Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Image Buzz plugin lets anyone change API keys

CVE-2025-14484 · published 1 month ago
Summary

The Image Buzz WordPress plugin up to version 1.0.3 does not verify who is making changes to its API key settings. As a result, someone who is not logged in can alter the Pixabay, Unsplash or Pixels keys that the site owner has configured, potentially redirecting image searches or exposing the keys. Install the latest safe version of the plugin or disable/remove it until the issue is fixed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
kamleshyadav image buzz <= 1.0.3
Original advisory text
Image Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter
The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys (Pixabay, Unsplash, Pixels) configured by site administrators via the 'pixabay_api', 'unsplash_api', or 'pixels_api' parameters.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published22 Sep 2026
Updated31 Oct 2026
First seen22 Sep 2026
Sources
CVE-2025-14484 · NVD
CVE-2025-14484 · MITRE
Track software like this
Free during beta