Stockie Extra <= 1.2.11 - Unauthenticated Arbitrary Shortcode Execution
medium
The The Stockie Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.11. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attacker...
- CVSS:
- 5.3
- Affected:
- up to 1.2.11
- Fixed in:
- 1.2.12
- Disclosed:
- Oct 21, 2025
CVE-2025-64225 on NVD →
Stockie Extra <= 1.2.11 - Cross-Site Request Forgery
medium
The Stockie Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.11. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site admini...
- CVSS:
- 4.3
- Affected:
- up to 1.2.11
- Fixed in:
- 1.2.12
- Disclosed:
- Oct 21, 2025
CVE-2025-64226 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database