CVE-2025-14158

The Coding Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update plugin settings including the theme configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/coding-blocks/tags/1.1.0/admin/pages/settings.php#L11
• https://plugins.trac.wordpress.org/browser/coding-blocks/trunk/admin/pages/settings.php#L11
• https://wordpress.org/plugins/coding-blocks/#developers
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5a4833de-d530-4bbf-ac28-e5d4b5f68f1e?source=cve

Published

Dec 12, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14151The SlimStat Analytics plugin for WordPress is vulnerable to…7.2
• CVE-2025-14153The Page Expire Popup/Redirection for WordPress plugin for W…6.5
• CVE-2025-14154The Better Messages – Live Chat for WordPress, BuddyPress, P…6.1
• CVE-2025-14155The Premium Addons for Elementor – Powerful Elementor Templa…5.3
• CVE-2025-14156The Fox LMS – WordPress LMS Plugin plugin for WordPress is v…9.8
• CVE-2025-14157GitLab has remediated an issue in GitLab CE/EE affecting all…6.5
• CVE-2025-14159The Secure Copy Content Protection and Content Locking plugi…4.3
• CVE-2025-1416In Proget MDM, a low-privileged user can retrieve passwords …7
• CVE-2025-14160The Upcoming for Calendly plugin for WordPress is vulnerable…4.3
• CVE-2025-14161The Truefy Embed plugin for WordPress is vulnerable to Cross…4.3
• CVE-2025-14162The BMLT WordPress Plugin for WordPress is vulnerable to Cro…4.3
• CVE-2025-14163The Premium Addons for Elementor plugin for WordPress is vul…4.3