CVE-2025-14161

The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the 'truefyembedoptionsupdate' settings update action. This makes it possible for unauthenticated attackers to update the...

EUVD-2025-202988

The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the 'truefyembedoptionsupdate' settings update action. This makes it possible for unauthenticated attackers to update the...

CVE-2025-14161

The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the 'truefyembedoptionsupdate' settings update action. This makes it possible for unauthenticated attackers to update the...

CVE-2025-14161

CVE-2025-14161 affects the Truefy Embed WordPress plugin (pre-1.1.0). Root cause: missing nonce validation on the truefy_embed_options_update action, enabling CSRF by unauthenticated attackers to update plugin settings (including the API key) via forged requests that trick an admin. Impact per so...

CVE-2025-14161 Truefy Embed <= 1.1.0 - Cross-Site Request Forgery to 'truefy_embed_options_update' Settings Update

The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the 'truefyembedoptionsupdate' settings update action. This makes it possible for unauthenticated attackers to update the...

PT-2025-50860

The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the 'truefy embed options update' settings update action. This makes it possible for unauthenticated attackers to update the...

WordPress plugin Truefy Embed 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site request...

CVE-2025-14161: Cross-Site Request Forgery (CSRF)

The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the 'truefyembedoptionsupdate' settings update action. This makes it possible for unauthenticated attackers to update the...

WordPress Truefy Embed plugin <= 1.1.0 - Cross-Site Request Forgery to 'truefy_embed_options_update' Settings Update vulnerability

Cross-Site Request Forgery to 'truefyembedoptionsupdate' Settings Update vulnerability discovered by dayea song - Ahnlab in WordPress Plugin Truefy Embed versions = 1.1.0...