CVE-2025-12412

Name of the Vulnerable Software and Affected Versions Top Bar Notification versions prior to 1.13

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the tbn ajax add() function. This allows unauthenticated attackers to update plugin settings and inject malicious web scripts by tricking a site administrator into clicking a forged link. Nonce validation is a security measure used to ensure that a request was intentionally sent by the user.

Recommendations Update to a version later than 1.12. As a temporary workaround, restrict access to the tbn ajax add() function to minimize the risk of exploitation.