CVE-2025-12410

Name of the Vulnerable Software and Affected Versions SH Contextual Help versions prior to 3.2.2

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the sh contextual help dashboard widget() function. This allows unauthenticated attackers to update plugin settings and inject malicious web scripts by tricking a site administrator into clicking a forged link. Nonce validation is a security measure used to ensure that a request was intentionally sent by the user.

Recommendations Update to a version newer than 3.2.1.