Cross-Site Request Forgery and XSS in YSlider Plugin by WordPress

CVE-2025-12590

What is CVE-2025-12590?

The YSlider plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) due to missing nonce verification and inadequate sanitization of user inputs. Attackers can exploit this vulnerability by crafting malicious requests that can deceive an administrator into executing scripts. This allows the injection of arbitrary web scripts into WordPress pages, which will execute whenever users access the compromised content, posing a significant security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References