Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
icated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6be74779-4db7-4d44-a706-285375f4fec9?source=cve - https://wordpress.org/plugins/extensions-leaflet-map - https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/4.7/php/geojsonmarker.php#L90 - https://plugins.trac.wordpress.org/changeset/3387532/
CVE ID: CVE-2025-12371 State: PUBLISHED Published: 2025-11-04T04:27:21.431Z Last Updated: 2025-11-04T15:15:44.559Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: shakhi Products: Nari Accountant Problem Types: CWE-79 Description: The Nari Accountant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via account settings in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site
arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c0a5e6b9-4da1-4d95-9fb1-aabb0d21b695?source=cve - https://wordpress.org/plugins/nari-accountant/
CVE ID: CVE-2025-12372 State: PUBLISHED Published: 2025-11-18T08:27:36.112Z Last Updated: 2025-11-18T21:42:53.480Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: _luigi Products: The Permalinks Cascade Problem Types: CWE-862 Description: The Permalinks Cascade plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action in the handleTPCAdminAjaxRequest function. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized administrative actions such as enabling or dis
ttackers, with subscriber-level access and above, to perform unauthorized administrative actions such as enabling or disabling automatic pinging settings and modifying page exclusion settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c08d420d-d521-4215-9ef7-b5d1c44a19d3?source=cve - https://plugins.trac.wordpress.org/browser/the-permalinks-cascade/tags/2.2/admin/admin-controller.class.php#L109 - https://plugins.trac.wordpress.org/browser/the-permalinks-cascade/tags/2.2/includes/core.class.php#L36
CVE ID: CVE-2025-12376 State: PUBLISHED Published: 2025-11-18T13:54:50.042Z Last Updated: 2025-11-18T14:30:38.295Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bplugins Products: Icon List Block – Add Icon-Based Lists with Custom Styles Problem Types: CWE-918 Description: The Icon List Block – Add Icon-Based Lists with Custom Styles plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.1 via the fs_api_request function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be u
er-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Only valid JSON objects are rendered in the response. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/438e2911-7663-44fe-883f-19ad29972aac?source=cve - https://plugins.trac.wordpress.org/browser/icon-list-block/tags/1.2.0/bplugins_sdk/inc/Base/FSActivate.php#L168
CVE ID: CVE-2025-12377 State: PUBLISHED Published: 2025-11-13T11:29:03.241Z Last Updated: 2025-11-13T14:46:20.368Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: smub Products: Gallery Plugin for WordPress – Envira Photo Gallery Problem Types: CWE-862 Description: The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.12.0. This makes it possible for authenticated attackers, with Author-level access and above, to perform multiple actions, such as removing images from arbitrary galleries. The
with Author-level access and above, to perform multiple actions, such as removing images from arbitrary galleries. The vulnerability was partially patched in version 1.12.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/69a0d985-cc85-45ba-889d-1ed30d06f9ce?source=cve - https://drive.google.com/file/d/1AgsJeff1x4pQAFVGmoSwwU75iiH4-H_p/view?usp=sharing - https://plugins.trac.wordpress.org/browser/envira-gallery-lite/trunk/includes/admin/ajax.php - https://research.cleantalk.org/cve-2025-12377/ - https://plugins.trac.wordpress.org/changeset/3387243/envira-gallery-lite/trunk/includes/admin/ajax.php?old=3133202&old_path
ps://plugins.trac.wordpress.org/changeset/3387243/envira-gallery-lite/trunk/includes/admin/ajax.php?old=3133202&old_path=envira-gallery-lite%2Ftrunk%2Fincludes%2Fadmin%2Fajax.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3394455%40envira-gallery-lite&old=3387243%40envira-gallery-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12378 State: PUBLISHED Published: 2025-10-28T05:32:05.752Z Last Updated: 2025-10-28T13:30:09.013Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Food Ordering System Problem Types: CWE-434, CWE-284 Description: A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addproduct.php. Performing manipulation of the argument photo results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330214 - https://vuldb.com/?ctiid.330214 - https://vuldb.com/?submit.674562 - https://github.com/tinggeogle01-lang/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-12380 State: PUBLISHED Published: 2025-10-28T14:06:34.814Z Last Updated: 2025-11-04T15:47:51.527Z Vendors: Mozilla Products: Firefox Description: Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox. This vulnerability affects Firefox < 144.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1993113 - https://www.mozilla.org/security/advisories/mfsa2025-86/
CVE ID: CVE-2025-12382 State: PUBLISHED Published: 2025-11-12T09:37:01.568Z Last Updated: 2025-11-13T10:48:50.053Z Vendors: AlgoSec Products: Firewall Analyzer Problem Types: CWE-22 Description: Improper Limitation of a Pathname 'Path Traversal') vulnerability in Algosec Firewall Analyzer on Linux, 64 bit allows an authenticated user to upload files to a restricted directory leading to code injection. This issue affects Algosec Firewall Analyzer: A33.0 (up to build 320), A33.10 (up to build 210). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://techdocs.algosec.com/en/cves/Content/tech-notes/cves/cve-2025-12382.htm
CVE ID: CVE-2025-12383 State: PUBLISHED Published: 2025-11-18T15:14:37.765Z Last Updated: 2025-11-18T21:34:35.027Z Vendors: Eclipse Foundation Products: Jersey Problem Types: CWE-362 Description: In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.eclipse.org/security/cve-assignment/-/issues/74
CVE ID: CVE-2025-12384 State: PUBLISHED Published: 2025-11-05T06:35:02.300Z Last Updated: 2025-11-05T14:22:37.337Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: bplugins Products: Document Embedder – Embed PDFs, Word, Excel, and Other Files Problem Types: CWE-862 Description: The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the "bplde_save_document_library", "bplde_get_all", "bplde_get_single", and "bplde_delete_docume
to perform an action in the "bplde_save_document_library", "bplde_get_all", "bplde_get_single", and "bplde_delete_document_library" functions. This makes it possible for unauthenticated attackers to create, read, update, and delete arbitrary document_library posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eb7e4e96-a4ff-4c6c-91de-c0e5ba78f0da?source=cve - https://plugins.trac.wordpress.org/changeset?old=3359820&old_path=document-emberdder%2Ftrunk%2Fincludes%2FDocumentLibrary%2FInit-DocumentLibrary.php&new=&new_path=document-emberdder%2Ftrunk%2Fincludes%2FDocumentLibrary%2FInit-DocumentLibrary.php - https://plugi
ary.php&new=&new_path=document-emberdder%2Ftrunk%2Fincludes%2FDocumentLibrary%2FInit-DocumentLibrary.php - https://plugins.trac.wordpress.org/changeset?old=3359820&old_path=document-emberdder%2Ftrunk%2Fdocument-library-block.php&new=&new_path=document-emberdder%2Ftrunk%2Fdocument-library-block.php
CVE ID: CVE-2025-12388 State: PUBLISHED Published: 2025-11-05T06:35:01.390Z Last Updated: 2025-11-05T14:23:30.683Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bplugins Products: Carousel Block – Responsive Image and Content Carousel Problem Types: CWE-918 Description: The B Carousel Block – Responsive Image and Content Carousel plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.1.5. This is due to the plugin not validating user-supplied URLs before passing them to the wp_remote_request() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requ
) function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb5ca73c-1a1d-4a93-bbcb-8af606189f26?source=cve - https://plugins.trac.wordpress.org/changeset/3387643/b-carousel-block - https://plugins.trac.wordpress.org/changeset/3388271/b-carousel-block
CVE ID: CVE-2025-12389 State: PUBLISHED Published: 2025-11-04T04:27:21.061Z Last Updated: 2025-11-04T15:20:23.287Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: sidngr Products: Import Export For WooCommerce Problem Types: CWE-862 Description: The Import Export For WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_setting() function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's record setting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
nd above, to update the plugin's record setting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a93e3f-54c6-4970-96fd-fab0e81f7034?source=cve - https://wordpress.org/plugins/import-export-for-woocommerce/
CVE ID: CVE-2025-12390 State: PUBLISHED Published: 2025-10-28T13:23:34.634Z Last Updated: 2025-11-19T14:44:22.746Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.4 Problem Types: CWE-384 Description: A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user. Additional Analyst No
browser cookies are missing. As a result, one user may receive tokens that belong to another user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:21370 - https://access.redhat.com/errata/RHSA-2025:21371 - https://access.redhat.com/security/cve/CVE-2025-12390 - https://bugzilla.redhat.com/show_bug.cgi?id=2406793
CVE ID: CVE-2025-12391 State: PUBLISHED Published: 2025-11-18T09:27:40.754Z Last Updated: 2025-11-18T21:11:57.169Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: seventhqueen Products: Restrictions for BuddyPress Problem Types: CWE-862 Description: The Restrictions for BuddyPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_optin_optout() function in all versions up to, and including, 1.5.2. This makes it possible for unauthenticated attackers to opt in and out of tracking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnera
racking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f4fe5ed7-17e2-4098-a51b-3b780721bf2e?source=cve - https://wordpress.org/plugins/bp-restrict/
CVE ID: CVE-2025-12392 State: PUBLISHED Published: 2025-11-18T09:27:39.093Z Last Updated: 2025-11-18T21:09:29.750Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: tripleatechnology Products: Cryptocurrency Payment Gateway for WooCommerce Problem Types: CWE-862 Description: The Cryptocurrency Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_optin_optout' function in all versions up to, and including, 2.0.22. This makes it possible for unauthenticated attackers to opt in and out of tracking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
thenticated attackers to opt in and out of tracking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/96d48392-fb64-4e5e-be9c-21df0bf75de6?source=cve - https://wordpress.org/plugins/triplea-cryptocurrency-payment-gateway-for-woocommerce/
CVE ID: CVE-2025-12393 State: PUBLISHED Published: 2025-11-04T04:27:14.125Z Last Updated: 2025-11-04T20:58:53.990Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: kris_iv Products: Free Quotation Problem Types: CWE-79 Description: The Free Quotation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-s
ct arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1c441ceb-0363-4117-afd6-afa253343cbe?source=cve - https://wordpress.org/plugins/free-quotation/
CVE ID: CVE-2025-12394 State: PUBLISHED Published: 2025-11-24T06:00:06.279Z Last Updated: 2025-11-24T10:54:28.331Z Vendors: Unknown Products: Backup Migration Problem Types: CWE-200 Information Exposure Description: The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unauthenticated users to fetch a log that discloses the backup filename. The backup archive is then downloadable without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e61293d0-2e1b-4dac-96c5-97fa17e38b16/
CVE ID: CVE-2025-12396 State: PUBLISHED Published: 2025-11-04T04:27:24.287Z Last Updated: 2025-11-04T14:41:45.820Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: alaminopu Products: clubmember Problem Types: CWE-79 Description: The clubmember plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site inst
rary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fed6bb3e-40f1-4d7a-b643-485f908cc816?source=cve - https://wordpress.com/plugins/clubmember
CVE ID: CVE-2025-12397 State: PUBLISHED Published: 2025-11-10T08:55:05.196Z Last Updated: 2025-11-10T15:17:03.069Z Vendors: Google Cloud Products: Looker Studio Problem Types: CWE-89 Description: A SQL injection vulnerability was found in Looker Studio. A Looker Studio user with report view access could inject malicious SQL that would execute with the report owner's permissions. The vulnerability affected to reports with BigQuery as the data source. This vulnerability was patched on 21 July 2025, and no customer action is needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/support/bulletins#gcp-2025-053 - https://www.tenable.com/security/research
hment: References: - https://cloud.google.com/support/bulletins#gcp-2025-053 - https://www.tenable.com/security/research/tra-2025-28
CVE ID: CVE-2025-12399 State: PUBLISHED Published: 2025-11-08T09:28:11.905Z Last Updated: 2025-11-10T14:13:30.917Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: alexreservations Products: Alex Reservations: Smart Restaurant Booking Problem Types: CWE-434 Description: The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-json/srr/v1/app/upload/file REST endpoint in all versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server whic
cated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f2d97646-27a8-4302-be70-7b4fb1a12300?source=cve - https://plugins.trac.wordpress.org/browser/alex-reservations/trunk/includes/application/Alexr/Http/Controllers/UploadFileController.php#L11 - https://github.com/d0n601/CVE-2025-12399 - https://ryankozak.com/posts/cve-2025-12399/ - https://plugins.trac.wordpress.org/changeset/3390614/
CVE ID: CVE-2025-12400 State: PUBLISHED Published: 2025-11-04T04:27:17.374Z Last Updated: 2025-11-04T16:47:13.869Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: lmbbox Products: LMB^Box Smileys Problem Types: CWE-352 Description: The LMB^Box Smileys plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2. This is due to missing or incorrect nonce validation on the manage_page() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link
ts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6e80e3ac-331a-480f-94ca-06d62230cd80?source=cve - https://plugins.trac.wordpress.org/browser/lmbbox-smileys/tags/3.2/lmbbox-smileys.php#L318 - https://plugins.trac.wordpress.org/browser/lmbbox-smileys/tags/3.2/lmbbox-smileys.php#L426 - https://plugins.trac.wordpress.org/browser/lmbbox-smileys/tags/3.2/lmbbox-smileys.php#L890
CVE ID: CVE-2025-12401 State: PUBLISHED Published: 2025-11-04T03:26:46.350Z Last Updated: 2025-11-04T18:48:46.590Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: theode Products: Label Plugins Problem Types: CWE-352 Description: The Label Plugins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on the label_plugins_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on
scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/843cc5e7-7820-409c-8de0-bd70245811cd?source=cve - https://plugins.trac.wordpress.org/browser/label-plugins/tags/0.5/lp_admin_page.php#L35 - https://plugins.trac.wordpress.org/browser/label-plugins/tags/0.5/lp_admin_page.php#L37 - https://plugins.trac.wordpress.org/browser/label-plugins/tags/0.5/lp_admin_page.php#L70
CVE ID: CVE-2025-12402 State: PUBLISHED Published: 2025-11-04T04:27:19.651Z Last Updated: 2025-11-04T15:52:16.797Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: bondnono Products: LinkedIn Resume Problem Types: CWE-352 Description: The LinkedIn Resume plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.00. This is due to missing or incorrect nonce validation on the linkedinresume_printAdminPage() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such