CVE-2025-9625

The Coil Web Monetization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the coil-get-css-selector parameter handling in the maybe_restrict_content function. This makes it possible for unauthenticated attackers to trigger CSS selector detection functionality via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/coil-web-monetization/tags/2.0.2/includes/functions.php#L48
• https://plugins.trac.wordpress.org/browser/coil-web-monetization/tags/2.0.2/includes/gating/functions.php#L195
• https://plugins.trac.wordpress.org/browser/coil-web-monetization/tags/2.0.2/includes/gating/functions.php#L202
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa4cb93-7af3-4427-a17f-160b27fcebb8?source=cve

Published

Nov 18, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9619A security flaw has been discovered in E4 Sistemas Mercatus …6.9
• CVE-2025-9620The Seo Monster plugin for WordPress is vulnerable to Cross-…6.1
• CVE-2025-9621The WidgetPack Comment System plugin for WordPress is vulner…4.3
• CVE-2025-9622The WP Blast | SEO & Performance Booster plugin for WordPres…4.3
• CVE-2025-9623The Admin in English with Switch plugin for WordPress is vul…4.3
• CVE-2025-9624A vulnerability in OpenSearch allows attackers to cause Deni…7.5
• CVE-2025-9626The Page Blocks plugin for WordPress is vulnerable to Cross-…4.3
• CVE-2025-9627The Run Log plugin for WordPress is vulnerable to Cross-Site…4.3
• CVE-2025-9628The The integration of the AMO.CRM plugin for WordPress is v…4.3
• CVE-2025-9629The USS Upyun plugin for WordPress is vulnerable to Cross-Si…4.3
• CVE-2025-9630The WP SinoType plugin for WordPress is vulnerable to Cross-…4.3
• CVE-2025-9631The AutoCatSet plugin for WordPress is vulnerable to Cross-S…4.3