Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-12376: Icon List Block plugin for WordPress allows attackers to access internal services

CVE-2025-12376 · published 11 months ago

Summary

The Icon List Block plugin for WordPress has a security flaw that could allow an attacker with a basic account to access internal services and information. This could happen if an attacker were to exploit this weakness. To protect your site, update the plugin to the latest version or consider removing it if you're not using it.

Original advisory text

The Icon List Block – Add Icon-Based Lists with Custom Styles plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.1 via the fs_api_request function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Only valid JSON objects are rendered in the response.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published18 Nov 2025

Updated29 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-12376 · NVD

Track software like this

Free during beta