Cross-Site Request Forgery in Centangle-Team Plugin for WordPress

CVE-2025-12456

What is CVE-2025-12456?

The Centangle-Team plugin for WordPress is susceptible to Cross-Site Request Forgery, allowing unauthenticated attackers to manipulate plugin settings if they can deceive a site administrator into clicking on a malicious link. This vulnerability arises from inadequate nonce validation. Additionally, the plugin has weak input sanitization and output escaping on specific parameters, which enables attackers to inject arbitrary web scripts. Such scripts can run on pages accessed by users, potentially leading to further exploitation.

References