CVE-2025-12696
Medium · 5.3CVSS
5.3
EPSS
0.1%
Published
Dec 14, 2025
CISA due date
—
The record
The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|