CVE-2025-12696

HelloLeads CRM Form Shortcode <= 1.0 - Unauthenticated Settings Reset

The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them

Affected

HelloLeads CRM Form Shortcode

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.14% chance of exploitation in the next 30 days, 3rd percentile

Published

2025-12-14

Updated

2026-04-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/e552dfc8-c6e1-4605-bc36-30dc4066eaea/

References

• CVE Record
• NVD entry