VulnSocial

CVE-2025-14795Disclosure

LOWCVSS 4.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Stop Spammers Classic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2026.1. This is due to missing nonce validation in the ss_addtoallowlist class. This makes it possible for unauthenticated attackers to add arbitrary email addresses to the spam allowlist via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The vulnerability was partially patched in version 2026.1.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-352

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-01-28: 2Technical Details · 2026-01-28: 201-28
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
Full discourse2 posts
  • CVE@CVEnew
    Disclosure

    CVE-2025-14795 The Stop Spammers Classic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2026.1. This is due to missing nonce … https://www.cve.org/CVERecord?id=CVE-2025-14795

    Post summary

    The announcement states that the Stop Spammers Classic WordPress plugin is vulnerable to CSRF via a missing nonce in versions up to 2026.1, but offers no exploitation code, active‑use evidence, or patch information.

    00010225
    56.5K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2025-14795 Cross-Site Request Forgery in Stop Spammers Classic WordPress Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-14795

    Post summary

    The snippet merely announces CVE‑2025‑14795 as a CSRF issue in Stop Spammers Classic without providing exploit, mitigation or active exploitation details.

    0000049
    4.0K followersView on X

Explore more

Back to dashboard