CVE-2025-12400

Name of the Vulnerable Software and Affected Versions LMB^Box Smileys versions prior to 3.3

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the manage page() function. This allows unauthenticated attackers to update settings and inject malicious web scripts by tricking a site administrator into clicking a forged link. Nonce validation is a security measure used to ensure that a request was intentionally sent by the user and not forged by a third party.

Recommendations Update the plugin to a version newer than 3.2. As a temporary workaround, restrict access to the manage page() function to minimize the risk of exploitation.