CVE-2025-12589

Name of the Vulnerable Software and Affected Versions WP-Walla plugin for WordPress versions up to and including 0.5.3.5

Description The WP-Walla plugin for WordPress is susceptible to Cross-Site Request Forgery leading to Stored Cross-Site Scripting. This is a result of lacking nonce verification on the settings page and inadequate input sanitization and output escaping. An unauthenticated attacker can inject malicious web scripts into pages by forging a request, provided they can deceive an administrator into performing an action, such as clicking a link.

Recommendations Update the WP-Walla plugin to a version newer than 0.5.3.5.