Cross-Site Request Forgery Vulnerability in Depicter Plugin for WordPress
CVE-2025-8383

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Depicter — Popup & Slider Builder
Vendor
CVE Published:
31 October 2025

What is CVE-2025-8383?

The Depicter plugin for WordPress is susceptible to Cross-Site Request Forgery due to insufficient nonce validation in the depicter-document-rules-store function. This flaw allows unauthenticated attackers to potentially manipulate document rules by tricking a site administrator into making a request, such as clicking on a deceptive link. It is crucial for site administrators using this plugin to update to the latest version to mitigate the risk associated with this vulnerability.

Affected Version(s)

Depicter — Popup & Slider Builder 0 <= 4.0.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://drive.google.com/file/d/1Fph3k-uyN6tX4hHeupjdYsZW...
https://plugins.trac.wordpress.org/browser/depicter/trunk...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dmitrii Ignatyev
.