MediumVulnerabilityLLM-specific
CVE-2024-12605: The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2024-12605
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
CVE-2024-12605 affects the AI Scribe WordPress plugin, including all versions up to and including 2.3. Missing or incorrect nonce validation on the "al_scribe_content_data" actions enables a Cross-Site Request Forgery flaw. An unauthenticated attacker who tricks a site administrator into clicking a link can forge a request that updates the plugin's settings.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumCVE-2026-111372: AI ChatBot for WooCommerce WoowBot plugin authorization bypass in RAG syncSame vendor · NVD/CVE Database
- HighCVE-2026-107685: req_llm WebSocket streaming client accepts untrusted TLS certificatesSame vendor · NVD/CVE Database
- MediumCVE-2026-113459: TYPO3 OpenAI API key exposed to backend users in page sourceSame vendor · NVD/CVE Database
- MediumCVE-2026-109296: Open WebUI missing authorization lets users reach disabled model backendsSame vendor · NVD/CVE Database
- MediumCVE-2026-107430: VideoWhisper Site Manager for ChatGPT, Claude, Codex missing authorization checkSame vendor · NVD/CVE Database