{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9880", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-02T21:43:58.690Z", "datePublished": "2025-09-12T03:22:43.950Z", "dateUpdated": "2026-04-08T16:54:31.230Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:31.230Z"}, "affected": [{"vendor": "dejocar", "product": "Side Slide Responsive Menu", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Side Slide Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Side Slide Responsive Menu <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/57ff8e0b-92cd-49e1-9db7-91c970282e21?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/side-slide-responsive-menu/tags/1.0/SideSlideMenu.class.php"}, {"url": "https://plugins.trac.wordpress.org/browser/side-slide-responsive-menu/tags/1.0/sideslide_admin.php"}, {"url": "https://wordpress.org/plugins/side-slide-responsive-menu/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2025-09-11T14:48:27.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-12T17:12:23.179681Z", "id": "CVE-2025-9880", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-12T17:12:36.311Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9880", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-12T17:12:23.179681Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-12T17:12:31.738Z"}}], "cna": {"title": "Side Slide Responsive Menu <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "dejocar", "product": "Side Slide Responsive Menu", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-11T14:48:27.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/57ff8e0b-92cd-49e1-9db7-91c970282e21?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/side-slide-responsive-menu/tags/1.0/SideSlideMenu.class.php"}, {"url": "https://plugins.trac.wordpress.org/browser/side-slide-responsive-menu/tags/1.0/sideslide_admin.php"}, {"url": "https://wordpress.org/plugins/side-slide-responsive-menu/"}], "descriptions": [{"lang": "en", "value": "The Side Slide Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:31.230Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9880", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:54:31.230Z", "dateReserved": "2025-09-02T21:43:58.690Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-12T03:22:43.950Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Side Slide Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "id": "CVE-2025-9880", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-09-12T04:16:06.177", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/side-slide-responsive-menu/tags/1.0/SideSlideMenu.class.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/side-slide-responsive-menu/tags/1.0/sideslide_admin.php"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/side-slide-responsive-menu/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/57ff8e0b-92cd-49e1-9db7-91c970282e21?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:57:33.904959+00:00", "value": {"mitigation_remediation": ["Upgrade the Side Slide Responsive Menu plugin to the latest available version that includes proper nonce validation or remove the plugin if no update exists.", "After upgrading or uninstalling, perform a full scan of the site\u2019s database and content for injected scripts and purge any malicious entries.", "If an immediate upgrade is not possible, add an additional nonce check on all plugin settings endpoints to prevent unauthenticated POST or GET requests from modifying configuration before the update is available."], "summary": {"action": "Update Plugin", "impact": "Stored Cross\u2011Site Scripting triggered by Cross\u2011Site Request Forgery"}, "threat_synthesis": {"affected_systems": "All WordPress sites that have installed the Side Slide Responsive Menu plugin version 1.0 or earlier, provided by the vendor dejocar. The vulnerability applies to each installation of the plugin in those versions regardless of WordPress core or theme.", "description_and_impact": "The Side Slide Responsive Menu plugin is affected by a missing or incorrect nonce check, which allows an unauthenticated attacker to send a forged request that updates the plugin\u2019s settings. By doing so, the attacker can inject arbitrary JavaScript that is stored in the database and executed in the context of the site, resulting in a stored Cross\u2011Site Scripting (XSS) vulnerability. The weakness is a classic Cross\u2011Site Request Forgery flaw (CWE\u2011352).", "risk_and_exploitability": "The CVSS score of 6.1 indicates a moderate severity, and the EPSS score of less than 1% suggests that the vulnerability is unlikely to be widely exploited at this time. It is not listed in the CISA KEV catalog. Exploitation would require the attacker to lure an administrative user into clicking a crafted link or otherwise submitting a forged request that bypasses nonce validation. If the target site lacks monitoring for unauthorized script changes, an attacker could achieve persistent client\u2011side code execution with potential for data theft or automated defacement. The risk is moderate but real, particularly for high\u2011traffic or highly valuable sites.\n"}}}}, "created": "2025-09-12T09:11:12.753365+00:00", "updated": "2026-04-21T03:00:06.381450+00:00", "vendors": ["dejocar", "dejocar$PRODUCT$side_slide_responsive_menu", "wordpress", "wordpress$PRODUCT$wordpress"]}