Medium severity5.3NVD Advisory· Published Dec 5, 2025· Updated Apr 15, 2026

CVE-2025-13528

Description

The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_export' function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to export all feedback data in CSV or JSON format via the 'export_data' parameter.

Affected products

WordPress/Feedback Modal For Websiteinferred
Range: <=1.0.1
Package: https://wordpress.org/plugins/feedback-modal-for-website

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

plugins.trac.wordpress.org/browser/feedback-modal-for-website/tags/1.0.1/inc/admin/main.phpnvd
plugins.trac.wordpress.org/browser/feedback-modal-for-website/trunk/inc/admin/main.phpnvd
www.wordfence.com/threat-intel/vulnerabilities/id/f3341c29-a69e-4618-a8a5-11f4141ff88fnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000