CVE-2025-7683

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7683", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-15T18:45:41.808Z", "datePublished": "2025-08-16T03:38:51.686Z", "dateUpdated": "2026-04-08T17:11:13.339Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:13.339Z"}, "affected": [{"vendor": "janyksteenbeek", "product": "LatestCheckins", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The LatestCheckins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. This is due to missing or incorrect nonce validation on the 'LatestCheckins' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "LatestCheckins <= 1 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9b2b1500-04b6-40fb-8d1f-9c210f95788b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/latestcheckins/trunk/wzw-admin.php"}, {"url": "https://wordpress.org/plugins/latestcheckins/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2025-08-15T14:46:11.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-18T13:34:58.887253Z", "id": "CVE-2025-7683", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-18T13:35:07.502Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7683", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-18T13:34:58.887253Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-18T13:35:03.428Z"}}], "cna": {"title": "LatestCheckins <= 1 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "janyksteenbeek", "product": "LatestCheckins", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-15T14:46:11.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9b2b1500-04b6-40fb-8d1f-9c210f95788b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/latestcheckins/trunk/wzw-admin.php"}, {"url": "https://wordpress.org/plugins/latestcheckins/"}], "descriptions": [{"lang": "en", "value": "The LatestCheckins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. This is due to missing or incorrect nonce validation on the 'LatestCheckins' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-08-16T03:38:51.686Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7683", "state": "PUBLISHED", "dateUpdated": "2025-08-18T13:35:07.502Z", "dateReserved": "2025-07-15T18:45:41.808Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-16T03:38:51.686Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "LatestCheckins", "vendor": "janyksteenbeek", "versions": [{"lessThanOrEqual": "1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The LatestCheckins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. This is due to missing or incorrect nonce validation on the 'LatestCheckins' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento LatestCheckins para WordPress es vulnerable a cross-site request forgery en todas las versiones hasta la 1 (incluida). Esto se debe a la falta o la validaci\u00f3n incorrecta de nonce en la p\u00e1gina \"LatestCheckins\". Esto permite que atacantes no autenticados actualicen la configuraci\u00f3n e inyecten scripts web maliciosos mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-7683", "lastModified": "2026-06-17T10:05:27.633", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7683", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-18T13:34:58.887253Z", "version": "2.0.3"}}]}, "published": "2025-08-16T04:16:07.460", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/latestcheckins/trunk/wzw-admin.php"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/latestcheckins/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9b2b1500-04b6-40fb-8d1f-9c210f95788b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:31:12.999779+00:00", "value": {"mitigation_remediation": ["Update the LatestCheckins plugin to the latest released version that fixes the nonce validation issue", "If an update is not feasible, disable or remove the 'LatestCheckins' page from public view or restrict it to trusted administrator accounts only", "In the interim, enforce a Content Security Policy that blocks execution of inline scripts and requires script\u2011src from trusted origins, to mitigate the impact of any injected scripts", "Additionally, scan the site for any remnants of injected scripts and remove them manually"], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting via CSRF"}, "threat_synthesis": {"affected_systems": "All installations of the WordPress plugin LatestCheckins version 1.0 or earlier, released by vendor janyksteenbeek. These installations are affected regardless of configuration, as the vulnerability exists in the core plugin code before any settings changes.", "description_and_impact": "The LatestCheckins plugin for WordPress is vulnerable to a Cross\u2011Site Request Forgery flaw in all versions up to and including 1. This flaw arises because the plugin fails to validate or incorrectly validates the nonce on the 'LatestCheckins' page, allowing an unauthenticated attacker to forge a request that updates plugin settings. By submitting a crafted request, an attacker can inject malicious scripts that are then stored by the plugin and executed in the browser context of site administrators or other logged\u2011in users. The result is a stored Cross\u2011Site Scripting vulnerability that compromises user sessions and can lead to account takeover, data exfiltration, or defacement.", "risk_and_exploitability": "The CVSS score for this vulnerability is 6.1, indicating a medium level severity. The EPSS score is below 1%, showing that the probability of widespread exploitation is low at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by persuading a site administrator to visit a malicious link that performs an authenticated or unauthenticated request to the plugin page. With the missing nonce check, the request will be processed and malicious scripts will be saved in the plugin's configuration, later executed when the admin accesses the page. Given the low EPSS, immediate risk is moderate, but since stored XSS can be leveraged for credential theft, the vulnerability should be considered a high business risk."}}}}, "created": "2025-08-18T20:59:30.034812+00:00", "updated": "2026-04-21T03:45:27.370793+00:00", "vendors": ["janyksteenbeek", "janyksteenbeek$PRODUCT$latestcheckins", "wordpress", "wordpress$PRODUCT$wordpress"]}