Cross-Site Request Forgery in Zen Sticky Social Plugin for WordPress
CVE-2025-6055

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Zen Sticky Social
Vendor
CVE Published:
14 June 2025

What is CVE-2025-6055?

The Zen Sticky Social plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation on specific endpoints. This vulnerability allows unauthenticated attackers to manipulate the plugin’s settings through forged requests. If an attacker successfully tricks a site administrator into activating malicious links or responses, they could potentially execute harmful scripts that compromise the site’s security.

Affected Version(s)

Zen Sticky Social * <= 0.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/zen-social-sti...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Johannes Skamletz
.
CVE-2025-6055 : Cross-Site Request Forgery in Zen Sticky Social Plugin for WordPress