Wordpress Plugin
CVE-2025-54010
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel FluentSnippets easy-code-manager allows Cross Site Request Forgery.This issue affects FluentSnippets: from n/a through <= 10.50.
AnalysisAI
Cross-site request forgery (CSRF) vulnerability in WordPress FluentSnippets plugin versions up to 10.50 allows unauthenticated attackers to execute unwanted actions on behalf of authenticated users without their knowledge or consent. The vulnerability affects the easy-code-manager component and has a low exploitation probability (EPSS 0.03%), but CSRF attacks typically require social engineering to trick users into visiting a malicious site, making real-world impact dependent on site traffic and user behavior rather than technical exploitability alone.
Technical ContextAI
CSRF vulnerabilities (CWE-352) occur when an application fails to validate that requests originate from legitimate users, typically by missing or improperly validating nonce tokens or origin headers. FluentSnippets is a WordPress plugin that manages code snippets; the vulnerable component (easy-code-manager) likely processes administrative or snippet-management actions via HTTP requests without proper CSRF protection. WordPress plugins typically handle nonce validation via wp_verify_nonce() or similar mechanisms, and their absence in certain endpoints leaves those actions vulnerable to unauthorized state-changing requests crafted by attackers.
Affected ProductsAI
WordPress plugin FluentSnippets (easy-code-manager) versions up to and including 10.50. The CPE designation would be software component in the WordPress plugin ecosystem hosted on wordpress.org. The vendor (Shahjahan Jewel) has published details via Patchstack's vulnerability database.
RemediationAI
Update the FluentSnippets plugin to a version newer than 10.50 from the official WordPress plugin repository. WordPress administrators should access their Dashboard, navigate to Plugins > Installed Plugins, locate FluentSnippets, and apply the available update. If no patched version is yet available, disable the plugin temporarily until an update is released. Verify that all nonce fields are included in administrative forms and that wp_verify_nonce() is called for state-changing requests. The vulnerability details and update status can be found at the Patchstack advisory: https://patchstack.com/database/Wordpress/Plugin/easy-code-manager/vulnerability/wordpress-fluentsnippets-plugin-10-50-cross-site-request-forgery-csrf-vulnerability
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today