CVE-2025-25137

Name of the Vulnerable Software and Affected Versions Social Links versions prior to 1.0.12

Description The Social Links plugin for WordPress contains a Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) issue. The flaw stems from missing or incorrect nonce validation—a security token used to verify that a request was intentionally sent by the user—within a function. This allows unauthenticated attackers to update settings and inject malicious web scripts by tricking a site administrator into clicking a forged link.

Recommendations Update Social Links to a version later than 1.0.11.