Cross-Site Request Forgery Vulnerability in Trust Reviews Plugin for WordPress
CVE-2025-9899
6.1MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 September 2025
What is CVE-2025-9899?
The Trust Reviews plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation within its feed_save function. This significant flaw allows unauthenticated attackers to potentially create or alter feed entries. An attacker may exploit this vulnerability by convincing a site administrator to perform an action, such as clicking on a malicious link, thereby executing unauthorized changes without proper authentication.
Affected Version(s)
Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms * <= 1.0