Cross-Site Request Forgery Vulnerability in CITS Support SVG, WebP Media and Font Upload Plugin
CVE-2025-0807
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 22 March 2025
What is CVE-2025-0807?
The CITS Support SVG, WebP Media and TTF, OTF File Upload, Use Custom Fonts plugin for WordPress is susceptible to Cross-Site Request Forgery due to insufficient nonce validation in the cits_settings_tab() function. This vulnerability allows unauthorized attackers to manipulate plugin settings by tricking a site administrator into executing actions, such as clicking on a malicious link, potentially compromising site integrity.
Affected Version(s)
CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts * <= 4.2