CVE-2025-4337

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The AHAthat Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the aha_plugin_page() function. This makes it possible for unauthenticated attackers to delete AHA pages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
May 6, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-433704.0A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may craCVE-2025-433718.2This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox.CVE-2025-433727.8The issue was addressed with improved input validation. This issue is fixed in iOS 26 and iPadOS 26, macOS Sonoma 14.8.2, macOS Tahoe 26, tvCVE-2025-433737.5The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. ACVE-2025-433744.3An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS SeqCVE-2025-433755.5The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.CVE-2025-433767.5A logic issue was addressed with improved state management. This issue is fixed in Safari 26, iOS 18.7.7 and iPadOS 18.7.7, iOS 26 and iPadOCVE-2025-433775.5An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2CVE-2025-433785.5A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may beCVE-2025-433795.5This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS CVE-2025-43386.8Lantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the network device. An attackCVE-2025-433805.5An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2,
CVE-2025-4337: Medium severity, CVSS 4.3 | Vulnix