CVE-2025-12452

Name of the Vulnerable Software and Affected Versions Visit Counter plugin for WordPress version 1.0

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation on the 'widgets.php' page. A nonce is a unique token used to prevent the replay of requests. This flaw allows unauthenticated attackers to update settings and inject malicious web scripts by tricking a site administrator into clicking a forged link.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.