PT-2025-46278 · WordPress · Wp Wall

Johska · Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-12589

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP-Walla plugin for WordPress versions up to and including 0.5.3.5

Description The WP-Walla plugin for WordPress is susceptible to Cross-Site Request Forgery leading to Stored Cross-Site Scripting. This is a result of lacking nonce verification on the settings page and inadequate input sanitization and output escaping. An unauthenticated attacker can inject malicious web scripts into pages by forging a request, provided they can deceive an administrator into performing an action, such as clicking a link.

Recommendations Update the WP-Walla plugin to a version newer than 0.5.3.5.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-12589

Affected Products

Wp Wall

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-12589 · Security Note
• https://t.me/CVEtracker/36981 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1988244908633678067 · Twitter Post
• https://developer.wordpress.org/plugins/security/nonces · Note
• https://plugins.trac.wordpress.org/browser/wp-walla/tags/0.5.3.5/wpwalla_admin.php#L2 · Note
• https://twitter.com/CVEnew/status/1988095327665074642 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-walla/tags/0.5.3.5/wpwalla_admin.php#L83 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5ed9f7a1-54ef-4f88-b89c-756b8b646254?source=cve · Note
• https://developer.wordpress.org/reference/functions/esc_attr · Note