CVE-2025-9632
PhpList Subber <= 1.1 - Cross-Site Request Forgery
The PhpList Subber plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the bulk_action_handler function. This makes it possible for unauthenticated attackers to trigger bulk synchronization of subscription forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
PhpList Subber <= 1.1 - Cross-Site Request Forgery
The PhpList Subber plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the bulk_action_handler function. This makes it possible for unauthenticated attackers to trigger bulk synchronization of subscription forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Record
CVE-2025-9632- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2025-27640
The PhpList Subber plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the bulk_action_handler function. This makes it possible for unauthenticated attackers to trigger bulk synchronization of subscription forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Record
EUVD-2025-27640- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9hh2-5xwh-4mjj
The PhpList Subber plugin for WordPress is vulnerable to Cross-Site Request Forgery in all...
The PhpList Subber plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the bulk_action_handler function. This makes it possible for unauthenticated attackers to trigger bulk synchronization of subscription forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Record
GHSA-9hh2-5xwh-4mjj- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
NVD
The PhpList Subber plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the bulk_action_handler function. This makes it possible for unauthenticated attackers to trigger bulk synchronization of subscription forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Record
CVE-2025-9632- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVCLSA-2025-1765209058No score
xorg-x11-server: Fix of 4 CVEs
- CVE-2025-9632: fix buffer overflow in _XkbSetCompatMap()
- CVE-2025-62229: fix use-after-free condition due improper error handling during notification creation leading to DoS
- CVE-2025-62230: fix use-after-free condition due freeing certain data structures without properly detaching related resources
- CVE-2025-62231: fix unsigned short overflow in XkbSetCompatMap() function
- Record
CLSA-2025-1765209058- Updated
- 2026-11-02
OSVCLSA-2025-1765209523No score
xorg-x11-server: Fix of 4 CVEs
- CVE-2025-9632: fix buffer overflow in _XkbSetCompatMap()
- CVE-2025-62229: fix use-after-free condition due improper error handling during notification creation leading to DoS
- CVE-2025-62230: fix use-after-free condition due freeing certain data structures without properly detaching related resources
- CVE-2025-62231: fix unsigned short overflow in XkbSetCompatMap() function
- Record
CLSA-2025-1765209523- Updated
- 2026-11-02
OSVCLSA-2025-1765223770No score
xorg-x11-server: Fix of 4 CVEs
- CVE-2025-9632: fix buffer overflow in _XkbSetCompatMap()
- CVE-2025-62229: fix use-after-free condition due improper error handling during notification creation leading to DoS
- CVE-2025-62230: fix use-after-free condition due freeing certain data structures without properly detaching related resources
- CVE-2025-62231: fix unsigned short overflow in XkbSetCompatMap() function
- Record
CLSA-2025-1765223770- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xorg-x11-server-XdmxTuxCare:OracleLinux:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-XephyrTuxCare:OracleLinux:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-XnestTuxCare:OracleLinux:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-XorgTuxCare:OracleLinux:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-XvfbTuxCare:OracleLinux:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-XwaylandTuxCare:OracleLinux:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-commonTuxCare:OracleLinux:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-develTuxCare:OracleLinux:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-sourceTuxCare:OracleLinux:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-XdmxTuxCare:RHEL:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xorg-x11-server-XephyrTuxCare:RHEL:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-XnestTuxCare:RHEL:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-XorgTuxCare:RHEL:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-XvfbTuxCare:RHEL:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-XwaylandTuxCare:RHEL:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-commonTuxCare:RHEL:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-develTuxCare:RHEL:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-sourceTuxCare:RHEL:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-XdmxTuxCare:CentOS:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-XephyrTuxCare:CentOS:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-XnestTuxCare:CentOS:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-XorgTuxCare:CentOS:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-XvfbTuxCare:CentOS:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-XwaylandTuxCare:CentOS:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-commonTuxCare:CentOS:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-develTuxCare:CentOS:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
xorg-x11-server-sourceTuxCare:CentOS:7 From an advisory covering 4 CVEs | before 1.20.4-99.el7_9.tuxcare.els8 | 1.20.4-99.el7_9.tuxcare.els8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-9632 is a medium vulnerability (CVSS 4.3) in Vinzzb Phplist Subber, published September 11, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 5th percentile. No source names a fixed version.
References
wordfence.com/threat-intel/vulnerabilities/id/e8113238-5208-42cd-aed6-7ec61c3ced85?source=cve
plugins.trac.wordpress.org/browser/phpls/tags/1.1/admin/init.php
nvd.nist.gov/vuln/detail/CVE-2025-9632
github.com/advisories/GHSA-9hh2-5xwh-4mjj
errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2025-1765209058.html