CVE-2025-12404 is a CSRF vulnerability in the Like-it plugin for WordPress, affecting all versions up to and including 2.2. The vulnerability arises from missing or incorrect nonce validation in the likeit_conf() function, enabling attackers to forge requests that can update plugin settings and inject malicious web scripts if a site administrator is tricked into clicking a crafted link. The CVSS 3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

An attacker can exploit this vulnerability to perform unauthorized changes to the plugin settings and inject malicious scripts by leveraging the trust of an authenticated administrator who interacts with a crafted request. This can lead to partial compromise of site integrity and confidentiality. There is no indication of impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted links and consider disabling or removing the Like-it plugin if possible. Monitor vendor channels for updates or patches addressing this vulnerability.