Cross-Site Request Forgery Vulnerability in WP Online Users Stats Plugin by WordPress

CVE-2025-4966

What is CVE-2025-4966?

The WP Online Users Stats plugin for WordPress suffers from a Cross-Site Request Forgery vulnerability due to inadequate nonce validation within the hk_dataset_results() function. This flaw allows unauthenticated attackers to execute malicious scripts by tricking site administrators into taking specific actions through deceptive links, exposing the site and its users to potential exploits.

References