Cross-Site Request Forgery Vulnerability in Add Google +1 Social Share Button Plugin for WordPress
CVE-2025-3866
6.1MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 25 April 2025
What is CVE-2025-3866?
The Add Google +1 Social Share Button plugin for WordPress is exposed to a Cross-Site Request Forgery vulnerability due to the absence of proper nonce validation on the google-plus-one-share-button page. This flaw allows unauthorized attackers to send forged requests that can manipulate plugin settings and potentially inject harmful web scripts, provided they can deceive an administrator into executing a malicious action.
Affected Version(s)
Add Google +1 (Plus one) social share Button * <= 1.0.0