Skip to content

Commit 8498e21

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-4cxv-4ppr-px4m GHSA-6jch-8crw-wv3g GHSA-95g3-m84h-pvg8 GHSA-g79r-wqxw-xp7q GHSA-qxh8-5779-hg4r
1 parent 557cc08 commit 8498e21

File tree

5 files changed

+221
-0
lines changed

5 files changed

+221
-0
lines changed

‎advisories/unreviewed/2025/10/GHSA-4cxv-4ppr-px4m/GHSA-4cxv-4ppr-px4m.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4cxv-4ppr-px4m",
4+
"modified": "2025-10-01T06:30:22Z",
5+
"published": "2025-10-01T06:30:22Z",
6+
"aliases": [
7+
"CVE-2025-9075"
8+
],
9+
"details": "The ZoloBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Gutenberg blocks in versions up to, and including, 2.3.10. This is due to insufficient input sanitization and output escaping on user-supplied attributes within multiple block components including Google Maps markers, Lightbox captions, Image Gallery data attributes, Progress Pie prefix/suffix fields, and Text Path URL fields. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9075"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/zoloblocks/tags/2.3.3/build/blocks/google-map/frontend.js#L1"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/zoloblocks/tags/2.3.3/build/blocks/image-gallery/frontend.js#L1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/zoloblocks/tags/2.3.3/build/blocks/progress-pie/frontend.js#L1"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/zoloblocks/tags/2.3.3/build/blocks/text-path/frontend.js#L1"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3351996%40zoloblocks&new=3351996%40zoloblocks&sfp_email=&sfph_mail="
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3369092%40zoloblocks&new=3369092%40zoloblocks&sfp_email=&sfph_mail="
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5860d456-a992-4816-8c93-7311c33734e4?source=cve"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-79"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2025-10-01T04:16:05Z"
59+
}
60+
}

‎advisories/unreviewed/2025/10/GHSA-6jch-8crw-wv3g/GHSA-6jch-8crw-wv3g.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6jch-8crw-wv3g",
4+
"modified": "2025-10-01T06:30:22Z",
5+
"published": "2025-10-01T06:30:22Z",
6+
"aliases": [
7+
"CVE-2025-10744"
8+
],
9+
"details": "The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view information like full paths and full paths to backup files information contained in the exposed log files.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10744"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/softdiscover-db-file-manager/tags/1.5.0/modules/filemanager/controllers/backup.php#L460"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/softdiscover-db-file-manager/tags/1.5.0/modules/filemanager/helpers/iprogress.php#L19"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3369101%40softdiscover-db-file-manager&new=3369101%40softdiscover-db-file-manager&sfp_email=&sfph_mail="
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30147e39-af94-4620-870b-71a0a46b7509?source=cve"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-200"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-10-01T04:16:01Z"
47+
}
48+
}

‎advisories/unreviewed/2025/10/GHSA-95g3-m84h-pvg8/GHSA-95g3-m84h-pvg8.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-95g3-m84h-pvg8",
4+
"modified": "2025-10-01T06:30:22Z",
5+
"published": "2025-10-01T06:30:22Z",
6+
"aliases": [
7+
"CVE-2025-9512"
8+
],
9+
"details": "The Schema & Structured Data for WP & AMP WordPress plugin before 1.50 does not properly handles HTML tag attribute modifications, making it possible for unauthenticated attackers to conduct Stored XSS attacks via post comments.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9512"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/e45d9335-3665-4155-abdf-9eeea250f1ba"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-10-01T06:15:31Z"
28+
}
29+
}

‎advisories/unreviewed/2025/10/GHSA-g79r-wqxw-xp7q/GHSA-g79r-wqxw-xp7q.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g79r-wqxw-xp7q",
4+
"modified": "2025-10-01T06:30:22Z",
5+
"published": "2025-10-01T06:30:22Z",
6+
"aliases": [
7+
"CVE-2025-10538"
8+
],
9+
"details": "An authentication bypass vulnerability exists in LG Innotek camera models LND7210 and LNV7210R. The vulnerability allows a malicious actor to gain access to camera information including user account information.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10538"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-07"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-288"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-01T04:15:48Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-qxh8-5779-hg4r/GHSA-qxh8-5779-hg4r.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qxh8-5779-hg4r",
4+
"modified": "2025-10-01T06:30:22Z",
5+
"published": "2025-10-01T06:30:22Z",
6+
"aliases": [
7+
"CVE-2025-10735"
8+
],
9+
"details": "The Block For Mailchimp – Easy Mailchimp Form Integration plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.12 via the mcbSubmit_Form_Data(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10735"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.svn.wordpress.org/block-for-mailchimp/tags/1.1.9/mailchimp/API.php"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3368808%40block-for-mailchimp&new=3368808%40block-for-mailchimp&sfp_email=&sfph_mail="
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://wordpress.org/plugins/block-for-mailchimp"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/51de575f-d458-4a7d-bc57-4a11e5124377?source=cve"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-918"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-10-01T04:15:59Z"
47+
}
48+
}

0 commit comments

Comments
 (0)