CVE-2025-8383

MediumCVSS 4.3

Published: 31/10/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

The Depicter plugin for WordPress up to version 4.0.4 is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the depicter-document-rules-store function. This allows unauthenticated attackers to modify document rules via a forged request if they can trick a site administrator into clicking a link.

Risk Assessment

An attacker could alter document rules, leading to unauthorized changes in site content or functionality, potentially compromising site integrity.

Recommendation

Update the Depicter plugin to the latest version immediately, which includes CSRF protections.

Other vulnerabilities in Depicter

CVE-2026-15049High
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate file types during import and does not remove malformed uploads, allowing editor-level users to write arbitrary files (including executable PHP) to a web-accessible directory, leading to remote code execution.

Original NVD description (English source)

The Depicter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 4.0.4. This is due to missing or incorrect nonce validation on the depicter-document-rules-store function. This makes it possible for unauthenticated attackers to modify document rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS