CVE-2025-8383

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8383", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-30T18:13:07.830Z", "datePublished": "2025-10-31T08:25:55.580Z", "dateUpdated": "2026-04-08T17:20:51.353Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:20:51.353Z"}, "affected": [{"vendor": "averta", "product": "Depicter \u2014 Popup & Slider Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.0.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Depicter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 4.0.4. This is due to missing or incorrect nonce validation on the depicter-document-rules-store function. This makes it possible for unauthenticated attackers to modify document rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Depicter <= 4.0.4 - Cross-Site Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c54e5cd9-cc51-4367-afe0-11a6abfc0437?source=cve"}, {"url": "https://drive.google.com/file/d/1Fph3k-uyN6tX4hHeupjdYsZWZe3gYjqo/view?usp=sharing"}, {"url": "https://plugins.trac.wordpress.org/browser/depicter/trunk/app/routes/ajax.php#L473"}, {"url": "https://plugins.trac.wordpress.org/changeset/3384613/"}, {"url": "https://research.cleantalk.org/cve-2025-8383/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2025-10-07T11:18:32.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-30T20:18:20.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-22T17:22:28.186222Z", "id": "CVE-2025-8383", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-22T17:22:32.719Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8383", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-22T17:22:28.186222Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-31T17:51:12.889Z"}}], "cna": {"title": "Depicter <= 4.0.4 - Cross-Site Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "averta", "product": "Depicter \u2014 Popup & Slider Builder", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.0.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-07T11:18:32.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-30T20:18:20.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c54e5cd9-cc51-4367-afe0-11a6abfc0437?source=cve"}, {"url": "https://drive.google.com/file/d/1Fph3k-uyN6tX4hHeupjdYsZWZe3gYjqo/view?usp=sharing"}, {"url": "https://plugins.trac.wordpress.org/browser/depicter/trunk/app/routes/ajax.php#L473"}, {"url": "https://plugins.trac.wordpress.org/changeset/3384613/"}, {"url": "https://research.cleantalk.org/cve-2025-8383/"}], "descriptions": [{"lang": "en", "value": "The Depicter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 4.0.4. This is due to missing or incorrect nonce validation on the depicter-document-rules-store function. This makes it possible for unauthenticated attackers to modify document rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-19T15:40:16.289Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8383", "state": "PUBLISHED", "dateUpdated": "2025-12-22T17:22:32.719Z", "dateReserved": "2025-07-30T18:13:07.830Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-31T08:25:55.580Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Depicter \u2014 Popup & Slider Builder", "vendor": "averta", "versions": [{"lessThanOrEqual": "4.0.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Depicter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 4.0.4. This is due to missing or incorrect nonce validation on the depicter-document-rules-store function. This makes it possible for unauthenticated attackers to modify document rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Depicter para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en versiones inferiores o iguales a 4.0.4. Esto se debe a la validaci\u00f3n nonce ausente o incorrecta en la funci\u00f3n depicter-document-rules-store. Esto hace posible que atacantes no autenticados modifiquen las reglas del documento a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-8383", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8383", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-22T17:22:28.186222Z", "version": "2.0.3"}}]}, "published": "2025-10-31T09:15:48.573", "references": [{"source": "security@wordfence.com", "url": "https://drive.google.com/file/d/1Fph3k-uyN6tX4hHeupjdYsZWZe3gYjqo/view?usp=sharing"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/depicter/trunk/app/routes/ajax.php#L473"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3384613/"}, {"source": "security@wordfence.com", "url": "https://research.cleantalk.org/cve-2025-8383/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c54e5cd9-cc51-4367-afe0-11a6abfc0437?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T19:06:07.919170+00:00", "value": {"mitigation_remediation": ["Upgrade the Depicter plugin to a version newer than 4.0.4, which resolves the nonce validation issue.", "Verify that future updates include proper nonce checks for the depicter-document-rules-store endpoint and that the endpoint requires a valid secret token.", "As a temporary measure, restrict access to the Ajax endpoint to authenticated administrators or disable the affected feature until a patch is applied."], "summary": {"action": "Update Plugin", "impact": "Cross\u2011Site Request Forgery allowing unauthorized changes to Depicter document rules"}, "threat_synthesis": {"affected_systems": "The defect exists in the Depicter Popup & Slider Builder plugin by averta for WordPress, affecting all releases up to and including version 4.0.4. Administrators running these vulnerable versions are at risk; users of newer releases are unaffected.", "description_and_impact": "The vulnerability arises from missing or incorrect nonce validation on the depicter-document-rules-store function in the Depicter WordPress plugin. Because the request is not properly authenticated, an attacker who can trick a site administrator into visiting a crafted URL can change document rules without legitimate credentials. The impact is limited to modification of content rules, but it can alter how sliders and pop\u2011ups behave, potentially enabling further attacks or disrupting site functionality. The flaw is identified as a CSRF weakness (CWE\u2011352).", "risk_and_exploitability": "The CVSS score of 4.3 places the issue in the medium severity range. An EPSS score of less than 1% suggests a very low probability of exploitation at this time. The vulnerability is not listed in CISA\u2019s KEV catalog, indicating no known widespread attacks. Likely exploitation would require social engineering to get an admin to click a malicious link, after which the forged request would update rule settings."}}}}, "created": "2025-11-03T10:45:00.431955+00:00", "updated": "2026-04-20T19:15:15.044734+00:00", "vendors": ["averta", "averta$PRODUCT$slider_and_popup_builder_by_depicter", "wordpress", "wordpress$PRODUCT$wordpress"]}