CVE-2025-10302

The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on thesave_options() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/ultimate-viral-quiz/trunk/bestbugcore/classes/options.class.php#L28
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fbe32b9e-a6da-4257-b740-63a143cee42f?source=cve

Published

Oct 3, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10295The Angel – Fashion Model Agency WordPress CMS Theme theme f…6.4
• CVE-2025-10298Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-10299The WPBifröst – Instant Passwordless Temporary Login Links p…8.8
• CVE-2025-1030Exposure of Private Personal Information to an Unauthorized …7.5
• CVE-2025-10300The TopBar plugin for WordPress is vulnerable to Cross-Site …4.3
• CVE-2025-10301The FunKItools plugin for WordPress is vulnerable to Cross-S…4.3
• CVE-2025-10303The Library Management System plugin for WordPress is vulner…4.3
• CVE-2025-10304The Everest Backup – WordPress Cloud Backup, Migration, Rest…5.3
• CVE-2025-10305The Secure Passkeys plugin for WordPress is vulnerable to un…5.3
• CVE-2025-10306The Backup Bolt plugin for WordPress is vulnerable to arbitr…3.8
• CVE-2025-10307The Backuply – Backup, Restore, Migrate and Clone plugin for…6.5
• CVE-2025-10309The PayPal Forms plugin for WordPress is vulnerable to Cross…4.3