BaseFortify

Publication date: 2025-11-11

Last updated on: 2025-11-12

Assigner: Wordfence

Description

The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.1. This is due to missing nonce verification on the content configuration page and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a forged request granted they can trick an administrator into performing an action such as clicking on a link. The injected scripts will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-11

Last Modified

2025-11-12

Generated

2026-07-06

AI Q&A

2025-11-11

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12590

Affected Vendors & Products

Vendor	Product	Version / Range
wordpress	yslider	1.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

The vulnerability in the YSlider plugin for WordPress is a Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS). It occurs because the plugin lacks nonce verification on its content configuration page and does not properly sanitize or escape input and output. This allows an unauthenticated attacker to inject malicious scripts into pages by tricking an administrator into performing an action, such as clicking a link. The injected scripts then execute whenever a user accesses the affected page.

Impact Analysis

This vulnerability can allow attackers to execute arbitrary scripts in the context of the affected website. This can lead to unauthorized actions performed on behalf of users, theft of sensitive information such as cookies or session tokens, defacement of the website, or distribution of malware. Since the attack requires tricking an administrator, it can compromise administrative functions and potentially affect all users who visit the injected pages.

Hi! I’m here to help you understand CVE-2025-12590. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70