CVE-2025-14846

The SocialChamp with WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.5. This is due to missing nonce validation on the wpsc_settings_tab_menu function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/auto-post-to-social-media-wp-to-social-champ/tags/1.3.3/admin/class-wp-socialchamp-settings-init.php#L157
• https://plugins.trac.wordpress.org/changeset/3467359/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bdbb660b-19aa-4c68-865c-0a51b85d1e5a?source=cve

Published

Jan 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14840Improper Check for Unusual or Exceptional Conditions vulnera…7.5
• CVE-2025-14841A flaw has been found in OFFIS DCMTK up to 3.6.9. The impact…3.3
• CVE-2025-14842The Drag and Drop Multiple File Upload – Contact Form 7 plug…6.1
• CVE-2025-14843The Wizit Gateway for WooCommerce plugin for WordPress is vu…5.3
• CVE-2025-14844The Membership Plugin – Restrict Content plugin for WordPres…7.5
• CVE-2025-14845The NS IE Compatibility Fixer plugin for WordPress is vulner…4.3
• CVE-2025-14847Mismatched length fields in Zlib compressed protocol headers…8.7
• CVE-2025-14848Advantech WebAccess/SCADA is vulnerable to absolute director…5.3
• CVE-2025-14849Advantech WebAccess/SCADA  is vulnerable to unrestricted fil…9.8
• CVE-2025-1485The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordP…4.8
• CVE-2025-14850Advantech WebAccess/SCADA is vulnerable to directory travers…9.1
• CVE-2025-14851The YaMaps for WordPress plugin for WordPress is vulnerable …6.4