PT-2025-52537 · WordPress · Wp Hallo Welt Plugin

Johska · Published 2025-12-20 · Updated 2025-12-20 · CVE-2025-13365

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Hallo Welt plugin versions prior to 1.5

Description The WP Hallo Welt plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the hallo welt seite function. This allows unauthenticated attackers to update plugin settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action, such as clicking a link. Insufficient input sanitization and output escaping can lead to Stored Cross-Site Scripting (XSS).

Recommendations Update the WP Hallo Welt plugin to version 1.5 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-13365

Affected Products

Wp Hallo Welt Plugin

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-13365 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-hallo-welt/trunk/hallowelt.php#L53 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e422aa58-a335-4734-bbcd-d400bd44bc89?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-hallo-welt/trunk/hallowelt.php#L66 · Note
• https://t.me/CVEtracker/40338 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-hallo-welt/tags/1.4./hallowelt.php#L53 · Note
• https://plugins.trac.wordpress.org/browser/wp-hallo-welt/trunk/hallowelt.php#L54 · Note
• https://t.me/cveNotify/146435 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-hallo-welt/trunk/hallowelt.php#L27 · Note
• https://plugins.trac.wordpress.org/browser/wp-hallo-welt/trunk/hallowelt.php#L15 · Note
• https://twitter.com/CVEnew/status/2002466745206874300 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2002268881373548645 · Twitter Post