CVE-2025-14391

The Simple Theme Changer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/simple-theme-changer/tags/1.0/class_theme_changer.php#L262
• https://www.wordfence.com/threat-intel/vulnerabilities/id/efa9b44d-8b6c-4a11-82af-cecc2c202024?source=cve

Published

Dec 12, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14386The Search Atlas SEO – Premier SEO Plugin for One-Click WP P…8.8
• CVE-2025-14387The LearnPress – WordPress LMS Plugin plugin for WordPress i…6.4
• CVE-2025-14388The PhastPress plugin for WordPress is vulnerable to Unauthe…9.8
• CVE-2025-14389The WPBlogSyn plugin for WordPress is vulnerable to Cross-Si…4.3
• CVE-2025-1439The Advanced iFrame plugin for WordPress is vulnerable to St…5.4
• CVE-2025-14390The Video Merchant plugin for WordPress is vulnerable to Cro…8.8
• CVE-2025-14392The Simple Theme Changer plugin for WordPress is vulnerable …4.3
• CVE-2025-14393The Wpik WordPress Basic Ajax Form plugin for WordPress is v…6.4
• CVE-2025-14394The Popover Windows plugin for WordPress is vulnerable to Cr…4.3
• CVE-2025-14395The Popover Windows plugin for WordPress is vulnerable to un…4.3
• CVE-2025-14397The Postem Ipsum plugin for WordPress is vulnerable to unaut…8.8
• CVE-2025-14399The Download Plugins and Themes in ZIP from Dashboard plugin…4.3