Hidepost Vulnerabilities

The HidePost plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.8. This is due to missing or incorrect nonce validation on the options.php settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted th...

CVSS:

4.3

Affected:

up to 2.3.8

Fix:

No patched version reported

Disclosed:

Sep 26, 2025

CVE-2025-9896 on NVD →

The HidePost plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.8. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrato...

CVSS:

4.3

Affected:

up to 2.3.8

Fix:

No patched version reported

Disclosed:

Jun 27, 2025

CVE-2025-53310 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Funnnny HidePost allows Reflected XSS. This issue affects HidePost: from n/a through 2.3.8.

Affected:

up to 2.3.8

Fix:

No patched version reported

Disclosed:

Jun 27, 2025

CVE-2025-53310 on NVD →

Affected:

up to 2.3.8

Fix:

No patched version reported

CVE-2025-9896 on NVD →