PT-2025-46279 · WordPress · Slider

Johska · Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-12590

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions YSlider versions prior to 1.2

Description The YSlider plugin for WordPress is susceptible to Cross-Site Request Forgery leading to Stored Cross-Site Scripting. This is a result of absent nonce verification on the content configuration page and inadequate input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages by deceiving an administrator into performing an action, such as clicking a link. These injected scripts will execute whenever a user accesses the affected page.

Recommendations Update YSlider to version 1.2 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-12590

Affected Products

Slider

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12590 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/79f03bfe-dd7e-47e7-9e6f-4539d26cc101?source=cve · Note
• https://plugins.trac.wordpress.org/browser/yslider/tags/1.1/content-config.php#L48 · Note
• https://t.me/CVEtracker/36982 · Telegram Post
• https://twitter.com/CVEnew/status/1988095321872687125 · Twitter Post
• https://plugins.trac.wordpress.org/browser/yslider/tags/1.1/content-config.php#L2 · Note
• https://twitter.com/VulmonFeeds/status/1988250028628910104 · Twitter Post