HEROIC · CVE-2026-125841 · Other
NO FIX YET · SEE WHAT TO DO
Heroic by webriti has a cross-site request forgery flaw affecting versions through 1.4.2. A logged-in user who visits a malicious page could have unwanted actions performed on the site without their knowledge.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
WordPress sites with the Heroic theme (by webriti, a child theme of Quality, about 500+ installs) at version 1.4.2 or earlier. Patchstack, the CVE assigner, reports a CSRF flaw (CVSS 8.8): a logged-in user, likely an admin, who visits a malicious page can have actions performed on the site. The affected actions are not stated in the sources I read. Sites without the theme can skip it.
Not affected if theme-not-active, theme-not-installed
Who cares csrf, heroic-theme, webriti, wordpress, wordpress-theme
1.4.2 (updated 2026-01-01) as the latest release, and Patchstack shows 0 patchedCross-Site Request Forgery (CSRF) vulnerability in webriti Heroic heroic allows Cross Site Request Forgery.This issue affects Heroic: from n/a through 1.4.2.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.