CVE-2025-12589

The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 0.5.3.5. This is due to missing nonce verification on the settings page and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a forged request granted they can trick an administrator into performing an action such as clicking on a link.

• CWE-352

• https://developer.wordpress.org/plugins/security/nonces/
• https://developer.wordpress.org/reference/functions/esc_attr/
• https://plugins.trac.wordpress.org/browser/wp-walla/tags/0.5.3.5/wpwalla_admin.php#L2
• https://plugins.trac.wordpress.org/browser/wp-walla/tags/0.5.3.5/wpwalla_admin.php#L83
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5ed9f7a1-54ef-4f88-b89c-756b8b646254?source=cve

Published

Nov 11, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12583The Simple Downloads List plugin for WordPress is vulnerable…6.4
• CVE-2025-12584The Quick View for WooCommerce plugin for WordPress is vulne…5.3
• CVE-2025-12585The MxChat – AI Chatbot for WordPress plugin for WordPress i…5.3
• CVE-2025-12586The Conditional Maintenance Mode for WordPress plugin for Wo…4.3
• CVE-2025-12587The Peer Publish plugin for WordPress is vulnerable to Cross…4.3
• CVE-2025-12588The USB Qr Code Scanner For Woocommerce plugin for WordPress…4.3
• CVE-2025-1259On affected platforms running Arista EOS with OpenConfig con…7.7
• CVE-2025-12590The YSlider plugin for WordPress is vulnerable to Cross-Site…6.1
• CVE-2025-12592Legacy Vivotek Device firmware uses default credetials for t…9.3
• CVE-2025-12593A vulnerability was identified in code-projects Simple Onlin…7.2
• CVE-2025-12594A security flaw has been discovered in code-projects Simple …7.2
• CVE-2025-12595A weakness has been identified in Tenda AC23 16.03.07.52. Th…9.8