davidskysa Skysa Text Ticker App Plugin up to 1.4 on WordPress Scrolling Message SkysaApps_Admin_AppPage cross-site request forgery

Summaryinfo

A vulnerability categorized as problematic has been discovered in davidskysa Skysa Text Ticker App Plugin up to 1.4 on WordPress. Impacted is the function SkysaApps_Admin_AppPage of the component Scrolling Message Handler. Such manipulation leads to cross-site request forgery. This vulnerability is uniquely identified as CVE-2026-6710. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in davidskysa Skysa Text Ticker App Plugin up to 1.4 on WordPress. Affected by this issue is the function SkysaApps_Admin_AppPage of the component Scrolling Message Handler. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is integrity. CVE summarizes:

The Skysa Text Ticker App plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the SkysaApps_Admin_AppPage function. This makes it possible for unauthenticated attackers to trick a site administrator into making a forged request to modify the plugin's settings, including the scrolling message text and URL, via a forged cross-site request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The weakness was disclosed by Muhammad Nur Ibnu Hubab. The advisory is shared for download at wordfence.com. This vulnerability is handled as CVE-2026-6710 since 04/20/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 1.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-29409). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• davidskysa

Name

• Skysa Text Ticker App Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion