CVE-2025-8491

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Easy restaurant menu manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the nsc_eprm_save_menu() function. This makes it possible for unauthenticated attackers to upload a menu file via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Aug 13, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-84925.3The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modi CVE-2025-84939.8A vulnerability classified as critical was found in code-projects Intern Membership Management System 1.0. This vulnerability affects unknow CVE-2025-84949.8A vulnerability, which was classified as critical, has been found in code-projects Intern Membership Management System 1.0. This issue affec CVE-2025-84959.8A vulnerability, which was classified as critical, was found in code-projects Intern Membership Management System 1.0. Affected is an unknow CVE-2025-84969.8A vulnerability has been found in projectworlds Online Admission System 1.0 and classified as critical. Affected by this vulnerability is an CVE-2025-84979.8A weakness has been identified in code-projects Online Medicine Guide 1.0. This affects an unknown part of the file /cusfindphar2.php. This CVE-2025-84989.8A security vulnerability has been detected in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /CVE-2025-84999.8A vulnerability was found in code-projects Online Medicine Guide 1.0. It has been declared as critical. This vulnerability affects unknown c CVE-2025-85008.8A vulnerability was found in code-projects Human Resource Integrated System 1.0. It has been rated as critical. This issue affects some unkn CVE-2025-85015.4A vulnerability classified as problematic has been found in code-projects Human Resource Integrated System 1.0. Affected is an unknown funct CVE-2025-85029.8A vulnerability classified as critical was found in code-projects Online Medicine Guide 1.0. Affected by this vulnerability is an unknown fu CVE-2025-85039.8A vulnerability, which was classified as critical, has been found in code-projects Online Medicine Guide 1.0. Affected by this issue is some