Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-2088 State: PUBLISHED Published: 2025-03-07T14:31:05.524Z Last Updated: 2025-03-07T14:56:35.848Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Pre-School Enrollment System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Pre-School Enrollment System up to 1.0. Affected is an unknown function of the file /admin/profile.php. The manipulation of the argument fullname/emailid/mobileNumber leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298902 - https://vuldb.com/?ctiid.298902 - https://vuldb.com/?submit.514974 - https://github.com/SECWG/cve/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-2089 State: PUBLISHED Published: 2025-03-07T15:00:13.289Z Last Updated: 2025-03-07T19:33:59.626Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: StarSea99 Products: starsea-mall Problem Types: CWE-284, CWE-266 Description: A vulnerability has been found in StarSea99 starsea-mall 1.0/2.X and classified as critical. Affected by this vulnerability is the function updateUserInfo of the file /personal/updateInfo of the component com.siro.mall.controller.mall.UserController. The manipulation of the argument userId leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Not
he attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298903 - https://vuldb.com/?ctiid.298903 - https://vuldb.com/?submit.514977 - https://wiki.shikangsi.com/post/share/baecf028-1116-4600-ae9c-f655cc93c29b
CVE ID: CVE-2025-2090 State: PUBLISHED Published: 2025-03-07T15:00:16.296Z Last Updated: 2025-03-07T19:33:17.643Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: PHPGurukul Products: Pre-School Enrollment System Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/add-subadmin.php of the component Sub Admin Handler. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298904 - https://vuldb.com/?ctiid.298904 - https://vuldb.com/?submit.515017 - https://github.com/SECWG/cve/issues/3 - https://phpgurukul.com/
CVE ID: CVE-2025-2091 State: PUBLISHED Published: 2025-06-16T08:27:13.170Z Last Updated: 2025-06-16T16:33:03.809Z Vendors: M-Files Corporation Products: M-Files Mobile Problem Types: CWE-601 Description: An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF files to trick other users into making requests to untrusted URLs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2025-2091
CVE ID: CVE-2025-2092 State: PUBLISHED Published: 2025-04-22T11:38:04.092Z Last Updated: 2025-04-22T13:08:31.297Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p29, <2.2.0p41 and <=2.1.0p49 (EOL) causes remote site authentication secrets to be written to log files accessible to administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17780
CVE ID: CVE-2025-2093 State: PUBLISHED Published: 2025-03-07T21:31:05.610Z Last Updated: 2025-03-07T22:26:57.808Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: PHPGurukul Products: Online Library Management System Problem Types: CWE-640 Description: A vulnerability was found in PHPGurukul Online Library Management System 3.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /change-password.php. The manipulation of the argument email/phone number leads to weak password recovery. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. T
attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298951 - https://vuldb.com/?ctiid.298951 - https://vuldb.com/?submit.515207 - https://github.com/SECWG/cve/issues/4 - https://phpgurukul.com/
CVE ID: CVE-2025-2094 State: PUBLISHED Published: 2025-03-07T21:31:09.611Z Last Updated: 2025-03-07T22:27:35.683Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: EX1800T Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. It has been rated as critical. Affected by this issue is the function setWiFiExtenderConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument apcliKey/key leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
losed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298952 - https://vuldb.com/?ctiid.298952 - https://vuldb.com/?submit.515319 - https://github.com/kn0sky/cve/blob/main/TOTOLINK%20EX1800T/OS%20Command%20Injection%2001%20setWiFiExtenderConfig-_apcliKey.md - https://www.totolink.net/
CVE ID: CVE-2025-2095 State: PUBLISHED Published: 2025-03-07T22:00:12.940Z Last Updated: 2025-03-07T22:28:13.640Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: EX1800T Problem Types: CWE-78, CWE-77 Description: A vulnerability classified as critical has been found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298953 - https://vuldb.
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298953 - https://vuldb.com/?ctiid.298953 - https://vuldb.com/?submit.515321 - https://github.com/kn0sky/cve/blob/main/TOTOLINK%20EX1800T/OS%20Command%20Injection%2003%20setDmzCfg-_ip.md - https://www.totolink.net/
CVE ID: CVE-2025-2096 State: PUBLISHED Published: 2025-03-07T22:00:16.475Z Last Updated: 2025-03-07T22:28:45.665Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: EX1800T Problem Types: CWE-78, CWE-77 Description: A vulnerability classified as critical was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This vulnerability affects the function setRebootScheCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument mode/week/minute/recHour leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298954 - https://vuldb.com/?ctiid.298954 - https://vuldb.com/?submit.515322 - https://github.com/kn0sky/cve/blob/main/TOTOLINK%20EX1800T/OS%20Command%20Injection%2004%20setRebootScheCfg-_mode.md - https://www.totolink.net/
CVE ID: CVE-2025-2097 State: PUBLISHED Published: 2025-03-07T22:31:06.074Z Last Updated: 2025-03-10T17:20:32.188Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: EX1800T Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as critical, has been found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This issue affects the function setRptWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument loginpass leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298955 - https://vuldb.com/?ctiid.298955 - https://vuldb.com/?submit.515326 - https://github.com/kn0sky/cve/blob/main/TOTOLINK%20EX1800T/Stack-based%20Buffer%20Overflow%2001%20setRptWizardCfg-_loginpass.md - https://www.totolink.net/
CVE ID: CVE-2025-2098 State: PUBLISHED Published: 2025-03-26T15:23:42.768Z Last Updated: 2025-10-03T09:05:54.941Z Vendors: Beijing Honghu Yuntu Technology Products: Fast CAD Reader Problem Types: CWE-732 Description: Fast CAD Reader application on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects Fast CAD Reader in possibly all versions since the vendor has not responded to our message
scalation. This issue affects Fast CAD Reader in possibly all versions since the vendor has not responded to our messages. The tested version was 4.1.5 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/03/CVE-2025-2098/ - https://apps.apple.com/pl/app/fast-cad-reader/id1484905765
CVE ID: CVE-2025-2099 State: PUBLISHED Published: 2025-05-19T11:22:36.908Z Last Updated: 2025-05-19T13:45:13.385Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: huggingface Products: huggingface/transformers Problem Types: CWE-1333 Description: A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can ex
leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and potential application downtime, effectively resulting in a Denial of Service (DoS) scenario. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/97b780f3-ffca-424f-ad5d-0e1c57a5bde4 - https://github.com/huggingface/transformers/commit/8cb522b4190bd556ce51be04942720650b1a3e57
CVE ID: CVE-2025-2101 State: PUBLISHED Published: 2025-04-26T08:23:20.508Z Last Updated: 2025-04-28T15:34:23.704Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ThemeMove Products: EduMall - Professional LMS Education Center WordPress Theme Problem Types: CWE-98 Description: The Edumall theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.4 via the 'template' parameter of the 'edumall_lazy_load_template' AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access
itrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7a4a0c26-6b7b-4dcf-a266-a6548431e6a8?source=cve - https://changelog.thememove.com/edumall/
CVE ID: CVE-2025-2102 State: PUBLISHED Published: 2025-05-21T17:19:02.060Z Last Updated: 2025-05-21T19:25:44.863Z Vendors: HYPR Products: Passwordless Problem Types: CWE-59 Description: Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.This issue affects HYPR Passwordless: before 10.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hypr.com/trust-center/security-advisories
CVE ID: CVE-2025-2103 State: PUBLISHED Published: 2025-03-14T05:24:04.037Z Last Updated: 2025-03-14T15:08:53.302Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IronTemplates Products: SoundRise Music Problem Types: CWE-862 Description: The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on theironMusic_ajax() function in all versions up to, and including, 1.6.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default r
level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c0f9d8-c5cf-4e31-bc0b-289ad7c1d197?source=cve - https://themeforest.net/item/soundrise-artists-producers-and-record-labels-wordpress-theme/19764337
CVE ID: CVE-2025-2104 State: PUBLISHED Published: 2025-03-13T04:21:04.607Z Last Updated: 2025-03-17T21:29:08.562Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: softaculous Products: Page Builder: Pagelayer – Drag and Drop website builder Problem Types: CWE-862 Description: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publication due to insufficient validation on the pagelayer_save_content() function in all versions up to, and including, 1.9.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to bypass post moderation and publish posts to the s
r authenticated attackers, with Contributor-level access and above, to bypass post moderation and publish posts to the site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2e3897fb-0f40-4111-8a7d-60415e1f9f96?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3253356%40pagelayer&new=3253356%40pagelayer&sfp_email=&sfph_mail=
CVE ID: CVE-2025-2105 State: PUBLISHED Published: 2025-04-26T05:34:22.050Z Last Updated: 2025-04-28T21:56:02.444Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: artbees Products: Jupiter X Core Problem Types: CWE-502 Description: The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'raven_download_file' function. This makes it possible for attackers to inject a PHP Object through a PHAR file. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or t
POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with the file download action, and the ability to upload files is also present. Otherwise, this would be considered exploitable by Contributor-level users and above, because they coul
is also present. Otherwise, this would be considered exploitable by Contributor-level users and above, because they could create the form needed to successfully exploit this. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3427387e-30d2-40a5-9bfd-d458039d8e2e?source=cve - https://wordpress.org/plugins/jupiterx-core/ - https://plugins.trac.wordpress.org/changeset/3279676/jupiterx-core/trunk/includes/extensions/raven/includes/utils.php
CVE ID: CVE-2025-2106 State: PUBLISHED Published: 2025-03-13T01:45:26.824Z Last Updated: 2025-03-14T13:55:51.518Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: arielbrailovsky Products: ArielBrailovsky-ViralAd Problem Types: CWE-89 Description: The ArielBrailovsky-ViralAd plugin for WordPress is vulnerable to SQL Injection via the 'text' and 'id' parameters of the limpia() function in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries
ery. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This only appears to be exploitable on very old versions of WordPress. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/60cd2178-858e-4e24-8967-13b04f675d2d?source=cve - https://wordpress.org/plugins/arielbrailovsky-viralad/ - https://plugins.trac.wordpress.org/browser/arielbrailovsky-viralad/trunk/inc/anuncio.php#L174
CVE ID: CVE-2025-2107 State: PUBLISHED Published: 2025-03-13T01:45:28.382Z Last Updated: 2025-03-14T13:53:48.361Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: arielbrailovsky Products: ArielBrailovsky-ViralAd Problem Types: CWE-89 Description: The ArielBrailovsky-ViralAd plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the printResultAndDie() function in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries
ry. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This only appears to be exploitable on very old versions of WordPress. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c6c846c8-df8a-4a95-834e-a9443b6a86b5?source=cve - https://wordpress.org/plugins/arielbrailovsky-viralad/ - https://plugins.trac.wordpress.org/browser/arielbrailovsky-viralad/trunk/inc/anuncio.php#L105
CVE ID: CVE-2025-2108 State: PUBLISHED Published: 2025-03-20T06:54:57.470Z Last Updated: 2025-03-20T15:02:48.150Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: xpro Products: 140+ Widgets | Xpro Addons For Elementor – FREE Problem Types: CWE-79 Description: The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Site Title’ widget's 'title_tag' and 'html_tag' parameters in all versions up to, and including, 1.4.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary w
ping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/009b9b0d-6cbd-402e-bc81-24661ff16b9d?source=cve - https://plugins.trac.wordpress.org/browser/xpro-elementor-addons/trunk/widgets/site-title/layout/frontend.php#L29 - https://plugins.trac.wordpress.org/changeset/3255986/
CVE ID: CVE-2025-2109 State: PUBLISHED Published: 2025-03-25T11:12:08.647Z Last Updated: 2025-03-31T16:18:03.130Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: smartersite Products: WP Compress – Instant Performance & Speed Optimization Problem Types: CWE-918 Description: The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.
o arbitrary locations originating from the web application and can be used to query information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/10b9d703-de9d-472a-bdfb-bc9a41bf375e?source=cve - https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/6.30.15/wp-compress-core.php#L994 - https://wordpress.org/plugins/wp-compress-image-optimizer/#developers - https://plugins.trac.wordpress.org/changeset/3254259/
CVE ID: CVE-2025-2110 State: PUBLISHED Published: 2025-03-26T11:22:08.756Z Last Updated: 2025-03-26T13:39:51.095Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: smartersite Products: WP Compress – Instant Performance & Speed Optimization Problem Types: CWE-862 Description: The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depe
ossible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depending on the specific function exploited - for example, by retrieving sensitive settings and configuration details, or by altering and deleting them, thereby disclosing sensitive information, disrupting the plugin’s functionality, and potentially impacting overall site performance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2bb4ead4-b2ad-42b4-92a0-fb7293f6df06?source=cve - https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/6.30.15/classes/ajax.class.php - https://wordpre
s://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/6.30.15/classes/ajax.class.php - https://wordpress.org/plugins/wp-compress-image-optimizer/#developers - https://plugins.trac.wordpress.org/changeset/3254259/