CVE-2025-14062 describes a CSRF vulnerability in the Animated Pixel Marquee Creator WordPress plugin (versions up to 1.0.0). The vulnerability arises because the plugin's marquee deletion function lacks nonce validation, enabling attackers to perform unauthorized deletion of marquees if an administrator is tricked into executing a malicious request. The attack requires user interaction (UI:R) but no privileges or authentication (PR:N). The vulnerability impacts integrity but not confidentiality or availability.

An attacker can cause an administrator to delete arbitrary marquees without their intent, resulting in limited integrity impact on the affected WordPress site. There is no impact on confidentiality or availability. Exploitation requires tricking an administrator into clicking a malicious link or similar action.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking untrusted links and consider disabling or removing the plugin if possible. Implementing nonce validation on the marquee deletion function would mitigate this vulnerability.