CVE-2025-12402

Name of the Vulnerable Software and Affected Versions LinkedIn Resume plugin for WordPress versions prior to 2.01

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the linkedinresume printAdminPage() function. A nonce is a unique token used to prevent the replay of requests. This flaw allows unauthenticated attackers to update settings and inject malicious web scripts by tricking a site administrator into clicking a forged link.

Recommendations Update the plugin to a version later than 2.00. As a temporary mitigation, restrict access to the linkedinresume printAdminPage() function.