CVE-2025-12696

The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.13% chance of exploitation in the next 30 days, 3th percentile

Published

2025-12-14

Updated

2026-04-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/e552dfc8-c6e1-4605-bc36-30dc4066eaea/

References

• CVE Record
• NVD entry

Related

• CVE-2025-12685
• CVE-2025-12697
• CVE-2025-12684
• CVE-2025-12704
• CVE-2025-12674
• CVE-2025-12716