Mergado Marketing Pack Vulnerabilities

The Mergado Pack plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.2.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can tric...

CVSS:

4.3

Affected:

up to 4.2.0

Fix:

No patched version reported

Disclosed:

Dec 31, 2025

CVE-2025-62089 on NVD →

The Mergado Pack plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.1.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request...

CVSS:

6.1

Affected:

up to 4.1.1

Fix:

No patched version reported

Disclosed:

Apr 9, 2025

CVE-2025-32669 on NVD →