Animated Pixel Marquee Creator <= 1.0.0 - Cross-Site Request Forgery via 'marquee' Parameter
Plattform
adobe
Komponente
animated-pixel-marquee-creator
Behoben in
1.0.1
CVE-2025-14062 describes a Cross-Site Request Forgery (CSRF) vulnerability affecting the Animated Pixel Marquee Creator plugin for WordPress. This flaw allows unauthenticated attackers to delete marquees if they can manipulate a site administrator into performing a forged action. The vulnerability impacts versions 1.0.0 and earlier, and a fix is expected to be released by the vendor.
Auswirkungen und Angriffsszenarienwird übersetzt…
The primary impact of this CSRF vulnerability is the unauthorized deletion of marquees within the WordPress site. An attacker could craft a malicious link that, when clicked by an administrator, triggers the deletion of marquees without the administrator's explicit consent. This could lead to data loss, disruption of site functionality, and potential defacement if marquees contain important information. While the impact is limited to the plugin's functionality, it highlights the importance of proper input validation and nonce protection in WordPress plugins.
Ausnutzungskontextwird übersetzt…
This vulnerability was publicly disclosed on 2025-12-12. There are currently no known public proof-of-concept exploits available. The CVSS score of 4.3 (Medium) indicates a moderate probability of exploitation. It is not currently listed on the CISA KEV catalog.
Wer Ist Gefährdetwird übersetzt…
WordPress sites using the Animated Pixel Marquee Creator plugin, particularly those with site administrators who are not vigilant about clicking on suspicious links, are at risk. Shared hosting environments where multiple users share the same server and WordPress installation are also potentially more vulnerable.
Erkennungsschrittewird übersetzt…
• wordpress / composer / npm:
grep -r 'marquee' /var/www/html/wp-content/plugins/animated-pixel-marquee-creator/• generic web:
curl -I https://example.com/wp-admin/admin-ajax.php?action=marquee_delete&marquee=X | grep -i '200 ok'Angriffszeitlinie
- Disclosure
disclosure
Bedrohungsanalyse
Exploit-Status
EPSS
0.02% (3% Perzentil)
CISA SSVC
CVSS-Vektor
Was bedeuten diese Metriken?
- Attack Vector
- Netzwerk — aus der Ferne über das Internet ausnutzbar. Kein physischer oder lokaler Zugriff erforderlich.
- Attack Complexity
- Niedrig — keine besonderen Bedingungen erforderlich. Zuverlässig ausnutzbar.
- Privileges Required
- Keine — ohne Authentifizierung ausnutzbar. Keine Zugangsdaten erforderlich.
- User Interaction
- Erforderlich — Opfer muss eine Datei öffnen, auf einen Link klicken oder eine Seite besuchen.
- Scope
- Unverändert — Auswirkung auf das anfällige Komponente beschränkt.
- Confidentiality
- Keine — kein Vertraulichkeitseinfluss.
- Integrity
- Niedrig — Angreifer kann einige Daten mit begrenztem Umfang ändern.
- Availability
- Keine — kein Verfügbarkeitseinfluss.
Betroffene Software
Schwachstellen-Klassifikation (CWE)
Zeitleiste
- Reserviert
- Veröffentlicht
- Geändert
- EPSS aktualisiert
Mitigation und Workaroundswird übersetzt…
The primary mitigation for CVE-2025-14062 is to upgrade the Animated Pixel Marquee Creator plugin to a patched version as soon as it becomes available. Until a patch is released, consider implementing a Web Application Firewall (WAF) rule to filter out requests with missing or invalid nonces for the marquee deletion function. Additionally, restrict access to the plugin's administrative interface and educate administrators about the risks of clicking on suspicious links. Regularly review WordPress plugin installations and remove any unused or outdated plugins.
So beheben
Kein bekannter Patch verfügbar. Bitte überprüfen Sie die Details der Vulnerability eingehend und setzen Sie Mitigationen basierend auf der Risikobereitschaft Ihrer Organisation ein. Es kann am besten sein, die betroffene Software zu deinstallieren und eine Alternative zu finden.
CVE-Sicherheitsnewsletter
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
Häufig gestellte Fragenwird übersetzt…
What is CVE-2025-14062 — CSRF in Animated Pixel Marquee Creator?
CVE-2025-14062 is a Cross-Site Request Forgery (CSRF) vulnerability in the Animated Pixel Marquee Creator WordPress plugin, allowing unauthorized deletion of marquees.
Am I affected by CVE-2025-14062 in Animated Pixel Marquee Creator?
You are affected if you are using the Animated Pixel Marquee Creator plugin in WordPress version 1.0.0 or earlier.
How do I fix CVE-2025-14062 in Animated Pixel Marquee Creator?
Upgrade the Animated Pixel Marquee Creator plugin to the latest available version as soon as a patch is released. Implement WAF rules as a temporary workaround.
Is CVE-2025-14062 being actively exploited?
There are currently no confirmed reports of active exploitation, but the vulnerability is publicly known.
Where can I find the official Animated Pixel Marquee Creator advisory for CVE-2025-14062?
Check the plugin developer's website or the WordPress plugin repository for updates and advisories related to CVE-2025-14062.
Ist dein Projekt betroffen?
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.