🔐 CVE Alert

CVE-2026-6710

MEDIUM 4.3

Skysa Text Ticker App <= 1.4 - Cross-Site Request Forgery to Settings Modification via 'Save Settings' Form

CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
2th

The Skysa Text Ticker App plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the SkysaApps_Admin_AppPage function. This makes it possible for unauthenticated attackers to trick a site administrator into making a forged request to modify the plugin's settings, including the scrolling message text and URL, via a forged cross-site request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CWE CWE-352
Vendor davidskysa
Product skysa text ticker app
Published May 12, 2026
Last Updated May 13, 2026
Stay Ahead of the Next One

Get instant alerts for davidskysa skysa text ticker app

Be the first to know when new medium vulnerabilities affecting davidskysa skysa text ticker app are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

davidskysa / Skysa Text Ticker App
0 ≤ 1.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/bcd5b83a-7d51-455b-bb31-dd776264fc6b?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/skysa-text-ticker-app/trunk/skysa-required/admin.php#L281 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/skysa-text-ticker-app/tags/1.4/skysa-required/admin.php#L281 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/skysa-text-ticker-app/trunk/skysa-required/admin.php#L215 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/skysa-text-ticker-app/tags/1.4/skysa-required/admin.php#L215

Credits

Muhammad Nur Ibnu Hubab