CVE-2026-6710

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Skysa Text Ticker App plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the SkysaApps_Admin_AppPage function. This makes it possible for unauthenticated attackers to trick a site administrator into making a forged request to modify the plugin's settings, including the scrolling message text and URL, via a forged cross-site request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
davidskysaSkysa Text Ticker App<= 1.4

References

Timeline

Published
May 12, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-671009.8HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an CVE-2026-671015.8HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allCVE-2026-671028.1HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user toCVE-2026-671036.1HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized mCVE-2026-671045.3HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyCVE-2026-671057.4HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network acCVE-2026-671065.3HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive dataCVE-2026-67116.1The Website LLMs.txt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, andCVE-2026-67124.4The Website LLMs.txt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includiCVE-2026-67135.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1CVE-2026-67159.8IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adCVE-2026-671655.4HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in