CVE-2026-121770: WordPress VISeek plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability

Q: What does an attacker need to exploit this issue?

The attacker needs to cause a user to interact with a malicious request, as indicated by the required user interaction in the CVSS vector. No attacker privileges are required.

Q: Who is exposed?

WordPress sites using the VillaTheme VISeek plugin are affected through version 1.0.5. The provided data does not identify any configuration requirement or exclusion.

Q: What is the likely impact of successful exploitation?

Successful exploitation can affect integrity and availability, while no confidentiality impact is identified. The CVSS score is 5.4 (medium).

Published Nov 11, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme VISeek viseek-easy-custom-search allows Cross Site Request Forgery.This issue affects VISeek: from n/a through 1.0.5.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress VISeek plugin to a version that resolves this vulnerability.
Fixed in 1.0.6

Event History

Nov 11, 2026

CVE Published

via MITRE·11:48 AM

Data Sourced

via MITRE·11:48 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·12:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs to cause a user to interact with a malicious request, as indicated by the required user interaction in the CVSS vector. No attacker privileges are required.

Who is exposed?

WordPress sites using the VillaTheme VISeek plugin are affected through version 1.0.5. The provided data does not identify any configuration requirement or exclusion.

What is the likely impact of successful exploitation?