EUVD-2025-17081Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network vector, low complexity, no privileges, user interaction required, low CIA impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This is due to missing or incorrect nonce validation on the hs_update_ai_chat_settings() function. This makes it possible for unauthenticated attackers to reconfigure the plugin’s AI/chat settings (including API keys) and to potentially redirect notifications or leak data to attacker-controlled endpoints via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Cross-Site Request Forgery in Hive Support WordPress plugin up to version 1.2.2 allows unauthenticated attackers to modify AI/chat settings, including API keys, by tricking a site administrator into clicking a malicious link. No public exploit or active exploitation identified, and EPSS score is low (0.03%).
Technical ContextAI
The vulnerability is a Cross-Site Request Forgery (CSRF) in the Hive Support plugin for WordPress, specifically in the hs_update_ai_chat_settings() function. CSRF occurs when a web application does not properly validate nonce tokens, allowing an attacker to forge requests on behalf of an authenticated user. The affected function lacks nonce validation, enabling attackers to change plugin settings without authorization. The CWE-352 classifies this as a CSRF vulnerability. The plugin is used for help desk and live chat functionality.
RemediationAI
Update to version 1.2.4 or later, which includes the fix. The patch was committed in changeset 3311984 on WordPress plugin Trac. No workarounds are available; updating is the recommended action. Advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/50542e5e-da66-4223-a6bf-dc9381687ddd?source=cve
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today