CVE-2025-58860 HIGH

CVE-2025-58860: WordPress Enable Latex Plugin <= 1.2.16 - Cross Site Request Forgery (CSRF) Vulnerability

Vendor Kaizencoders
Product Enable Latex
Weakness CWE-352 · CSRF
Published September 5, 2025
Last update May 12, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in KaizenCoders Enable Latex enable-latex allows Stored XSS.This issue affects Enable Latex: from n/a through <= 1.2.16.

Explanation of Vulnerability in Simple Terms

02Summary

Enable Latex versions 1.2.16 and earlier contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without the administrator's knowledge. The vulnerability requires the victim to visit the attacker's page while authenticated to the site.

What an attacker can do

03Attacker Capabilities

Perform actions on the site (read data, modify settings, create content) on behalf of a logged-in administrator.

Potential impact on your site

04Site Impact

An attacker can trick your administrators into unknowingly changing site settings or creating malicious content via a crafted link or webpage.

Conditions required to exploit

05Prerequisites

Administrator must visit an attacker-controlled webpage while logged into the site.

Key dates

06Disclosure timeline

September 5, 2025 CVE published
May 12, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2023-52226 WordPress Advanced Flamingo plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-59541 Chamilo: CSRF Vulnerability in Project Deletion CVE-2025-13408 Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.2 - Cross-Site Request Forgery to Google OAuth Connection CVE-2025-32563 WordPress WP Calais Auto Tagger plugin <= 2.0 - CSRF to Stored XSS vulnerability CVE-2023-44995 WordPress WooCommerce Login Redirect Plugin <= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF)