CVE-2026-8941

Name of the Vulnerable Software and Affected Versions CDN Linker lite versions prior to 1.3.2

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the ossdl off options() function. This allows unauthenticated attackers to update plugin settings, such as the CDN URL used to rewrite static asset references, by tricking a site administrator into clicking a malicious link.

Recommendations Update to a version newer than 1.3.1. As a temporary workaround, restrict access to the ossdl off options() function to minimize the risk of exploitation.