CVE-2025-13363

Name of the Vulnerable Software and Affected Versions IMAQ Core versions prior to 1.2.2

Description The plugin is subject to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs due to missing nonce validation—a security measure used to ensure that a request was intentionally sent by the user—within the URL structure settings update functionality. Unauthenticated attackers can exploit this to modify the plugin's URL structure settings by inducing a site administrator to click a malicious link.

Recommendations Update the plugin to version 1.2.2 or later.