Wp Plugin Manager Vulnerabilities

The WP Plugin Manager – Deactivate plugins per page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.7. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action gra...

CVSS:

4.3

Affected:

up to 1.4.7

Fixed in:

1.4.8

Disclosed:

Nov 13, 2025

CVE-2025-64271 on NVD →

The WP Plugin Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.7. This is due to missing or incorrect nonce validation on the plugin_activation function. This makes it possible for unauthenticated attackers to activate installed plugins via a forged request...

CVSS:

4.3

Affected:

up to 1.1.7

Fixed in:

1.1.8

Disclosed:

Feb 28, 2023

CVE-2023-1088 on NVD →