Server-Side Request Forgery in WordPress Icon List Block Plugin
CVE-2025-12376
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 18 November 2025
What is CVE-2025-12376?
The Icon List Block Plugin for WordPress is affected by a vulnerability that allows authenticated users with Subscriber-level access and above to send unauthorized requests to external services. This issue stems from the fs_api_request function, which processes web requests without proper validation, enabling attackers to interact with internal services. The response only renders valid JSON objects, but the potential for information disclosure or modification remains a significant concern for users operating versions up to 1.2.1.
Affected Version(s)
Icon List Block – Add Icon-Based Lists with Custom Styles * <= 1.2.1