Unauthorized Data Modification in Live CSS Preview Plugin for WordPress

CVE-2025-12354

What is CVE-2025-12354?

The Live CSS Preview plugin for WordPress has a security flaw that permits unauthorized data modification due to a missing capability check in the 'wp_ajax_frontend_save' AJAX endpoint. This vulnerability can be exploited by authenticated attackers with Subscriber-level access or higher, allowing them to alter the plugin's CSS settings without proper authorization. All versions up to and including 2.0.0 are affected, posing a risk to website integrity and user trust.

References