{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10302", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-11T21:12:36.647Z", "datePublished": "2025-10-03T11:17:24.011Z", "dateUpdated": "2026-04-08T17:34:37.177Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:37.177Z"}, "affected": [{"vendor": "hameha", "product": "Ultimate Viral Quiz", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on thesave_options() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Ultimate Viral Quiz <= 1.0 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fbe32b9e-a6da-4257-b740-63a143cee42f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-viral-quiz/trunk/bestbugcore/classes/options.class.php#L28"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-10-02T22:09:56.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T13:56:51.429472Z", "id": "CVE-2025-10302", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T13:56:57.367Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10302", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-03T13:56:51.429472Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T13:56:54.532Z"}}], "cna": {"title": "Ultimate Viral Quiz <= 1.0 - Cross-Site Request Forgery to Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "hameha", "product": "Ultimate Viral Quiz", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-02T22:09:56.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fbe32b9e-a6da-4257-b740-63a143cee42f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-viral-quiz/trunk/bestbugcore/classes/options.class.php#L28"}], "descriptions": [{"lang": "en", "value": "The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on thesave_options() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:37.177Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10302", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:34:37.177Z", "dateReserved": "2025-09-11T21:12:36.647Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-03T11:17:24.011Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on thesave_options() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "id": "CVE-2025-10302", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-10-03T12:15:42.280", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-viral-quiz/trunk/bestbugcore/classes/options.class.php#L28"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fbe32b9e-a6da-4257-b740-63a143cee42f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:55:24.447093+00:00", "value": {"mitigation_remediation": ["Upgrade the Ultimate Viral Quiz plugin to the latest release that implements proper nonce validation.", "If an immediate upgrade is not possible, restrict access to the plugin\u2019s settings page so that only the highest\u2011privileged roles (e.g., Administrator) can modify settings.", "Deploy a general CSRF protection plugin or enable WordPress core CSRF checks on all settings forms to block unauthorized requests."], "summary": {"action": "Apply Patch", "impact": "Cross\u2011Site Request Forgery"}, "threat_synthesis": {"affected_systems": "All released versions of the Ultimate Viral Quiz plugin from the vendor hameha up to and including 1.0 are impacted. Site administrators running any of these versions risk having their configuration altered if they visit a malicious link that triggers the settings update.", "description_and_impact": "The Ultimate Viral Quiz plugin for WordPress contains a flawed nonce validation in the thesave_options() function. Because the nonce check is missing or incorrect, an attacker can craft a request that updates the plugin\u2019s configuration settings. This flaw allows an unauthenticated actor to modify settings without logging into the WordPress site, potentially altering how the plugin behaves and affecting site functionality.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate severity. The EPSS score is less than 1%, suggesting a low likelihood of widespread exploitation at present. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can exploit this by convincing an administrator to click an attacker\u2011controlled link that submits a forged request; no additional privileges or system access are required beyond the administrator\u2019s session."}}}}, "created": "2025-10-06T14:42:46.818090+00:00", "updated": "2026-04-21T19:00:36.140723+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}