Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-4579 State: PUBLISHED Published: 2025-05-15T01:59:23.874Z Last Updated: 2025-05-15T14:40:33.536Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: dyland Products: WP Content Security Plugin Problem Types: CWE-79 Description: The WP Content Security Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blocked-uri and effective-directive parameters in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst
to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f3c4ba08-a9fa-439a-a887-b8c113f78e20?source=cve - https://plugins.trac.wordpress.org/browser/wp-content-security-policy/tags/2.3/includes/WP_CSP.php#L597 - https://plugins.trac.wordpress.org/browser/wp-content-security-policy/tags/2.3/includes/WP_CSP.php#L612 - https://plugins.trac.wordpress.org/browser/wp-content-security-policy/tags/2.3/includes/WP_CSP.php#L659
CVE ID: CVE-2025-4580 State: PUBLISHED Published: 2025-06-04T06:00:07.148Z Last Updated: 2025-06-04T13:20:14.868Z Vendors: Unknown Products: File Provider Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8741353a-2a7f-4dee-b62d-7f5fe435f1a1/
CVE ID: CVE-2025-4581 State: PUBLISHED Published: 2025-08-09T04:14:22.942Z Last Updated: 2025-08-11T18:52:32.347Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-918 Description: Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading t
er can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4581
CVE ID: CVE-2025-4582 State: PUBLISHED Published: 2025-09-23T17:51:38.223Z Last Updated: 2025-09-23T18:37:03.251Z Vendors: RTI Products: Connext Professional Problem Types: CWE-126, CWE-193 Description: Buffer Over-read, Off-by-one Error vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation.This issue affects Connext Professional: from 7.4.0 before 7.6.0, from 7.0.0 before 7.3.0.8, from 6.1.0 before 6.1.2.26, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 4.4a before 5.2.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2025-4582
CVE ID: CVE-2025-4583 State: PUBLISHED Published: 2025-05-29T04:23:08.202Z Last Updated: 2025-05-29T13:17:48.514Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: smub Products: Smash Balloon Social Photo Feed – Easy Social Feeds Plugin Problem Types: CWE-79 Description: The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-plugin` attribute in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pa
it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/23e47daa-79e7-4ed3-a88a-0f090e9aa277?source=cve - https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.9.0/js/sb-instagram-admin-6.js#L428
CVE ID: CVE-2025-4584 State: PUBLISHED Published: 2025-06-13T01:47:46.977Z Last Updated: 2025-06-13T15:40:34.296Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: irmau Products: IRM Newsroom Problem Types: CWE-79 Description: The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmeventlist' shortcode in all versions up to, and including, 1.2.17 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an in
ibutor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3895df7a-9f24-45a5-b447-16f214cfbfcc?source=cve - https://plugins.trac.wordpress.org/browser/irm-newsroom/trunk/irm-newsroom.php#L494
CVE ID: CVE-2025-4585 State: PUBLISHED Published: 2025-06-13T01:47:45.853Z Last Updated: 2025-06-13T15:44:42.133Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: irmau Products: IRM Newsroom Problem Types: CWE-79 Description: The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmflat' shortcode in all versions up to, and including, 1.2.17 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injecte
r-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0da6d357-e55f-4bf6-9cd7-50e3dc712434?source=cve - https://plugins.trac.wordpress.org/browser/irm-newsroom/trunk/irm-newsroom.php#L439
CVE ID: CVE-2025-4586 State: PUBLISHED Published: 2025-06-13T01:47:49.727Z Last Updated: 2025-06-13T14:02:17.036Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: irmau Products: IRM Newsroom Problem Types: CWE-79 Description: The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmcalendarview' shortcode in all versions up to, and including, 1.2.17 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
ntributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c6210c35-31d7-4a8d-b34f-596977c7a33e?source=cve - https://plugins.trac.wordpress.org/browser/irm-newsroom/trunk/irm-newsroom.php#L467
CVE ID: CVE-2025-4587 State: PUBLISHED Published: 2025-06-27T07:22:21.998Z Last Updated: 2025-06-27T13:51:36.200Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: johnjamesjacoby Products: A/B Testing for WordPress Problem Types: CWE-79 Description: The A/B Testing for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ab-testing-for-wp/ab-test-block' block in all versions up to, and including, 1.18.2 due to insufficient input sanitization and output escaping on the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages tha
sible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3dcf401a-3b91-4b55-b6b1-a132ec195607?source=cve - https://wordpress.org/plugins/ab-testing-for-wp/
CVE ID: CVE-2025-4588 State: PUBLISHED Published: 2025-08-02T07:24:22.417Z Last Updated: 2025-08-04T15:16:56.142Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mrgoodfellow Products: 360 Photo Spheres Problem Types: CWE-79 Description: The 360 Photo Spheres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sphere' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user access
th contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a654ee62-8742-49bc-95fd-bfab14750b50?source=cve - https://wordpress.org/plugins/360-sphere-images/
CVE ID: CVE-2025-4589 State: PUBLISHED Published: 2025-05-15T03:21:38.214Z Last Updated: 2025-05-15T14:25:58.600Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nackle2k10 Products: Bon Toolkit Problem Types: CWE-79 Description: The Bon Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt-map' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inject
or-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4cafec05-c275-475d-91cf-ed65cd191b0e?source=cve - https://plugins.trac.wordpress.org/browser/bon-toolkit/trunk/includes/shortcodes.php#L71
CVE ID: CVE-2025-4590 State: PUBLISHED Published: 2025-05-31T06:40:55.434Z Last Updated: 2025-06-02T15:49:47.207Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: daisycon Products: Daisycon prijsvergelijkers Problem Types: CWE-79 Description: The Daisycon prijsvergelijkers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'daisycon_uitvaart' shortcode in all versions up to, and including, 4.8.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exe
authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/74551e01-063c-4493-8472-9c0903ac17c5?source=cve - https://wordpress.org/plugins/daisycon/
CVE ID: CVE-2025-4591 State: PUBLISHED Published: 2025-05-15T03:21:39.647Z Last Updated: 2025-05-15T15:20:59.940Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: welukame Products: Weluka Lite Problem Types: CWE-79 Description: The Weluka Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'weluka-map' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inje
utor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d21a12b4-2f9d-4ae3-a5f6-1ba90fab43a2?source=cve - https://plugins.trac.wordpress.org/browser/weluka-lite/trunk/class-weluka-builder.php#L4666
CVE ID: CVE-2025-4592 State: PUBLISHED Published: 2025-06-14T08:23:25.234Z Last Updated: 2025-06-17T18:39:10.244Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: aspengrovestudios Products: AI Image Lab – Free AI Image Generator Problem Types: CWE-352 Description: The AI Image Lab – Free AI Image Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the 'wpz-ai-images' page. This makes it possible for unauthenticated attackers to update the plugin's API key via a forged request granted they can trick a site administrator into performing a
ackers to update the plugin's API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/61d56713-59af-4ad9-8744-6c6a5e5fe213?source=cve - https://plugins.trac.wordpress.org/browser/ai-image-generator-lab/trunk/includes/admin/admin-page.php#L3
CVE ID: CVE-2025-4593 State: PUBLISHED Published: 2025-07-11T07:22:59.127Z Last Updated: 2025-07-11T16:54:36.358Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: avimegladon Products: WP Register Profile With Shortcode Problem Types: CWE-200 Description: The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'rp_user_data' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data from user meta like hashed passwords, usernames, and more. Additional Analyst Notes: - CISA ADP Vulnrichme
ensitive data from user meta like hashed passwords, usernames, and more. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2ae7f5e3-7312-4fee-962b-3aecd8432557?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3324309%40wp-register-profile-with-shortcode&new=3324309%40wp-register-profile-with-shortcode&sfp_email=&sfph_mail=
CVE ID: CVE-2025-4594 State: PUBLISHED Published: 2025-05-23T03:39:40.713Z Last Updated: 2025-05-23T12:38:03.862Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tournamatch Products: Tournamatch Problem Types: CWE-79 Description: The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registration-button' shortcode in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fc912831-bbdd-4f8f-a620-47e41b1b731d?source=cve - https://plugins.trac.wordpress.org/browser/tournamatch/tags/4.6.1/includes/shortcodes/class-shortcodes.php#L273 - https://plugins.trac.wordpress.org/changeset/3295681/tournamatch/trunk/includes/shortcodes/class-shortcodes.php
CVE ID: CVE-2025-4595 State: PUBLISHED Published: 2025-05-31T06:40:58.535Z Last Updated: 2025-06-02T15:49:09.268Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jtewes Products: FastSpring Problem Types: CWE-79 Description: The FastSpring plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fastspring/block-fastspringblocks-complete-product-catalog' block in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on the 'color' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exe
authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e96d118a-e38c-4043-9550-5f5ab0d83dc7?source=cve - https://wordpress.org/plugins/fastspring/
CVE ID: CVE-2025-4597 State: PUBLISHED Published: 2025-05-30T11:15:08.735Z Last Updated: 2025-05-30T12:29:18.294Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: bc2018 Products: Woo Slider Pro – Drag Drop Slider Builder For WooCommerce Problem Types: CWE-862 Description: The Woo Slider Pro – Drag Drop Slider Builder For WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woo_slide_pro_delete_draft_preview AJAX action in all versions up to, and including, 1.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts. Addition
kes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1eaee0f6-968c-4004-83e7-f79baf3ff88d?source=cve - https://plugins.trac.wordpress.org/browser/woo-slider-pro-drag-drop-slider-builder-for-woocommerce/trunk/inc/actions.php#L111
CVE ID: CVE-2025-4598 State: PUBLISHED Published: 2025-05-30T13:13:26.049Z Last Updated: 2025-11-14T10:04:33.779Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-364 Description: A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original
eged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file.
/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2025-4598 - https://bugzilla.redhat.com/show_bug.cgi?id=2369242 - https://www.openwall.com/lists/oss-security/2025/05/29/3
CVE ID: CVE-2025-4599 State: PUBLISHED Published: 2025-08-04T21:18:14.251Z Last Updated: 2025-08-05T15:43:07.612Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 update 61 through update 92 was found to be vulnerable to postMessage-based XSS because it allows a remote non-authenticated attacker to inject JavaScript into the fragment portlet URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/kn
ent portlet URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4599
CVE ID: CVE-2025-4600 State: PUBLISHED Published: 2025-05-16T13:47:45.266Z Last Updated: 2025-09-08T09:48:16.572Z Vendors: Google Cloud Products: Classic Application Load Balancer Problem Types: CWE-444 Description: A request smuggling vulnerability existed in the Google Cloud Classic Application Load Balancer due to improper handling of chunked-encoded HTTP requests. This allowed attackers to craft requests that could be misinterpreted by backend servers. The issue was fixed by disallowing stray data after a chunk, and is no longer exploitable. No action is required as Classic Application Load Balancer service after 2025-04-26 is not vulnerable. Additional Analyst Notes: - CISA ADP Vulnrich
ssic Application Load Balancer service after 2025-04-26 is not vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/support/bulletins#gcp-2025-027
CVE ID: CVE-2025-4601 State: PUBLISHED Published: 2025-06-10T03:41:38.102Z Last Updated: 2025-06-10T14:10:12.864Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: InspiryThemes Products: RH - Real Estate WordPress Theme Problem Types: CWE-269 Description: The "RH - Real Estate WordPress Theme" theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.0. This is due to the theme not properly restricting user roles that can be updated as part of the inspiry_update_profile() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to set their role to that of an administrator. T
le for authenticated attackers, with subscriber-level access and above, to set their role to that of an administrator. The vulnerability was partially patched in version 4.4.0, and fully patched in version 4.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a816e5a8-2494-4bcf-869d-5214b21f7791?source=cve - https://themeforest.net/item/real-homes-wordpress-real-estate-theme/5373914