HIGHCVSS 8.8Vulnerability
CVE-2025-14390
The Video Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in version <= 5.0.4. This is due to missing or incorrect nonce validation on the video_merchant_add_video_file() function. This makes it possible for unauthenticated attackers to upload arbitrary files that make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Properties
- Severity
- HIGH
- Epss score
- 0.00449
- Cvss severity
- HIGH
- Cvss score
- 8.8
- Retrieved at
- 2026-10-21T01:24:47+00:00
- Score
- 8.8
- Last source
- FIRST EPSS
- Cve id
- CVE-2025-14390
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-10-18T14:16:38+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Published at
- 2025-12-10T10:16:01.823
- Last modified
- 2026-10-14T21:10:00.183
- Epss percentile
- 0.37733
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph