CVE-2025-13528

MEDIUMNuclei

Feedback Modal for Website <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export_data' Parameter

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-13528 has a selected CVSS score of 5.3 (medium); EIP currently links 1 Nuclei template.

Description

The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_export' function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to export all feedback data in CSV or JSON format via the 'export_data' parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 5, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Feedback Modal for Website

Browse nedwp / Feedback Modal for Website

Default status: unaffected

CVE ListThrough 1.0.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMFeedback Modal for Website <= 1.0.1 - Unauthenticated Feedback Export

The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_export' function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to export all feedback data in CSV or JSON format via the 'export_data' parameter.

Impact

Unauthenticated attackers can export all feedback data, leading to complete data disclosure.

Remediation

Update to the latest version beyond 1.0.1.

WeaknessesCWE-862
Authorscoffeetaro_12
Template tagscvecve2025wordpresswp-pluginfeedback-modalunauthinfo-disclosure
https://wpscan.com/vulnerability/fbba8734-482e-4c22-9ee9-12e807a68ccc/ https://nvd.nist.gov/vuln/detail/CVE-2025-13528

Source: ProjectDiscovery

References

4