CVE-2025-12188

Name of the Vulnerable Software and Affected Versions Posts Navigation Links for Sections and Headings – Free versions prior to 1.0.2

Description The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs due to missing or incorrect nonce validation on the 'wpm navigation links settings' page. Consequently, unauthenticated attackers can update plugin settings by inducing a site administrator to click a malicious link.

Recommendations Update the plugin to version 1.0.2 or later.