CVE-2025-48320

Name of the Vulnerable Software and Affected Versions baidushare-wp versions prior to 1.0.7

Description A Cross-Site Request Forgery (CSRF) flaw exists due to missing or incorrect nonce validation (a unique token used to prevent forged requests) on a function. This allows unauthenticated attackers to update settings and perform Stored Cross-Site Scripting (XSS), which involves injecting malicious scripts that are stored on the server and served to other users, by tricking a site administrator into clicking a malicious link.

Recommendations Update baidushare-wp to a version newer than 1.0.6.