CVE-2025-14165

The Kirim.Email WooCommerce Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9. This is due to missing nonce validation on the plugin's settings page. This makes it possible for unauthenticated attackers to modify the plugin's API credentials and integration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/kirimemail-woocommerce-integration/tags/1.2.9/includes/class-kirimemail-woocommerce.php#L113
• https://plugins.trac.wordpress.org/browser/kirimemail-woocommerce-integration/tags/1.2.9/includes/class-kirimemail-woocommerce.php#L137
• https://plugins.trac.wordpress.org/browser/kirimemail-woocommerce-integration/trunk/includes/class-kirimemail-woocommerce.php#L113
• https://plugins.trac.wordpress.org/browser/kirimemail-woocommerce-integration/trunk/includes/class-kirimemail-woocommerce.php#L137
• https://www.wordfence.com/threat-intel/vulnerabilities/id/70993f6f-d9b0-49d5-b35e-e129f96529f6?source=cve

Published

Dec 12, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1416In Proget MDM, a low-privileged user can retrieve passwords …7
• CVE-2025-14160The Upcoming for Calendly plugin for WordPress is vulnerable…4.3
• CVE-2025-14161The Truefy Embed plugin for WordPress is vulnerable to Cross…4.3
• CVE-2025-14162The BMLT WordPress Plugin for WordPress is vulnerable to Cro…4.3
• CVE-2025-14163The Premium Addons for Elementor plugin for WordPress is vul…4.3
• CVE-2025-14164The Quran Gateway plugin for WordPress is vulnerable to Cros…4.3
• CVE-2025-14166The WPMasterToolKit plugin for WordPress is vulnerable to PH…5.3
• CVE-2025-14167The Remove Post Type Slug plugin for WordPress is vulnerable…4.3
• CVE-2025-14168The WP DB Booster plugin for WordPress is vulnerable to Cros…4.3
• CVE-2025-14169The FunnelKit - Funnel Builder for WooCommerce Checkout plug…7.5
• CVE-2025-1417In Proget MDM, a low-privileged user can access information …4.6
• CVE-2025-14170The Vimeo SimpleGallery plugin for WordPress is vulnerable t…4.3