Skip to content

Commit 13f22d9

Browse files
cad-safe-botcad-safe-bot
committed
Auto-Update: 2026-02-27T09:00:11.894665+00:00
1 parent 5e07149 commit 13f22d9

File tree

16 files changed

+1148
-25
lines changed

16 files changed

+1148
-25
lines changed

‎CVE-2025/CVE-2025-129xx/CVE-2025-12981.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"id": "CVE-2025-12981",
3+
"sourceIdentifier": "security@wordfence.com",
4+
"published": "2026-02-27T07:17:09.300",
5+
"lastModified": "2026-02-27T07:17:09.300",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "The Listee theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.6. This is due to a broken validation check in the bundled listee-core plugin's user registration function that fails to properly sanitize the user_role parameter. This makes it possible for unauthenticated attackers to register as Administrator by manipulating the user_role parameter during registration."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV31": [
16+
{
17+
"source": "security@wordfence.com",
18+
"type": "Primary",
19+
"cvssData": {
20+
"version": "3.1",
21+
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
22+
"baseScore": 9.8,
23+
"baseSeverity": "CRITICAL",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "LOW",
26+
"privilegesRequired": "NONE",
27+
"userInteraction": "NONE",
28+
"scope": "UNCHANGED",
29+
"confidentialityImpact": "HIGH",
30+
"integrityImpact": "HIGH",
31+
"availabilityImpact": "HIGH"
32+
},
33+
"exploitabilityScore": 3.9,
34+
"impactScore": 5.9
35+
}
36+
]
37+
},
38+
"weaknesses": [
39+
{
40+
"source": "security@wordfence.com",
41+
"type": "Primary",
42+
"description": [
43+
{
44+
"lang": "en",
45+
"value": "CWE-269"
46+
}
47+
]
48+
}
49+
],
50+
"references": [
51+
{
52+
"url": "https://listee-wp.dreamstechnologies.com/documentation/changelog.html",
53+
"source": "security@wordfence.com"
54+
},
55+
{
56+
"url": "https://themeforest.net/item/listee-classified-ads-wordpress-theme/44526956",
57+
"source": "security@wordfence.com"
58+
},
59+
{
60+
"url": "https://themes.trac.wordpress.org/browser/listee/1.1.5/listee-core/includes/listee-core-users.php#L928",
61+
"source": "security@wordfence.com"
62+
},
63+
{
64+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d534feae-d1b7-4544-b1c5-c23f37dd5bab?source=cve",
65+
"source": "security@wordfence.com"
66+
}
67+
]
68+
}

‎CVE-2025/CVE-2025-133xx/CVE-2025-13327.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"id": "CVE-2025-13327",
3+
"sourceIdentifier": "secalert@redhat.com",
4+
"published": "2026-02-27T08:17:04.043",
5+
"lastModified": "2026-02-27T08:17:04.043",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV31": [
16+
{
17+
"source": "secalert@redhat.com",
18+
"type": "Primary",
19+
"cvssData": {
20+
"version": "3.1",
21+
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
22+
"baseScore": 6.3,
23+
"baseSeverity": "MEDIUM",
24+
"attackVector": "LOCAL",
25+
"attackComplexity": "HIGH",
26+
"privilegesRequired": "HIGH",
27+
"userInteraction": "REQUIRED",
28+
"scope": "UNCHANGED",
29+
"confidentialityImpact": "HIGH",
30+
"integrityImpact": "HIGH",
31+
"availabilityImpact": "HIGH"
32+
},
33+
"exploitabilityScore": 0.3,
34+
"impactScore": 5.9
35+
}
36+
]
37+
},
38+
"weaknesses": [
39+
{
40+
"source": "secalert@redhat.com",
41+
"type": "Primary",
42+
"description": [
43+
{
44+
"lang": "en",
45+
"value": "CWE-1286"
46+
}
47+
]
48+
}
49+
],
50+
"references": [
51+
{
52+
"url": "https://access.redhat.com/security/cve/CVE-2025-13327",
53+
"source": "secalert@redhat.com"
54+
},
55+
{
56+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407263",
57+
"source": "secalert@redhat.com"
58+
},
59+
{
60+
"url": "https://github.com/astral-sh/uv",
61+
"source": "secalert@redhat.com"
62+
},
63+
{
64+
"url": "https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628",
65+
"source": "secalert@redhat.com"
66+
},
67+
{
68+
"url": "https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64",
69+
"source": "secalert@redhat.com"
70+
}
71+
]
72+
}

‎CVE-2025/CVE-2025-140xx/CVE-2025-14040.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"id": "CVE-2025-14040",
3+
"sourceIdentifier": "security@wordfence.com",
4+
"published": "2026-02-27T07:17:09.710",
5+
"lastModified": "2026-02-27T07:17:09.710",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Call to Action' custom fields in all versions up to, and including, 13.4. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the 'action_text', 'action_button_text', 'action_link', and 'action_class' custom fields. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV31": [
16+
{
17+
"source": "security@wordfence.com",
18+
"type": "Primary",
19+
"cvssData": {
20+
"version": "3.1",
21+
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
22+
"baseScore": 6.4,
23+
"baseSeverity": "MEDIUM",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "LOW",
26+
"privilegesRequired": "LOW",
27+
"userInteraction": "NONE",
28+
"scope": "CHANGED",
29+
"confidentialityImpact": "LOW",
30+
"integrityImpact": "LOW",
31+
"availabilityImpact": "NONE"
32+
},
33+
"exploitabilityScore": 3.1,
34+
"impactScore": 2.7
35+
}
36+
]
37+
},
38+
"weaknesses": [
39+
{
40+
"source": "security@wordfence.com",
41+
"type": "Primary",
42+
"description": [
43+
{
44+
"lang": "en",
45+
"value": "CWE-79"
46+
}
47+
]
48+
}
49+
],
50+
"references": [
51+
{
52+
"url": "https://themeforest.net/item/automotive-car-dealership-business-wordpress-theme/9210971",
53+
"source": "security@wordfence.com"
54+
},
55+
{
56+
"url": "https://themeforest.net/item/automotive-car-dealership-business-wordpress-theme/9210971#item-description__changelog",
57+
"source": "security@wordfence.com"
58+
},
59+
{
60+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd4b65d-b916-432f-bb59-d2f8a9aadeac?source=cve",
61+
"source": "security@wordfence.com"
62+
}
63+
]
64+
}

‎CVE-2025/CVE-2025-141xx/CVE-2025-14149.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"id": "CVE-2025-14149",
3+
"sourceIdentifier": "security@wordfence.com",
4+
"published": "2026-02-27T07:17:09.903",
5+
"lastModified": "2026-02-27T07:17:09.903",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "The Xpro Addons \u2014 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Scroller widget box link attribute in all versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV31": [
16+
{
17+
"source": "security@wordfence.com",
18+
"type": "Primary",
19+
"cvssData": {
20+
"version": "3.1",
21+
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
22+
"baseScore": 6.4,
23+
"baseSeverity": "MEDIUM",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "LOW",
26+
"privilegesRequired": "LOW",
27+
"userInteraction": "NONE",
28+
"scope": "CHANGED",
29+
"confidentialityImpact": "LOW",
30+
"integrityImpact": "LOW",
31+
"availabilityImpact": "NONE"
32+
},
33+
"exploitabilityScore": 3.1,
34+
"impactScore": 2.7
35+
}
36+
]
37+
},
38+
"weaknesses": [
39+
{
40+
"source": "security@wordfence.com",
41+
"type": "Primary",
42+
"description": [
43+
{
44+
"lang": "en",
45+
"value": "CWE-79"
46+
}
47+
]
48+
}
49+
],
50+
"references": [
51+
{
52+
"url": "https://plugins.trac.wordpress.org/changeset/3470049/xpro-elementor-addons/trunk/widgets/image-scroller/layout/frontend.php?old=3122565&old_path=xpro-elementor-addons%2Ftrunk%2Fwidgets%2Fimage-scroller%2Flayout%2Ffrontend.php",
53+
"source": "security@wordfence.com"
54+
},
55+
{
56+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5569e2fa-ce20-4ad0-8089-7c9ec792cc44?source=cve",
57+
"source": "security@wordfence.com"
58+
}
59+
]
60+
}

‎CVE-2025/CVE-2025-155xx/CVE-2025-15509.json‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
{
2+
"id": "CVE-2025-15509",
3+
"sourceIdentifier": "security@vivo.com",
4+
"published": "2026-02-27T07:17:10.090",
5+
"lastModified": "2026-02-27T07:17:10.090",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "The\u00a0SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV40": [
16+
{
17+
"source": "security@vivo.com",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "4.0",
21+
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
22+
"baseScore": 7.1,
23+
"baseSeverity": "HIGH",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "LOW",
26+
"attackRequirements": "NONE",
27+
"privilegesRequired": "NONE",
28+
"userInteraction": "PASSIVE",
29+
"vulnConfidentialityImpact": "HIGH",
30+
"vulnIntegrityImpact": "LOW",
31+
"vulnAvailabilityImpact": "NONE",
32+
"subConfidentialityImpact": "NONE",
33+
"subIntegrityImpact": "NONE",
34+
"subAvailabilityImpact": "NONE",
35+
"exploitMaturity": "NOT_DEFINED",
36+
"confidentialityRequirement": "NOT_DEFINED",
37+
"integrityRequirement": "NOT_DEFINED",
38+
"availabilityRequirement": "NOT_DEFINED",
39+
"modifiedAttackVector": "NOT_DEFINED",
40+
"modifiedAttackComplexity": "NOT_DEFINED",
41+
"modifiedAttackRequirements": "NOT_DEFINED",
42+
"modifiedPrivilegesRequired": "NOT_DEFINED",
43+
"modifiedUserInteraction": "NOT_DEFINED",
44+
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
45+
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
46+
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
47+
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
48+
"modifiedSubIntegrityImpact": "NOT_DEFINED",
49+
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
50+
"Safety": "NOT_DEFINED",
51+
"Automatable": "NOT_DEFINED",
52+
"Recovery": "NOT_DEFINED",
53+
"valueDensity": "NOT_DEFINED",
54+
"vulnerabilityResponseEffort": "NOT_DEFINED",
55+
"providerUrgency": "NOT_DEFINED"
56+
}
57+
}
58+
]
59+
},
60+
"weaknesses": [
61+
{
62+
"source": "security@vivo.com",
63+
"type": "Secondary",
64+
"description": [
65+
{
66+
"lang": "en",
67+
"value": "CWE-306"
68+
}
69+
]
70+
}
71+
],
72+
"references": [
73+
{
74+
"url": "https://www.vivo.com/en/support/security-advisory-detail?id=20",
75+
"source": "security@vivo.com"
76+
}
77+
]
78+
}

0 commit comments

Comments
 (0)