blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2025-12696

MEDIUM 5.3 CVSS 3.1
Published
December 14, 2025
Last modified
October 7, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them

Affected products and versions

  • Unknown HelloLeads CRM Form Shortcode — Up to and including 1.0

References

  • wpscan.com https://wpscan.com/vulnerability/e552dfc8-c6e1-4605-bc36-30dc4066eaea/
  • nvd.nist.gov Official NVD record