CVE-2025-8481

Name of the Vulnerable Software and Affected Versions Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid version 1.1.7

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the bdfe install activate rswpbs only() function. This allows unauthenticated attackers to install the 'rs-wp-books-showcase' plugin by tricking a site administrator into clicking a malicious link. Nonce validation is a security measure used to ensure that a request was intentionally sent by the user and not forged by a third party.

Recommendations Update Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid to a version newer than 1.1.7. As a temporary workaround, restrict administrative access to the WordPress dashboard to trusted networks only.