Skip to content

Commit 836846e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-34r3-h75p-74mh GHSA-6gww-hr44-3pw7 GHSA-j6v2-qq6j-wfg4 GHSA-pfhq-2m75-72hp GHSA-qjm3-c7wh-w6v2
1 parent 79eeb91 commit 836846e

File tree

5 files changed

+182
-0
lines changed

5 files changed

+182
-0
lines changed

‎advisories/unreviewed/2025/09/GHSA-34r3-h75p-74mh/GHSA-34r3-h75p-74mh.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-34r3-h75p-74mh",
4+
"modified": "2025-09-09T06:30:17Z",
5+
"published": "2025-09-09T06:30:17Z",
6+
"aliases": [
7+
"CVE-2025-8889"
8+
],
9+
"details": "The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8889"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/5d84a577-62aa-4aa2-ac39-b146eae65243"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-09-09T06:15:32Z"
28+
}
29+
}

‎advisories/unreviewed/2025/09/GHSA-6gww-hr44-3pw7/GHSA-6gww-hr44-3pw7.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6gww-hr44-3pw7",
4+
"modified": "2025-09-09T06:30:17Z",
5+
"published": "2025-09-09T06:30:17Z",
6+
"aliases": [
7+
"CVE-2025-9489"
8+
],
9+
"details": "The The WP-Members Membership Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9489"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.2/includes/class-wp-members-shortcodes.php#L69"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.2/includes/class-wp-members-shortcodes.php#L983"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa2035ef-5251-49cc-a480-b6c167b5ef8c?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-94"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-09-09T05:15:33Z"
43+
}
44+
}

‎advisories/unreviewed/2025/09/GHSA-j6v2-qq6j-wfg4/GHSA-j6v2-qq6j-wfg4.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j6v2-qq6j-wfg4",
4+
"modified": "2025-09-09T06:30:18Z",
5+
"published": "2025-09-09T06:30:18Z",
6+
"aliases": [
7+
"CVE-2025-9061"
8+
],
9+
"details": "The Wilmer Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9061"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://themeforest.net/item/wilmr-construction-wordpress-theme/23695848"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53d65d4c-4bd6-4e18-b7ba-ee64328faf32?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-09-09T06:15:35Z"
39+
}
40+
}

‎advisories/unreviewed/2025/09/GHSA-pfhq-2m75-72hp/GHSA-pfhq-2m75-72hp.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pfhq-2m75-72hp",
4+
"modified": "2025-09-09T06:30:18Z",
5+
"published": "2025-09-09T06:30:18Z",
6+
"aliases": [
7+
"CVE-2025-9111"
8+
],
9+
"details": "The AI ChatBot for WordPress WordPress plugin before 7.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9111"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/5845bcff-beb8-45c8-b182-3dc9e209008b"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-09-09T06:15:35Z"
28+
}
29+
}

‎advisories/unreviewed/2025/09/GHSA-qjm3-c7wh-w6v2/GHSA-qjm3-c7wh-w6v2.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qjm3-c7wh-w6v2",
4+
"modified": "2025-09-09T06:30:17Z",
5+
"published": "2025-09-09T06:30:17Z",
6+
"aliases": [
7+
"CVE-2025-9058"
8+
],
9+
"details": "The Mikado Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9058"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://themeforest.net/user/mikado-themes/portfolio"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cba546d8-df3e-4ada-9cf9-663baf175dd0?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-09-09T06:15:34Z"
39+
}
40+
}

0 commit comments

Comments
 (0)