Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-8129 State: PUBLISHED Published: 2025-07-25T04:02:05.418Z Last Updated: 2025-07-25T12:01:53.033Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: KoaJS Products: Koa Problem Types: CWE-601 Description: A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317514 - https://vuldb.com/?ctiid.317514 - https://vuldb.com/?submit.619741 - https://github.com/koajs/koa/issues/1892 - https://github.com/koajs/koa/issues/1892#issue-3213028583
CVE ID: CVE-2025-8130 State: REJECTED Published: N/A Last Updated: 2025-08-06T18:36:04.669Z Description: No description available.
CVE ID: CVE-2025-8131 State: PUBLISHED Published: 2025-07-25T04:32:07.004Z Last Updated: 2025-07-25T11:55:59.091Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC20 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Tenda AC20 16.03.08.05. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
losed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317527 - https://vuldb.com/?ctiid.317527 - https://vuldb.com/?submit.619769 - https://github.com/Thir0th/Thir0th-CVE/blob/main/Tenda_AC20_V16.03.08.05_has_a_stack_overflow.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-8132 State: PUBLISHED Published: 2025-07-25T05:02:25.251Z Last Updated: 2025-07-25T11:51:29.743Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: yanyutao0402 Products: ChanCMS Problem Types: CWE-22 Description: A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been rated as critical. Affected by this issue is the function delfile of the file app/extend/utils.js. The manipulation leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. The name of the patch is c8a282bf02a62b59ec60b4699e91c51aff2ee9cd. It
ng to version 3.1.3 is able to address this issue. The name of the patch is c8a282bf02a62b59ec60b4699e91c51aff2ee9cd. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317528 - https://vuldb.com/?ctiid.317528 - https://vuldb.com/?submit.619776 - https://gitee.com/yanyutao0402/ChanCMS/issues/ICLOT8 - https://gitee.com/yanyutao0402/ChanCMS/issues/ICLOT8#note_43945209_link - https://gitee.com/yanyutao0402/ChanCMS/commit/c8a282bf02a62b59ec60b4699e91c51aff2ee9cd - https://gitee.com/yanyutao0402/ChanCMS/releases/tag/V3.1.3
CVE ID: CVE-2025-8133 State: PUBLISHED Published: 2025-07-25T05:32:20.216Z Last Updated: 2025-07-27T09:45:47.498Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: yanyutao0402 Products: ChanCMS Problem Types: CWE-918 Description: A vulnerability classified as critical has been found in yanyutao0402 ChanCMS up to 3.1.2. This affects the function getArticle of the file app/modules/api/service/gather.js. The manipulation of the argument targetUrl leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. The identifier of
een disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. The identifier of the patch is 3ef58a50e8b3c427b03c8cf3c9e19a79aa809be6. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317529 - https://vuldb.com/?ctiid.317529 - https://vuldb.com/?submit.619777 - https://gitee.com/yanyutao0402/ChanCMS/issues/ICLP1K - https://gitee.com/yanyutao0402/ChanCMS/commit/3ef58a50e8b3c427b03c8cf3c9e19a79aa809be6 - https://gitee.com/yanyutao0402/ChanCMS/releases/tag/V3.1.3
CVE ID: CVE-2025-8134 State: PUBLISHED Published: 2025-07-25T06:02:06.609Z Last Updated: 2025-07-25T11:48:01.254Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: BP Monitoring Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in PHPGurukul BP Monitoring Management System 1.0. This vulnerability affects unknown code of the file /bwdates-report-result.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317530 - https://vuldb.com/?ctiid.317530 - https://vuldb.com/?submit.619810 - https://vuldb.com/?submit.619813 - https://github.com/LagonGit/ReportCVE/issues/13 - https://github.com/LagonGit/ReportCVE/issues/14 - https://phpgurukul.com/
CVE ID: CVE-2025-8135 State: PUBLISHED Published: 2025-07-25T06:32:05.969Z Last Updated: 2025-07-25T11:46:48.280Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Insurance Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in itsourcecode Insurance Management System 1.0. This issue affects some unknown processing of the file /updateAgent.php. The manipulation of the argument agent_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
he exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317531 - https://vuldb.com/?ctiid.317531 - https://vuldb.com/?submit.619817 - https://github.com/viaiam/CVE/issues/5 - https://itsourcecode.com/
CVE ID: CVE-2025-8136 State: PUBLISHED Published: 2025-07-25T07:02:13.877Z Last Updated: 2025-08-04T18:32:37.499Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: A702R Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, was found in TOTOLINK A702R 4.0.0-B20230721.1521. Affected is an unknown function of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument ip6addr leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317532 - https://vuldb.com/?ctiid.317532 - https://vuldb.com/?submit.620482 - https://github.com/panda666-888/vuls/blob/main/totolink/a702r/formFilter.md - https://www.totolink.net/
CVE ID: CVE-2025-8137 State: PUBLISHED Published: 2025-07-25T07:32:08.962Z Last Updated: 2025-07-25T13:06:00.573Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: A702R Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in TOTOLINK A702R 4.0.0-B20230721.1521 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formIpQoS of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichm
d remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317533 - https://vuldb.com/?ctiid.317533 - https://vuldb.com/?submit.620483 - https://github.com/panda666-888/vuls/blob/main/totolink/a702r/formIpQoS.md - https://www.totolink.net/
CVE ID: CVE-2025-8138 State: PUBLISHED Published: 2025-07-25T08:02:07.866Z Last Updated: 2025-07-25T13:05:17.677Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: A702R Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formOneKeyAccessButton of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP
e launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317534 - https://vuldb.com/?ctiid.317534 - https://vuldb.com/?submit.620484 - https://github.com/panda666-888/vuls/blob/main/totolink/a702r/formOneKeyAccessButton.md - https://www.totolink.net/
CVE ID: CVE-2025-8139 State: PUBLISHED Published: 2025-07-25T08:32:09.407Z Last Updated: 2025-07-25T12:54:26.632Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: A702R Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been classified as critical. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
otely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317535 - https://vuldb.com/?ctiid.317535 - https://vuldb.com/?submit.620485 - https://github.com/panda666-888/vuls/blob/main/totolink/a702r/formPortFw.md - https://www.totolink.net/
CVE ID: CVE-2025-8140 State: PUBLISHED Published: 2025-07-25T09:02:08.707Z Last Updated: 2025-07-25T12:49:23.392Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: A702R Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/formWlanMultipleAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichm
d remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317536 - https://vuldb.com/?ctiid.317536 - https://vuldb.com/?submit.620486 - https://github.com/panda666-888/vuls/blob/main/totolink/a702r/formWlanMultipleAP.md - https://www.totolink.net/
CVE ID: CVE-2025-8141 State: PUBLISHED Published: 2025-08-20T01:44:36.793Z Last Updated: 2025-08-20T15:15:16.516Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: themeisle Products: Redirection for Contact Form 7 Problem Types: CWE-22 Description: The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_associated_files function in all versions up to, and including, 3.2.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
s on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fafd0159-25ab-430d-88ef-c4d09d23baa7?source=cve - https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.3/classes/class-wpcf7r-save-files.php#L80
CVE ID: CVE-2025-8142 State: PUBLISHED Published: 2025-08-16T11:11:23.436Z Last Updated: 2025-08-18T18:07:42.358Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: pencidesign Products: Soledad Problem Types: CWE-98 Description: The Soledad theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.6.7 via the 'header_layout' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code ex
on of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7dea9b4a-d7a5-4ea7-b55f-b42f8f5c4a91?source=cve - https://themeforest.net/item/soledad-multiconcept-blogmagazine-wp-theme/12945398#item-description__update-changelog
CVE ID: CVE-2025-8143 State: PUBLISHED Published: 2025-08-16T11:11:24.852Z Last Updated: 2025-08-18T18:00:19.839Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pencidesign Products: Soledad Problem Types: CWE-79 Description: The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pcsml_smartlists_h’ parameter in all versions up to, and including, 8.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes
ect arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e8852d39-e34a-45d3-aee8-1ccbfc0ab238?source=cve - https://themeforest.net/item/soledad-multiconcept-blogmagazine-wp-theme/12945398#item-description__update-changelog
CVE ID: CVE-2025-8145 State: PUBLISHED Published: 2025-08-20T01:44:35.663Z Last Updated: 2025-08-20T15:15:28.803Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: themeisle Products: Redirection for Contact Form 7 Problem Types: CWE-502 Description: The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the get_lead_fields function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in a Contact Form 7 plugin allows attackers to delete arbitrary files. Additionally, in certa
al presence of a POP chain in a Contact Form 7 plugin allows attackers to delete arbitrary files. Additionally, in certain server configurations, Remote Code Execution is possible Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2cb275d5-ec4b-419f-84e1-84172d381411?source=cve - https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.3/classes/class-wpcf7r-lead.php#L144
CVE ID: CVE-2025-8146 State: PUBLISHED Published: 2025-08-02T04:24:11.591Z Last Updated: 2025-08-04T15:18:26.498Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: qodeinteractive Products: Qi Addons For Elementor Problem Types: CWE-79 Description: The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TypeOut Text widget in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when
ated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4fdfdcbe-014b-4b68-9ac5-976d384106c3?source=cve - https://wordpress.org/plugins/qi-addons-for-elementor/#developers - https://plugins.trac.wordpress.org/changeset/3335762/
CVE ID: CVE-2025-8147 State: PUBLISHED Published: 2025-08-29T04:25:28.386Z Last Updated: 2025-08-29T12:03:54.361Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: aurelienlws Products: LWSCache Problem Types: CWE-285 Description: The LWSCache plugin for WordPress is vulnerable to unauthorized modification of data due to improper authorization on the lwscache_activatePlugin() function in all versions up to, and including, 2.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate arbitrary whitelisted LWS plugins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threa
hitelisted LWS plugins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/01a6a5bf-636b-416c-86fa-43f639624e80?source=cve - https://plugins.trac.wordpress.org/browser/lwscache/tags/2.8.5/lwscache.php#L401 - https://wordpress.org/plugins/lwscache/#developers - https://plugins.trac.wordpress.org/changeset/3352047/
CVE ID: CVE-2025-8149 State: PUBLISHED Published: 2025-09-06T03:22:37.670Z Last Updated: 2025-09-08T14:05:08.133Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: smub Products: aThemes Addons for Elementor Problem Types: CWE-79 Description: The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d0ca1d32-d094-46a2-838a-000e8b531767?source=cve - https://wordpress.org/plugins/athemes-addons-for-elementor-lite/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3350397%40athemes-addons-for-elementor-lite&old=3336319%40athemes-addons-for-elementor-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8150 State: PUBLISHED Published: 2025-08-29T08:25:54.349Z Last Updated: 2025-08-29T16:23:22.584Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nicheaddons Products: Events Addon for Elementor Problem Types: CWE-79 Description: The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter and Countdown widgets in all versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi
e for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c3122921-6bea-49e7-b1d7-77a291928497?source=cve - https://wordpress.org/plugins/events-addon-for-elementor/#developers - https://plugins.trac.wordpress.org/changeset/3351935/
CVE ID: CVE-2025-8151 State: PUBLISHED Published: 2025-07-31T11:19:12.200Z Last Updated: 2025-07-31T14:11:33.243Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: devitemsllc Products: HT Mega – Absolute Addons For Elementor Problem Types: CWE-22 Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'save_block_css' function. This makes it possible for authenticated attackers, with Author-level access and above, to create CSS files in any directory, and delete CSS files in any directory in a Windows environment. Additional Analyst Notes: - CISA ADP Vuln
any directory, and delete CSS files in any directory in a Windows environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6b3e93bf-af5c-4ca3-a531-2d91df880c51?source=cve - https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.9.1/htmega-blocks/includes/classes/Manage_Styles.php#L118 - https://plugins.trac.wordpress.org/changeset/3336533/
CVE ID: CVE-2025-8152 State: PUBLISHED Published: 2025-08-02T07:24:21.531Z Last Updated: 2025-08-04T15:18:03.713Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: blendmedia Products: WP CTA Problem Types: CWE-862 Description: The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_cta_status' and 'change_sticky_sidebar_name' functions in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to update the status of a sticky and update the name displayed in the back-end WP CTA Dashboard. Additi
icated attackers to update the status of a sticky and update the name displayed in the back-end WP CTA Dashboard. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/981ed50b-8f03-4320-99f0-3f53f7b2fc44?source=cve - https://plugins.trac.wordpress.org/browser/easy-sticky-sidebar/trunk/inc/ClassActions.php#L29 - https://plugins.trac.wordpress.org/browser/easy-sticky-sidebar/trunk/inc/ClassActions.php#L52 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3336867%40easy-sticky-sidebar&new=3336867%40easy-sticky-sidebar&sfp_email=&sfph_mail=