CVE-2025-14454

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14454", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-10T14:39:39.550Z", "datePublished": "2025-12-13T03:20:26.993Z", "dateUpdated": "2026-04-08T17:29:06.587Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:06.587Z"}, "affected": [{"vendor": "ays-pro", "product": "Image Slider by Ays- Responsive Slider and Carousel", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.7.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Image Slider by Ays- Responsive Slider and Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.0. This is due to missing or incorrect nonce validation on the bulk delete functionality. This makes it possible for unauthenticated attackers to delete arbitrary sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Image Slider by Ays- Responsive Slider and Carousel <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e211df80-aab7-43a1-8c11-a472f90ef4c6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ays-slider/trunk/includes/lists/class-ays-slider-list-table.php#L430"}, {"url": "https://plugins.trac.wordpress.org/browser/ays-slider/tags/2.7.0/includes/lists/class-ays-slider-list-table.php#L430"}, {"url": "https://plugins.trac.wordpress.org/changeset/3417916/ays-slider/tags/2.7.1/includes/lists/class-ays-slider-list-table.php?old=3278880&old_path=ays-slider%2Ftags%2F2.7.0%2Fincludes%2Flists%2Fclass-ays-slider-list-table.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Camilla Flocco"}], "timeline": [{"time": "2025-12-10T14:54:48.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-12T14:34:25.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:43:50.736400Z", "id": "CVE-2025-14454", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:48:51.517Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14454", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T15:43:50.736400Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:43:51.715Z"}}], "cna": {"title": "Image Slider by Ays- Responsive Slider and Carousel <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Camilla Flocco"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "ays-pro", "product": "Image Slider by Ays- Responsive Slider and Carousel", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.7.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-10T14:54:48.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-12T14:34:25.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e211df80-aab7-43a1-8c11-a472f90ef4c6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ays-slider/trunk/includes/lists/class-ays-slider-list-table.php#L430"}, {"url": "https://plugins.trac.wordpress.org/browser/ays-slider/tags/2.7.0/includes/lists/class-ays-slider-list-table.php#L430"}, {"url": "https://plugins.trac.wordpress.org/changeset/3417916/ays-slider/tags/2.7.1/includes/lists/class-ays-slider-list-table.php?old=3278880&old_path=ays-slider%2Ftags%2F2.7.0%2Fincludes%2Flists%2Fclass-ays-slider-list-table.php"}], "descriptions": [{"lang": "en", "value": "The Image Slider by Ays- Responsive Slider and Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.0. This is due to missing or incorrect nonce validation on the bulk delete functionality. This makes it possible for unauthenticated attackers to delete arbitrary sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:06.587Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14454", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:29:06.587Z", "dateReserved": "2025-12-10T14:39:39.550Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-13T03:20:26.993Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Image Slider by Ays- Responsive Slider and Carousel", "vendor": "ays-pro", "versions": [{"lessThanOrEqual": "2.7.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Image Slider by Ays- Responsive Slider and Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.0. This is due to missing or incorrect nonce validation on the bulk delete functionality. This makes it possible for unauthenticated attackers to delete arbitrary sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Image Slider by Ays- Responsive Slider and Carousel para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 2.7.0, inclusive. Esto se debe a la falta o la incorrecci\u00f3n de la validaci\u00f3n de nonce en la funcionalidad de eliminaci\u00f3n masiva. Esto hace posible que atacantes no autenticados eliminen deslizadores arbitrarios mediante una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-14454", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14454", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:43:50.736400Z", "version": "2.0.3"}}]}, "published": "2025-12-13T16:16:50.163", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ays-slider/tags/2.7.0/includes/lists/class-ays-slider-list-table.php#L430"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ays-slider/trunk/includes/lists/class-ays-slider-list-table.php#L430"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3417916/ays-slider/tags/2.7.1/includes/lists/class-ays-slider-list-table.php?old=3278880&old_path=ays-slider%2Ftags%2F2.7.0%2Fincludes%2Flists%2Fclass-ays-slider-list-table.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e211df80-aab7-43a1-8c11-a472f90ef4c6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:26:06.860740+00:00", "value": {"mitigation_remediation": ["Upgrade the Image Slider by Ays plugin to version 2.7.1 or later to remove the CSRF flaw", "If an upgrade is not immediately possible, restrict or disable the bulk delete capability for users without administrative privileges", "Audit the site for any deleted sliders and regenerate or restore them if possible", "Monitor administrative activity logs for unexpected delete actions in the slider interface"], "summary": {"action": "Patch Now", "impact": "Cross\u2011Site Request Forgery allowing arbitrary slider deletion"}, "threat_synthesis": {"affected_systems": "All WordPress installations running the Image Slider by Ays\u2011Responsive Slider and Carousel plugin version 2.7.0 or earlier are affected. The vulnerability exists for the plugin as a whole, regardless of specific slider content, and therefore any site that has not upgraded past version 2.7.0 is at risk. There is no indication that other plugins or core WordPress would be impacted.", "description_and_impact": "The WordPress plugin Image Slider by Ays is vulnerable to a cross\u2011site request forgery attack that permits an unauthenticated attacker to delete sliders. The flaw arises from missing or incorrect nonce validation on the bulk delete functionality, allowing an attacker to trick an authenticated site administrator into executing a forged delete request. The effect is loss of slider content, potential disruption of the site\u2019s appearance, and loss of administrative control over media items.", "risk_and_exploitability": "The CVSS score of 4.3 classifies the weakness as moderate severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. Because the vulnerability requires the victim to be an authenticated site administrator who can be lured into clicking a crafted link, the attack vector is inferred to be CSRF via a user action. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited or recognized as a known exploit."}}}}, "created": "2025-12-14T21:15:07.194159+00:00", "updated": "2026-04-20T21:30:18.581784+00:00", "vendors": ["ays-pro", "ays-pro$PRODUCT$image_slider", "wordpress", "wordpress$PRODUCT$wordpress"]}