CVE-2025-12413

Name of the Vulnerable Software and Affected Versions Social Media WPCF7 Stop Words versions prior to 1.1.4

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the smWpCfSwOptions() function. This allows unauthenticated attackers to update plugin settings and inject malicious web scripts by tricking a site administrator into clicking a forged link. Nonce validation is a security measure used to ensure that a request was intentionally sent by the user.

Recommendations Update Social Media WPCF7 Stop Words to version 1.1.4 or later. As a temporary workaround, restrict access to the smWpCfSwOptions() function to minimize the risk of exploitation.