CVE-2025-13134

MediumCVSS 6.1

Published: 21/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

1th percentile - higher than 1% of all known CVEs

Summary

The AuthorSure plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.3. Missing nonce validation on the 'authorsure' page allows unauthenticated attackers to update settings and inject malicious scripts via a forged request if an admin clicks a link.

Risk Assessment

An attacker could change plugin settings and inject malicious scripts, potentially leading to site compromise or data theft.

Recommendation

Update the plugin to the latest version and educate administrators about the risk of clicking suspicious links.

Other vulnerabilities in AuthorSure

CVE-2025-57979Medium
Stored XSS vulnerability in AuthorSure plugin (up to 2.3) due to improper input neutralization. Allows persistent script injection that executes in the victim's browser.

Original NVD description (English source)

The AuthorSure plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the 'authorsure' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS