Cross-Site Request Forgery in Chat by Chatwee Plugin for WordPress

CVE-2025-9948

What is CVE-2025-9948?

The Chat by Chatwee plugin for WordPress is susceptible to Cross-Site Request Forgery due to inadequate nonce validation on the administration settings page. This security oversight allows unauthenticated attackers to exploit the vulnerability by tricking an administrator into executing unintended actions, potentially altering plugin settings through crafted requests.

References