PT-2026-2837 · Rndsand81 · Stopwords For Comments

Dayea Song · Published 2026-01-14 · Updated 2026-01-14 · CVE-2025-15376

NVD

CVSS v3.1

4.3

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

The Stopwords for comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing nonce validation on the 'set stopwords for comments' and 'delete stopwords for comments' functions. This makes it possible for unauthenticated attackers to add or delete stopwords via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-15376

Affected Products

Stopwords For Comments

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-15376 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/dd8c45c7-dbb2-46ab-8e50-e02062587b00?source=cve · Note
• https://plugins.trac.wordpress.org/browser/stopwords-for-comments/trunk/functions.php?marks=151,170#L151 · Note