquee from the site. This flaw gives the attacker control over content deletion without direct site access.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate risk; the EPSS score of < 1% suggests exploitation is unlikely in the wild, and the vulnerability is not yet catalogued in CISA KEV. Attackers would need to trick a site administrator into visiting a crafted URL to exploit the flaw, making it a CSRF\u2011based attack with a high prerequisite of social engineering."}}}}, "created": "2025-12-12T08:47:47.467212+00:00", "updated": "2026-04-20T21:30:18.598877+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}