Cross-Site Request Forgery in SH Contextual Help Plugin for WordPress

CVE-2025-12410

What is CVE-2025-12410?

The SH Contextual Help plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit a flaw in nonce validation within the sh_contextual_help_dashboard_widget() function. This can lead to unauthorized changes in the plugin's settings, including the injection of malicious scripts, if an unsuspecting site administrator is tricked into executing specific actions, such as clicking on a deceptive link. Ensuring proper nonce validation is essential to mitigate such risks.

References