Skip to content

Commit aea7e1f

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3w6x-j894-mcx4 GHSA-4xqm-hx6r-2gp8 GHSA-5r88-ccjv-66xq GHSA-8wv5-4mjg-mcjg GHSA-93v3-46mj-22fw GHSA-h7h6-79g4-qpq3 GHSA-hjcx-w529-729v GHSA-j4mr-6qvv-6q4w GHSA-mrfv-m5wm-5w6w GHSA-qw27-cxc9-7xxh GHSA-r9h3-v9hv-vpf2 GHSA-v43f-9m3r-qj67 GHSA-vwg9-2rf4-w4xc GHSA-x3v7-84r2-j89m GHSA-xgr9-pmph-722v
1 parent f1f0449 commit aea7e1f

File tree

15 files changed

+598
-0
lines changed

15 files changed

+598
-0
lines changed

‎advisories/unreviewed/2025/12/GHSA-3w6x-j894-mcx4/GHSA-3w6x-j894-mcx4.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3w6x-j894-mcx4",
4+
"modified": "2025-12-31T06:30:18Z",
5+
"published": "2025-12-31T06:30:18Z",
6+
"aliases": [
7+
"CVE-2025-68885"
8+
],
9+
"details": "Cross-Site Request Forgery (CSRF) vulnerability in Page Carbajal Custom Post Status allows Stored XSS.This issue affects Custom Post Status: from n/a through 1.1.0.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68885"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://vdp.patchstack.com/database/wordpress/plugin/custom-post-status/vulnerability/wordpress-custom-post-status-plugin-1-1-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-31T06:15:41Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-4xqm-hx6r-2gp8/GHSA-4xqm-hx6r-2gp8.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4xqm-hx6r-2gp8",
4+
"modified": "2025-12-31T06:30:17Z",
5+
"published": "2025-12-31T06:30:17Z",
6+
"aliases": [
7+
"CVE-2025-13029"
8+
],
9+
"details": "The Knowband Mobile App Builder WordPress plugin before 3.0.0 does not have authorisation when deleting users via its REST API, allowing unauthenticated attackers to delete arbitrary users.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13029"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/22344534-cd36-4817-b683-c0af55759e01"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-12-31T06:15:40Z"
28+
}
29+
}

‎advisories/unreviewed/2025/12/GHSA-5r88-ccjv-66xq/GHSA-5r88-ccjv-66xq.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5r88-ccjv-66xq",
4+
"modified": "2025-12-31T06:30:17Z",
5+
"published": "2025-12-31T06:30:17Z",
6+
"aliases": [
7+
"CVE-2025-49342"
8+
],
9+
"details": "Cross-Site Request Forgery (CSRF) vulnerability in Wolfgang Häfelinger Custom Style allows Stored XSS.This issue affects Custom Style: from n/a through 1.0.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49342"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://vdp.patchstack.com/database/wordpress/plugin/custom-style/vulnerability/wordpress-custom-style-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-31T06:15:40Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-8wv5-4mjg-mcjg/GHSA-8wv5-4mjg-mcjg.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8wv5-4mjg-mcjg",
4+
"modified": "2025-12-31T06:30:18Z",
5+
"published": "2025-12-31T06:30:18Z",
6+
"aliases": [
7+
"CVE-2025-49353"
8+
],
9+
"details": "Cross-Site Request Forgery (CSRF) vulnerability in Marcin Kijak Noindex by Path allows Stored XSS.This issue affects Noindex by Path: from n/a through 1.0.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49353"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://vdp.patchstack.com/database/wordpress/plugin/noindex-by-path/vulnerability/wordpress-noindex-by-path-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-31T06:15:41Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-93v3-46mj-22fw/GHSA-93v3-46mj-22fw.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-93v3-46mj-22fw",
4+
"modified": "2025-12-31T06:30:17Z",
5+
"published": "2025-12-31T06:30:16Z",
6+
"aliases": [
7+
"CVE-2025-15373"
8+
],
9+
"details": "A security vulnerability has been detected in EyouCMS up to 1.7.7. Impacted is the function saveRemote of the file application/function.php. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor is \"[a]cknowledging the existence of the vulnerability, we have completed the fix and will release a new version, v1.7.8\".",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15373"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://note-hxlab.wetolink.com/share/DeUFyoSjsPPK"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://note-hxlab.wetolink.com/share/DeUFyoSjsPPK#-span--strong-proof-of-concept---strong---span-"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.339081"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.339081"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.718465"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-918"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-31T04:15:53Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-h7h6-79g4-qpq3/GHSA-h7h6-79g4-qpq3.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h7h6-79g4-qpq3",
4+
"modified": "2025-12-31T06:30:17Z",
5+
"published": "2025-12-31T06:30:17Z",
6+
"aliases": [
7+
"CVE-2025-49343"
8+
],
9+
"details": "Cross-Site Request Forgery (CSRF) vulnerability in Socialprofilr Social Profilr allows Stored XSS.This issue affects Social Profilr: from n/a through 1.0.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49343"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://vdp.patchstack.com/database/wordpress/plugin/social-profilr-display-social-network-profile/vulnerability/wordpress-social-profilr-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-31T06:15:40Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-hjcx-w529-729v/GHSA-hjcx-w529-729v.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hjcx-w529-729v",
4+
"modified": "2025-12-31T06:30:18Z",
5+
"published": "2025-12-31T06:30:18Z",
6+
"aliases": [
7+
"CVE-2025-49354"
8+
],
9+
"details": "Cross-Site Request Forgery (CSRF) vulnerability in Mindstien Technologies Recent Posts From Each Category allows Stored XSS.This issue affects Recent Posts From Each Category: from n/a through 1.4.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49354"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://vdp.patchstack.com/database/wordpress/plugin/recent-posts-from-each-category/vulnerability/wordpress-recent-posts-from-each-category-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-31T06:15:41Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-j4mr-6qvv-6q4w/GHSA-j4mr-6qvv-6q4w.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j4mr-6qvv-6q4w",
4+
"modified": "2025-12-31T06:30:17Z",
5+
"published": "2025-12-31T06:30:17Z",
6+
"aliases": [
7+
"CVE-2025-14434"
8+
],
9+
"details": "The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upk_alex_grid_loadmore_posts without ensuring that posts to be displayed are published authentication. This allows an unauthenticated attacker to query arbitrary posts and retrieve rendered HTML content of private and unpublished ones.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14434"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/bf3c3193-fc9c-454b-ad4f-94ba1669a312"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-12-31T06:15:40Z"
28+
}
29+
}

‎advisories/unreviewed/2025/12/GHSA-mrfv-m5wm-5w6w/GHSA-mrfv-m5wm-5w6w.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mrfv-m5wm-5w6w",
4+
"modified": "2025-12-31T06:30:18Z",
5+
"published": "2025-12-31T06:30:18Z",
6+
"aliases": [
7+
"CVE-2025-69277"
8+
],
9+
"details": "libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69277"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/jedisct1/libsodium/commit/ad3004ec8731730e93fcfbbc824e67eadc1c1bae"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://00f.net/2025/12/30/libsodium-vulnerability"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://ianix.com/pub/ed25519-deployment.html"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://news.ycombinator.com/item?id=46435614"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-184"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-31T06:15:41Z"
47+
}
48+
}

‎advisories/unreviewed/2025/12/GHSA-qw27-cxc9-7xxh/GHSA-qw27-cxc9-7xxh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qw27-cxc9-7xxh",
4+
"modified": "2025-12-31T06:30:17Z",
5+
"published": "2025-12-31T06:30:17Z",
6+
"aliases": [
7+
"CVE-2025-49344"
8+
],
9+
"details": "Cross-Site Request Forgery (CSRF) vulnerability in Rene Ade SensitiveTagCloud allows Stored XSS.This issue affects SensitiveTagCloud: from n/a through 1.4.1.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49344"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://vdp.patchstack.com/database/wordpress/plugin/sensitive-tag-cloud/vulnerability/wordpress-sensitivetagcloud-plugin-1-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-31T06:15:40Z"
35+
}
36+
}

0 commit comments

Comments
 (0)