The Skysa Text Ticker App for WordPress contains a Cross‑Site Request Forgery flaw due to missing or incorrect nonce validation in the admin settings page. An attacker can supply a forged request that tricks an authenticated administrator into submitting altered configuration values, such as the scrolling message text and target URL. This flaw permits an attacker to deface the ticker, redirect site visitors to malicious destinations, or otherwise manipulate content that appears on the front‑end, thereby compromising content integrity and potentially user trust. The weakness is a classic CSRF vulnerability (CWE‑352).

WordPress sites that have installed the Skysa Text Ticker App plugin, specifically versions 1.4 and earlier by vendor davidskysa. Any blog or content site running these plugin versions and having an active administrator account is susceptible.

The CVSS score of 4.3 indicates a moderate risk level; the EPSS score is not available and the vulnerability is not listed in CISA KEV. Exploitation requires an attacker to lure an administrator into clicking a crafted link or form, which is a feasible social‑engineering attack but not trivial. Vulnerability applies to unauthenticated attackers who can reach the site’s admin interface, thus the attack vector is primarily browser‑based web. While the flaw is not trivially exploitable, the potential impact on user experience and trust warrants prompt attention.