Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
iles outside of the originally intended directory. The impact of this vulnerability is limited, as file types are validated and only safe ones can be uploaded, while deletion is limited to the plugin's uploads folder. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/17f7be7f-f675-4c9f-a7b3-525a3c3c5775?source=cve - https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.0/inc/dnd-upload-cf7.php#L1018 - https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.0/inc/dnd-upload-cf7.php#L1050 - https://plugins.trac.wordpress.org/
drop-multiple-file-upload-contact-form-7/tags/1.3.9.0/inc/dnd-upload-cf7.php#L1050 - https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.0/inc/dnd-upload-cf7.php#L77 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3344512%40drag-and-drop-multiple-file-upload-contact-form-7&new=3344512%40drag-and-drop-multiple-file-upload-contact-form-7&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8466 State: PUBLISHED Published: 2025-08-02T08:32:05.345Z Last Updated: 2025-08-04T13:38:30.836Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Farm System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Farm System 1.0. It has been classified as critical. Affected is an unknown function of the file /forgot_passfarmer.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318516 - https://vuldb.com/?ctiid.318516 - https://vuldb.com/?submit.625785 - https://github.com/wllovemy/cve/issues/11 - https://code-projects.org/
CVE ID: CVE-2025-8467 State: PUBLISHED Published: 2025-08-02T11:02:05.501Z Last Updated: 2025-08-04T13:23:49.492Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Wazifa System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Wazifa System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /controllers/regcontrol.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
loit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318517 - https://vuldb.com/?ctiid.318517 - https://vuldb.com/?submit.625786 - https://github.com/wllovemy/cve/issues/12 - https://code-projects.org/
CVE ID: CVE-2025-8468 State: PUBLISHED Published: 2025-08-02T14:32:05.375Z Last Updated: 2025-08-04T15:15:28.763Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Wazifa System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Wazifa System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /controllers/reset.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318518 - https://vuldb.com/?ctiid.318518 - https://vuldb.com/?submit.625787 - https://github.com/wllovemy/cve/issues/13 - https://code-projects.org/
CVE ID: CVE-2025-8469 State: PUBLISHED Published: 2025-08-02T17:02:06.047Z Last Updated: 2025-08-04T15:14:52.507Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in SourceCodester Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/deletegallery.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318519 - https://vuldb.com/?ctiid.318519 - https://vuldb.com/?submit.626017 - https://github.com/K1nakoo/tmp01/blob/main/tmp01.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-8470 State: PUBLISHED Published: 2025-08-02T17:32:06.652Z Last Updated: 2025-08-04T13:53:54.454Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in SourceCodester Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /admin/deleteroom.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
t has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318520 - https://vuldb.com/?ctiid.318520 - https://vuldb.com/?submit.626018 - https://github.com/K1nakoo/tmp02/blob/main/tmp02.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-8471 State: PUBLISHED Published: 2025-08-02T18:32:06.080Z Last Updated: 2025-08-04T13:41:01.893Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Online Admission System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in projectworlds Online Admission System 1.0. This issue affects some unknown processing of the file /adminlogin.php. The manipulation of the argument a_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318521 - https://vuldb.com/?ctiid.318521 - https://vuldb.com/?submit.626115 - https://github.com/tqlfront/CVE/issues/1
CVE ID: CVE-2025-8472 State: PUBLISHED Published: 2025-08-01T17:38:26.172Z Last Updated: 2025-08-01T19:17:23.518Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Alpine Products: iLX-507 Problem Types: CWE-121 Description: Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the parsing of vCard data. The issue results from the lack of p
icious Bluetooth device. The specific flaw exists within the parsing of vCard data. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-26316. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-761/
CVE ID: CVE-2025-8473 State: PUBLISHED Published: 2025-08-01T17:38:30.138Z Last Updated: 2025-08-01T19:14:15.168Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Alpine Products: iLX-507 Problem Types: CWE-78 Description: Alpine iLX-507 UPDM_wstpCBCUpdStart Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPDM_wstpCBCUpdStart function. The issue results from the lack of proper validation of user-supplied data before using it to execute a system c
nction. The issue results from the lack of proper validation of user-supplied data before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26317. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-762/
CVE ID: CVE-2025-8474 State: PUBLISHED Published: 2025-08-01T17:38:34.112Z Last Updated: 2025-08-01T19:04:16.692Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Alpine Products: iLX-507 Problem Types: CWE-121 Description: Alpine iLX-507 CarPlay Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the Apple CarPlay protocol. The issue results from the lack of proper validation of the length of user-supplied
tion of the Apple CarPlay protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26318. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-763/
CVE ID: CVE-2025-8475 State: PUBLISHED Published: 2025-08-01T17:38:37.709Z Last Updated: 2025-08-01T18:54:17.404Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Alpine Products: iLX-507 Problem Types: CWE-121 Description: Alpine iLX-507 AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the implementation of the AVRCP protocol. The issue results from the la
luetooth device. The specific flaw exists within the implementation of the AVRCP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26321. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-764/
CVE ID: CVE-2025-8476 State: PUBLISHED Published: 2025-08-01T17:38:41.443Z Last Updated: 2025-08-01T18:53:13.566Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Alpine Products: iLX-507 Problem Types: CWE-295 Description: Alpine iLX-507 TIDAL Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TIDAL music streaming application. The issue results from improper certificate validation. An attacker can leverage this in conjunction with other
cation. The issue results from improper certificate validation. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-26322. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-765/
CVE ID: CVE-2025-8477 State: PUBLISHED Published: 2025-08-01T17:38:48.758Z Last Updated: 2025-08-01T18:12:28.740Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Alpine Products: iLX-507 Problem Types: CWE-121 Description: Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-507 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the parsing of vCard data. The issue results from the lack of proper validation
device. The specific flaw exists within the parsing of vCard data. The issue results from the lack of proper validation of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26324. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-767/
CVE ID: CVE-2025-8479 State: PUBLISHED Published: 2025-09-11T06:43:51.174Z Last Updated: 2025-09-11T14:41:53.922Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: zohoflow Products: Zoho Flow – Integrate 100+ plugins with 1000+ business apps, no-code workflow automation Problem Types: CWE-352 Description: The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1. This is due to missing or incorrect nonce validation on the zoho_flow_deactivate_plugin function. This makes it possible for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site adminis
e for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/328fc7a9-be41-4e30-bb8d-c12ac3fd63f5?source=cve - https://plugins.trac.wordpress.org/browser/zoho-flow/tags/2.14.1/settings.php#L151 - https://plugins.trac.wordpress.org/browser/zoho-flow/tags/2.14.1/settings.php#L144 - https://plugins.trac.wordpress.org/browser/zoho-flow/tags/2.14.2/settings.php#L144
CVE ID: CVE-2025-8480 State: PUBLISHED Published: 2025-08-01T17:38:45.894Z Last Updated: 2025-08-07T16:06:00.334Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Alpine Products: iLX-507 Problem Types: CWE-22 Description: Alpine iLX-507 Command Injection Remote Code Execution. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Tidal music streaming application. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An att
ue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26357. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-766/
CVE ID: CVE-2025-8481 State: PUBLISHED Published: 2025-09-11T07:24:57.926Z Last Updated: 2025-09-11T14:38:26.145Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: mdimran41 Products: Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid Problem Types: CWE-352 Description: The Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.1.7. This is due to missing or incorrect nonce validation on the bdfe_install_activate_rswpbs_only function. This makes it possible for unauthenticated attackers to install the 'rs-wp-books-showcase' plugin via a forged request gr
his makes it possible for unauthenticated attackers to install the 'rs-wp-books-showcase' plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b8f31f8e-03a0-436c-bfa3-bc41d70e8e2a?source=cve - https://plugins.trac.wordpress.org/browser/blog-designer-for-elementor/tags/1.1.7/inc/import-books-from-amazon-notice/import-books-from-amazon-notice.php#L109
CVE ID: CVE-2025-8482 State: PUBLISHED Published: 2025-08-12T06:42:41.969Z Last Updated: 2025-08-12T16:04:34.828Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: 10up Products: Simple Local Avatars Problem Types: CWE-862 Description: The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of data in version 2.8.4. This is due to a missing capability check on the migrate_from_wp_user_avatar() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to migrate avatar metadata for all users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/thr
r metadata for all users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/69d78334-2b38-43ee-acf6-c073d5826213?source=cve - https://plugins.trac.wordpress.org/browser/simple-local-avatars/tags/2.8.4/includes/class-simple-local-avatars.php?marks=1663-1672#L1663 - https://plugins.trac.wordpress.org/browser/simple-local-avatars/tags/2.8.4/includes/class-simple-local-avatars.php#L123 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3340223%40simple-local-avatars&new=3340223%40simple-local-avatars&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8483 State: PUBLISHED Published: 2025-10-25T06:49:23.683Z Last Updated: 2025-10-27T15:40:24.854Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: marketingfire Products: Discussion Board – WordPress Forum Plugin Problem Types: CWE-94 Description: The The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.5.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbi
o_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a09659bc-e42b-4f08-a1a1-23e226be1be9?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3382300%40wp-discussion-board&new=3382300%40wp-discussion-board&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8484 State: PUBLISHED Published: 2025-10-11T09:28:40.032Z Last Updated: 2025-10-14T18:45:21.486Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: nickclarkweb Products: Code Quality Control Tool Problem Types: CWE-200 Description: The Code Quality Control Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in version 0.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b64635f4-abc0-4
Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b64635f4-abc0-4e69-89e4-357840c5e776?source=cve - https://plugins.trac.wordpress.org/browser/code-quality-control-tool/trunk/error_logger.php#L71
CVE ID: CVE-2025-8485 State: PUBLISHED Published: 2025-11-12T19:18:28.696Z Last Updated: 2025-11-12T21:03:39.691Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: App Store Problem Types: CWE-276 Description: An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges during installation of an application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/434329
CVE ID: CVE-2025-8486 State: PUBLISHED Published: 2025-10-15T14:25:36.182Z Last Updated: 2025-10-16T19:56:04.432Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: PC Manager Problem Types: CWE-250 Description: A potential vulnerability was reported in PC Manager that could allow a local authenticated user to execute code with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/432378
CVE ID: CVE-2025-8487 State: PUBLISHED Published: 2025-09-19T03:34:47.887Z Last Updated: 2025-09-19T13:09:13.468Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: extendthemes Products: Kubio AI Page Builder Problem Types: CWE-862 Description: The Kubio AI Page Builder plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the kubio-image-hub-install-plugin AJAX action in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the Image Hub plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
ess and above, to install the Image Hub plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1f528c89-2b8c-4750-b9eb-47ebd8c1630e?source=cve - https://plugins.trac.wordpress.org/browser/kubio/tags/2.6.3/lib/integrations/image-hub/image-hub.php#L70 - https://plugins.trac.wordpress.org/changeset/3361499/kubio/trunk/lib/integrations/image-hub/image-hub.php
CVE ID: CVE-2025-8488 State: PUBLISHED Published: 2025-08-02T09:23:31.864Z Last Updated: 2025-08-04T13:27:52.880Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: brainstormforce Products: Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) Problem Types: CWE-862 Description: The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_hfe_compatibility_option_callback ()function in all versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access
l versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the compatibility option setting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b847b5-9deb-41c4-b976-725249e0098e?source=cve - https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/2.4.6/admin/class-hfe-addons-actions.php#L494 - https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/2.4.7/admin/class-hfe-addons-actions.php#L525