Cross-Site Request Forgery in Centangle-Team Plugin for WordPress

CVE-2025-12456

What is CVE-2025-12456?

The Centangle-Team plugin for WordPress is susceptible to Cross-Site Request Forgery, allowing unauthenticated attackers to manipulate plugin settings if they can deceive a site administrator into clicking on a malicious link. This vulnerability arises from inadequate nonce validation. Additionally, the plugin has weak input sanitization and output escaping on specific parameters, which enables attackers to inject arbitrary web scripts. Such scripts can run on pages accessed by users, potentially leading to further exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References