Cross-Site Request Forgery and XSS in YSlider Plugin by WordPress

CVE-2025-12590

What is CVE-2025-12590?

The YSlider plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) due to missing nonce verification and inadequate sanitization of user inputs. Attackers can exploit this vulnerability by crafting malicious requests that can deceive an administrator into executing scripts. This allows the injection of arbitrary web scripts into WordPress pages, which will execute whenever users access the compromised content, posing a significant security risk.

References