CVE-2025-6055: 
WordPress vulnerability analysis and mitigation

The Zen Sticky Social plugin for WordPress (CVE-2025-6055) is affected by a Cross-Site Request Forgery vulnerability in all versions up to and including 0.3. The vulnerability was discovered by researcher johska and disclosed on June 13, 2025, with publication to the CVE List occurring on June 14, 2025 (NVD, Wiz).

The vulnerability stems from missing or incorrect nonce validation on the 'zen-social-sticky/zen-sticky-social.php' page. It has been assessed with a CVSS v3.1 Base Score of 6.1 (Medium) with the vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-352: Cross-Site Request Forgery (CSRF) (NVD, Wordfence).

The vulnerability enables unauthenticated attackers to update settings and inject malicious web scripts through forged requests, provided they can successfully trick a site administrator into performing specific actions, such as clicking on a malicious link (Wiz).

Website administrators running the Zen Sticky Social plugin should upgrade to a version newer than 0.3 when available. In the interim, administrators should exercise heightened caution when clicking on links while logged into their WordPress dashboard (Wiz).