CVE-2025-12456

Name of the Vulnerable Software and Affected Versions Centangle-Team plugin for WordPress versions prior to 1.0.1

Description The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs due to missing or incorrect nonce validation on a function, allowing unauthenticated attackers to modify plugin settings if a site administrator is deceived into clicking a malicious link. Furthermore, insufficient input sanitization and output escaping on the cai name color parameter enable the injection of arbitrary web scripts into pages, which execute when a user accesses the affected page.

Recommendations Update the plugin to a version later than 1.0.0. Avoid using the cai name color parameter until the update is applied.