CVE-2025-14062

Name of the Vulnerable Software and Affected Versions Animated Pixel Marquee Creator versions prior to 1.0.1

Description This issue is a Cross-Site Request Forgery (CSRF), which occurs when a malicious website causes a user's web browser to perform an unwanted action on a different website. The flaw exists due to missing nonce validation—a security measure used to ensure that a request was intentionally sent by the user—within the marquee deletion function. Unauthenticated attackers can exploit this by tricking a site administrator into clicking a link, allowing the attacker to delete arbitrary marquees via the marquee parameter.

Recommendations Update the plugin to a version later than 1.0.0.