CVE-2025-14616

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Recooty – Job Widget (Old Dashboard) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing nonce validation on the recooty_save_maybe() function. This makes it possible for unauthenticated attackers to update the recooty_key option and inject malicious content into iframe src attributes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jan 28, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-146175.3A vulnerability has been found in Jehovahs Witnesses JW Library App up to 15.5.1 on Android. Affected is an unknown function of the componen CVE-2025-146184.3The Sweet Energy Efficiency plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capab CVE-2025-146199.8A vulnerability was found in code-projects Student File Management System 1.0. Affected by this vulnerability is an unknown functionality of CVE-2025-146209.8A vulnerability was determined in code-projects Student File Management System 1.0. Affected by this issue is some unknown functionality of CVE-2025-146219.8A vulnerability was identified in code-projects Student File Management System 1.0. This affects an unknown part of the file /admin/update_u CVE-2025-146229.8A security flaw has been discovered in code-projects Student File Management System 1.0. This vulnerability affects unknown code of the file CVE-2025-146239.8A weakness has been identified in code-projects Student File Management System 1.0. This issue affects some unknown processing of the file /CVE-2025-146256.7Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows (Nios II Command Shell modules), Altera Quartus P CVE-2025-146266.4The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CVE-2025-146276.4The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up CVE-2025-146295.3The Alchemist Ajax Upload plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the 'd CVE-2025-14634.3The Spreadsheet Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. Th