Cross-Site Request Forgery Vulnerability in WP2HTML Plugin for WordPress

CVE-2025-5930

What is CVE-2025-5930?

The WP2HTML plugin for WordPress contains a vulnerability allowing Cross-Site Request Forgery (CSRF) due to inadequate nonce validation within the save() function. An unauthenticated attacker could exploit this flaw to manipulate plugin settings by tricking a site administrator into executing a malicious request. This represents a significant risk for websites utilizing this plugin version 1.0.2 or earlier, as it opens the door for potential unauthorized changes to site configurations.

References