Skip to content

Commit 6d6271c

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-7h84-ffvq-9q78 GHSA-9x7j-2h58-mc3v GHSA-q93v-5jjx-7797 GHSA-vm64-rwh3-4fc9
1 parent 2552e6c commit 6d6271c

File tree

4 files changed

+138
-0
lines changed

4 files changed

+138
-0
lines changed

‎advisories/unreviewed/2025/12/GHSA-7h84-ffvq-9q78/GHSA-7h84-ffvq-9q78.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7h84-ffvq-9q78",
4+
"modified": "2025-12-02T06:30:25Z",
5+
"published": "2025-12-02T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-13606"
8+
],
9+
"details": "The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.19. This is due to missing or incorrect nonce validation on the `parseData` function. This makes it possible for unauthenticated attackers to export sensitive information including user data, email addresses, password hashes, and WooCommerce data to an attacker-controlled file path on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13606"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3405694"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3511e110-d091-447d-87c0-25d33900bc30?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-352"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-02T05:16:20Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-9x7j-2h58-mc3v/GHSA-9x7j-2h58-mc3v.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9x7j-2h58-mc3v",
4+
"modified": "2025-12-02T06:30:25Z",
5+
"published": "2025-12-02T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-13001"
8+
],
9+
"details": "The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as admin to perform SQL injection attacks",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13001"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/4e7a8154-46bf-44c9-ad9a-273e99ae2104"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-12-02T06:15:45Z"
28+
}
29+
}

‎advisories/unreviewed/2025/12/GHSA-q93v-5jjx-7797/GHSA-q93v-5jjx-7797.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q93v-5jjx-7797",
4+
"modified": "2025-12-02T06:30:25Z",
5+
"published": "2025-12-02T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-13000"
8+
],
9+
"details": "The db-access WordPress plugin through 0.8.7 does not have authorization in an AJAX action, allowing any authenticated users, such as subscriber to perform SQLI attacks",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13000"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/aec53f87-6500-4c8a-925a-146be61bbabf"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-12-02T06:15:45Z"
28+
}
29+
}

‎advisories/unreviewed/2025/12/GHSA-vm64-rwh3-4fc9/GHSA-vm64-rwh3-4fc9.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vm64-rwh3-4fc9",
4+
"modified": "2025-12-02T06:30:25Z",
5+
"published": "2025-12-02T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-13387"
8+
],
9+
"details": "The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name in all versions up to, and including, 1.5.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13387"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3399955/kadence-woocommerce-email-designer"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1e0cf512-f676-4f47-abaa-5198998376b7?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-02T05:16:17Z"
39+
}
40+
}

0 commit comments

Comments
 (0)