Cross-Site Request Forgery Vulnerability in Image Slider Plugin by Ays

CVE-2025-14454

What is CVE-2025-14454?

The Image Slider by Ays – Responsive Slider and Carousel plugin for WordPress contains a Cross-Site Request Forgery vulnerability due to inadequate nonce validation in the bulk delete functionality. This flaw allows unauthenticated attackers to exploit the plugin by sending forged requests to delete any arbitrary sliders. The attack requires an administrator to be tricked into clicking a malicious link, which could lead to unauthorized deletion of content. As a result, site owners should consider applying security measures to mitigate this vulnerability.

References