CVE-2025-9895

MediumCVSS 4.3

Published: 03/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

The Notification Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the 'subscriber-list-empty.php' file. Unauthenticated attackers can empty the subscriber list via a forged request if they trick a site administrator into clicking a link.

Risk Assessment

Attackers can delete all subscribers, leading to loss of contact data and potential marketing losses. This can harm customer relationships and require rebuilding the list.

Recommendation

Update the Notification Bar plugin to a version later than 2.2 if available, or remove it. Implement nonce validation and regularly back up the subscriber list.

Other vulnerabilities in Notification Bar

CVE-2025-15481Medium
The Notification Bar WordPress plugin through version 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails.

Original NVD description (English source)

The Notification Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the 'subscriber-list-empty.php' file. This makes it possible for unauthenticated attackers to empty the subscriber list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS