PT-2026-1567 · WordPress · Ns Ie Compatibility Fixer

Muhammad Afnaan · Published 2026-01-07 · Updated 2026-01-07 · CVE-2025-14845

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions NS IE Compatibility Fixer plugin for WordPress versions through 2.1.5

Description The software is susceptible to Cross-Site Request Forgery (CSRF) due to the absence of nonce validation on the settings update functionality. This allows attackers to modify the plugin’s settings by deceiving an administrator into performing an action, such as clicking a link. The attack requires the attacker to forge a request.

Recommendations Update the NS IE Compatibility Fixer plugin to a version newer than 2.1.5.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-14845

Affected Products

Ns Ie Compatibility Fixer

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-14845 · Security Note
• https://plugins.trac.wordpress.org/browser/ns-ie-compatibility-fixer/tags/2.1.5/ns-admin-options/ns_admin_option_dashboard.php#L30 · Note
• https://plugins.trac.wordpress.org/browser/ns-ie-compatibility-fixer/tags/2.1.5/ns-admin-options/ns_admin_option_dashboard.php#L29 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3c25b462-cb9e-4250-bb17-9f2a0bd7665e?source=cve · Note
• https://developer.wordpress.org/plugins/security/nonces · Note
• https://developer.wordpress.org/reference/functions/wp_verify_nonce · Note
• https://twitter.com/CVEnew/status/2008795329588600907 · Twitter Post
• https://developer.wordpress.org/reference/functions/check_admin_referer · Note
• https://plugins.trac.wordpress.org/browser/ns-ie-compatibility-fixer/tags/2.1.5/ns-admin-options/ns_settings_custom.php#L8 · Note