CVE-2025-1306 | spicethemes Newscrunch Plugin up to 1.8.4 on WordPress newscrunch_install_and_activate_plugin cross-site request forgery

A vulnerability was found in spicethemes Newscrunch Plugin up to 1.8.4 on WordPress. It has been classified as problematic. Affected is the function newscrunch_install_and_activate_plugin. The manipulation leads to cross-site request forgery.

This vulnerability is traded as CVE-2025-1306. It is possible to launch the attack remotely. There is no exploit available.