CVE-2025-12696
HelloLeads CRM Form Shortcode <= 1.0 - Unauthenticated Settings Reset
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 5.3EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
14 dic 2025Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
Unknown · HelloLeads CRM Form Shortcode