CVE-2025-14454 is a CSRF vulnerability in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin, affecting all versions up to 2.7.0. The issue is caused by missing or incorrect nonce validation on the bulk delete feature, enabling attackers to perform unauthorized slider deletions if they can induce an administrator to execute a crafted request. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity, with no known exploits or vendor patches documented at this time.

Successful exploitation allows an attacker to delete arbitrary sliders on a vulnerable WordPress site by tricking an authenticated administrator into performing a malicious action. This results in limited impact affecting the integrity of slider content but does not affect confidentiality or availability directly. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted links or requests that could trigger bulk delete actions in the plugin. Monitoring for updates from the plugin vendor is recommended.