CVE-2025-12696
CVE-2025-12696
Medium · published December 14, 2025
What it is
The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them
The record
Technical detail
- CVSS v3.1
- 5.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00136 · 2.7th percentile
- Published
- 2025-12-14T11:15Z
References (1)
EPSS history
Timeline