CVE-2025-14077

The Simcast plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the settingsPage function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/simcast/tags/1.0.0/Simcast_OptionsManager.php#L257
• https://plugins.trac.wordpress.org/browser/simcast/trunk/Simcast_OptionsManager.php#L257
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e3917e1a-c230-46ad-9889-6ab233ecc4d0?source=cve

Published

Jan 7, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14071The Live Composer – Free WordPress Website Builder plugin fo…7.5
• CVE-2025-14072The Ninja Forms WordPress plugin before 3.13.3 allows unaut…5.3
• CVE-2025-14073The WooCommerce PayPal Payments plugin for WordPress is vuln…5.3
• CVE-2025-14074The PDF for Contact Form 7 + Drag and Drop Template Builder …4.3
• CVE-2025-14075The WP Hotel Booking plugin for WordPress is vulnerable to S…5.3
• CVE-2025-14076The iXML – Google XML sitemap generator plugin for WordPress…6.1
• CVE-2025-14078The PAYGENT for WooCommerce plugin for WordPress is vulnerab…5.3
• CVE-2025-14079The ELEX WordPress HelpDesk & Customer Ticketing System plug…5.3
• CVE-2025-1408The ProfileGrid – User Profiles, Groups and Communities plug…4.3
• CVE-2025-14080The Frontend Post Submission Manager Lite plugin for WordPre…5.3
• CVE-2025-14081The Ultimate Member plugin for WordPress is vulnerable to Pr…4.3
• CVE-2025-14082A flaw was found in Keycloak Admin REST (Representational St…2.7