{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13362", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-18T16:46:15.761Z", "datePublished": "2025-12-05T04:29:11.690Z", "dateUpdated": "2026-04-08T17:02:58.138Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:58.138Z"}, "affected": [{"vendor": "jevgenisultanov", "product": "Norby AI", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Norby AI plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Norby AI <= 1.0.3 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc6f6e2-6777-4056-95d0-e3d3e7ad7a22?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/norby-ai/trunk/api/save.php#L23"}, {"url": "https://plugins.trac.wordpress.org/browser/norby-ai/tags/1.0.3/api/save.php#L23"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "timeline": [{"time": "2025-12-04T16:26:16.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-05T16:04:58.929736Z", "id": "CVE-2025-13362", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T16:06:56.944Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13362", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T16:04:58.929736Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T16:06:19.920Z"}}], "cna": {"title": "Norby AI <= 1.0.3 - Cross-Site Request Forgery to Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "jevgenisultanov", "product": "Norby AI", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-04T16:26:16.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc6f6e2-6777-4056-95d0-e3d3e7ad7a22?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/norby-ai/trunk/api/save.php#L23"}, {"url": "https://plugins.trac.wordpress.org/browser/norby-ai/tags/1.0.3/api/save.php#L23"}], "descriptions": [{"lang": "en", "value": "The Norby AI plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:58.138Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13362", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:58.138Z", "dateReserved": "2025-11-18T16:46:15.761Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-05T04:29:11.690Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Norby AI plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "id": "CVE-2025-13362", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-12-05T05:16:58.010", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/norby-ai/tags/1.0.3/api/save.php#L23"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/norby-ai/trunk/api/save.php#L23"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc6f6e2-6777-4056-95d0-e3d3e7ad7a22?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:46:44.089224+00:00", "value": {"mitigation_remediation": ["Install the latest Norby AI plugin version (\u22651.0.4) which implements nonce validation for the settings update endpoint.", "Verify that the endpoint now requires a valid nonce before processing changes; test by attempting a CSRF request or inspecting the code.", "Harden WordPress by limiting administrative accounts to necessary users, enabling core security features, and monitoring for unexpected configuration changes."], "summary": {"action": "Patch Now", "impact": "Unauthorized alteration of plugin settings and potential injection of malicious scripts via cross\u2011site request forgery"}, "threat_synthesis": {"affected_systems": "All installations of the Norby AI plugin distributed by jevgenisultanov that are version 1.0.3 or earlier are affected. Any WordPress site that has deployed one of these versions is at risk.", "description_and_impact": "The Norby AI plugin for WordPress suffers from a CSRF flaw caused by missing nonce validation on its settings update endpoint. This allows an unauthenticated attacker, by tricking an administrative user into clicking a crafted link, to change the plugin\u2019s configuration and inject arbitrary JavaScript. The vulnerability falls under CWE\u2011352. The compromised site can then serve malicious scripts to visitors, potentially leading to defacement or further attacks.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate impact; the EPSS score of less than 1% implies a very low likelihood of exploitation today. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires social engineering to persuade an authenticated administrator to perform the forged request, meaning that while the attack is technically straightforward, it relies on human manipulation and is therefore less likely to occur automatically."}}}}, "created": "2025-12-05T10:51:47.602698+00:00", "updated": "2026-04-21T18:00:11.705639+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}