CVE-2025-12402: LinkedIn Resume <= 2.00 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The LinkedIn Resume plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.00. This is due to missing or incorrect nonce validation on the linkedinresumeprintAdminPage() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12402?
CVE-2025-12402 has a moderate severity level due to its potential for exploitation via Cross-Site Request Forgery.
How do I fix CVE-2025-12402?
To fix CVE-2025-12402, update the LinkedIn Resume plugin for WordPress to version 2.01 or later where the nonce validation is properly implemented.
Who is affected by CVE-2025-12402?
CVE-2025-12402 affects all versions of the LinkedIn Resume plugin for WordPress up to and including version 2.00.
What type of vulnerability is CVE-2025-12402?
CVE-2025-12402 is a Cross-Site Request Forgery vulnerability that can be exploited by unauthenticated attackers.
What component of the LinkedIn Resume plugin is vulnerable in CVE-2025-12402?
The vulnerable component in CVE-2025-12402 is the function linkedinresume_printAdminPage() which lacks proper nonce validation.