Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-9874 State: PUBLISHED Published: 2025-09-11T07:24:55.823Z Last Updated: 2025-09-11T14:39:16.369Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: webcodingplace Products: Ultimate Classified Listings Problem Types: CWE-98 Description: The Ultimate Classified Listings plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6 via the 'uclwp_dashboard' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access contr
.php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7cf6421c-7b92-4624-9c8a-2a2ab0ca9b28?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-classified-listings/trunk/classes/class-shortcodes.php#L49
CVE ID: CVE-2025-9875 State: PUBLISHED Published: 2025-10-03T11:17:10.831Z Last Updated: 2025-10-03T18:05:08.687Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ticketspot Products: Event Tickets, RSVPs, Calendar Problem Types: CWE-79 Description: The Event Tickets, RSVPs, Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticket_spot' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will
for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3f507853-8c9f-4308-ad6e-5fbb610158f5?source=cve - https://plugins.trac.wordpress.org/browser/ticket-spot/trunk/ticket-spot.php#L104 - https://plugins.trac.wordpress.org/changeset/3371344/
CVE ID: CVE-2025-9876 State: PUBLISHED Published: 2025-10-03T11:17:11.219Z Last Updated: 2025-10-03T18:05:47.114Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: inforrada Products: Ird Slider Problem Types: CWE-79 Description: The Ird Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irdslider' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inject
or-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/44362245-a3af-46a5-b35b-eabd5f537fca?source=cve - https://plugins.trac.wordpress.org/browser/ird-slider/tags/1.0.2/irdslider.php#L221
CVE ID: CVE-2025-9877 State: PUBLISHED Published: 2025-09-12T03:22:44.334Z Last Updated: 2025-09-12T17:13:14.941Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: elangovan Products: Embed Google Datastudio Problem Types: CWE-79 Description: The Embed Google Datastudio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'egds' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
ckers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/90e24dba-e251-476e-87b8-c8df1e4317d4?source=cve - https://plugins.trac.wordpress.org/browser/embed-google-data-studio/trunk/core-init.php#L144
CVE ID: CVE-2025-9879 State: PUBLISHED Published: 2025-09-12T03:22:43.350Z Last Updated: 2025-09-12T17:11:55.208Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: slowmove Products: Spotify Embed Creator Problem Types: CWE-79 Description: The Spotify Embed Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spotify' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
ers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4a0c744a-d4b0-45f4-9434-06ce3dec4d75?source=cve - https://plugins.trac.wordpress.org/browser/spotify-embed-creator/tags/1.0.5/Spotify-Embed-Creator.php#L72
CVE ID: CVE-2025-9880 State: PUBLISHED Published: 2025-09-12T03:22:43.950Z Last Updated: 2025-09-12T17:12:36.311Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: dejocar Products: Side Slide Responsive Menu Problem Types: CWE-352 Description: The Side Slide Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on
scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/57ff8e0b-92cd-49e1-9db7-91c970282e21?source=cve - https://plugins.trac.wordpress.org/browser/side-slide-responsive-menu/tags/1.0/SideSlideMenu.class.php - https://plugins.trac.wordpress.org/browser/side-slide-responsive-menu/tags/1.0/sideslide_admin.php - https://wordpress.org/plugins/side-slide-responsive-menu/
CVE ID: CVE-2025-9881 State: PUBLISHED Published: 2025-09-12T03:22:44.713Z Last Updated: 2025-09-12T17:13:55.722Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: jensg Products: Ultimate Blogroll Problem Types: CWE-352 Description: The Ultimate Blogroll plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional
ged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e5d82cd5-42cc-412b-8026-53736680407d?source=cve - https://wordpress.org/plugins/ultimate-blogroll/ - https://plugins.trac.wordpress.org/browser/ultimate-blogroll/tags/2.5.2/gui/Linkpartner.php#L34
CVE ID: CVE-2025-9882 State: PUBLISHED Published: 2025-09-20T06:43:19.442Z Last Updated: 2025-09-22T15:00:11.042Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: michaelbo Products: osTicket WP Bridge Problem Types: CWE-352 Description: The osTicket WP Bridge plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Addi
a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/88e508ad-e7dd-4c8f-a44d-ef633e826007?source=cve - https://wordpress.org/plugins/osticket-wp-bridge/ - https://plugins.trac.wordpress.org/browser/osticket-wp-bridge/tags/1.9.2/admin/ost-config.php#L122
CVE ID: CVE-2025-9883 State: PUBLISHED Published: 2025-09-20T06:43:19.926Z Last Updated: 2025-09-22T14:55:58.676Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: bpedrassani Products: Browser Sniff Problem Types: CWE-352 Description: The Browser Sniff plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Ana
request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b7210fd7-0812-47bc-bc62-d69280253e0a?source=cve - https://wordpress.org/plugins/browser-sniff/ - https://plugins.trac.wordpress.org/browser/browser-sniff/tags/2.3/browsersniff.php#L88
CVE ID: CVE-2025-9884 State: PUBLISHED Published: 2025-10-03T11:17:12.758Z Last Updated: 2025-10-03T18:10:45.136Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: webdevabq Products: Mobile Site Redirect Problem Types: CWE-352 Description: The Mobile Site Redirect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5c921300-88ef-43b8-959e-2bc490cf303f?source=cve - https://wordpress.org/plugins/mobile-site-redirect/ - https://plugins.trac.wordpress.org/browser/mobile-site-redirect/tags/1.2.1/mobired_admin.php#L27
CVE ID: CVE-2025-9885 State: PUBLISHED Published: 2025-10-03T11:17:09.201Z Last Updated: 2025-10-03T18:01:14.348Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: laudanumsoft Products: MPWizard – Create Mercado Pago Payment Links Problem Types: CWE-352 Description: The MPWizard – Create Mercado Pago Payment Links plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation in the '/includes/admin/class-mpwizard-table.php' file. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site ad
t possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2ca6746d-afca-4ade-bd2e-4d37dedd3c5c?source=cve - https://plugins.trac.wordpress.org/browser/mpwizard/tags/1.2.1/includes/admin/class-mpwizard-table.php#L157
CVE ID: CVE-2025-9886 State: PUBLISHED Published: 2025-10-04T03:33:32.003Z Last Updated: 2025-10-06T15:58:38.479Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: sergiotrinity Products: Trinity Audio – Text to Speech AI audio player to convert content into audio Problem Types: CWE-352 Description: The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.20.2. This is due to missing or incorrect nonce validation in the '/admin/inc/post-management.php' file. This makes it possible for unauthenticated attackers to activate/deactivate
the '/admin/inc/post-management.php' file. This makes it possible for unauthenticated attackers to activate/deactivate posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f57d99dc-3faa-4dfc-9cb6-fdb5647daf9a?source=cve - https://plugins.trac.wordpress.org/browser/trinity-audio/tags/5.20.1/admin/inc/post-management.php#L7 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3371934%40trinity-audio&new=3371934%40trinity-audio&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9887 State: PUBLISHED Published: 2025-09-20T06:43:20.390Z Last Updated: 2025-09-22T14:53:57.815Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: bittokazi Products: Custom Login And Signup Widget Problem Types: CWE-352 Description: The Custom Login And Signup Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in the /frndzk_adminclsw.php file. This makes it possible for unauthenticated attackers to change the email and username settings via a forged request granted they can trick a site administrator into performing an action
email and username settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f478db7f-6339-446e-b00d-0710707e679a?source=cve - https://plugins.trac.wordpress.org/browser/custom-login-and-signup-widget/tags/1.0/frndzk_adminclsw.php#L3
CVE ID: CVE-2025-9888 State: PUBLISHED Published: 2025-09-10T06:38:49.964Z Last Updated: 2025-09-10T20:32:22.942Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: yonifre Products: Maspik – Ultimate Spam Protection Problem Types: CWE-352 Description: The Maspik – Ultimate Spam Protection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.6. This is due to missing or incorrect nonce validation on the clear_log function. This makes it possible for unauthenticated attackers to clear all spam logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a
am logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b9b18739-67ed-4cb0-9577-eb60bc84bbeb?source=cve - https://plugins.trac.wordpress.org/browser/contact-forms-anti-spam/tags/2.5.5/admin/partials/maspik-log.php#L12 - https://research.cleantalk.org/CVE-2025-9888 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3357602%40contact-forms-anti-spam&new=3357602%40contact-forms-anti-spam&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9889 State: PUBLISHED Published: 2025-10-03T11:17:19.123Z Last Updated: 2025-10-03T14:03:49.950Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: contentmx Products: ContentMX Content Publisher Problem Types: CWE-352 Description: The ContentMX Content Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the cmx_activate_connection function. This makes it possible for unauthenticated attackers to bind their own ContentMX connection via a forged request granted they can trick a site administrator into performing an action s
ir own ContentMX connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a5dd354f-080f-4be9-837e-eed48037f140?source=cve - https://plugins.trac.wordpress.org/browser/contentmx-content-publisher/tags/1.0.6/inc/admin.php#L7
CVE ID: CVE-2025-9890 State: PUBLISHED Published: 2025-10-18T08:25:35.623Z Last Updated: 2025-10-20T17:16:42.968Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: mndpsingh287 Products: Theme Editor Problem Types: CWE-352 Description: The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrect nonce validation on the 'theme_editor_theme' page. This makes it possible for unauthenticated attackers to achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analys
uest granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/77189684-b794-41a0-8fc0-3320032c2f69?source=cve - https://plugins.trac.wordpress.org/browser/theme-editor/trunk/app/controller/theme_controller.php#L87 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379404%40theme-editor&new=3379404%40theme-editor&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9891 State: PUBLISHED Published: 2025-09-17T01:53:14.331Z Last Updated: 2025-09-17T13:09:26.021Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: cyberlord92 Products: User Sync Problem Types: CWE-352 Description: The User Sync – Remote User Sync plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the mo_user_sync_form_handler() function. This makes it possible for unauthenticated attackers to deactivate the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link
in via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6b60777e-6e07-42bd-9364-43367e209227?source=cve - https://plugins.trac.wordpress.org/browser/user-sync/tags/1.0.1/mo-user-sync-main.php#L118 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3360328%40user-sync&new=3360328%40user-sync&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9892 State: PUBLISHED Published: 2025-10-03T11:17:16.816Z Last Updated: 2025-10-03T18:15:06.744Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: devrix Products: Restrict User Registration Problem Types: CWE-352 Description: The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the update() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8f51aa9f-056a-441c-8752-edb1c7277808?source=cve - https://plugins.trac.wordpress.org/browser/restrict-user-registration/trunk/index.php#L149
CVE ID: CVE-2025-9893 State: PUBLISHED Published: 2025-09-27T06:47:16.001Z Last Updated: 2025-09-29T19:11:05.048Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: milankyada Products: VM Menu Reorder plugin Problem Types: CWE-352 Description: The VM Menu Reorder plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the vm_set_to_default function. This makes it possible for unauthenticated attackers to reset all menu reordering settings via a forged request granted they can trick a site administrator into performing an action such as clicking
ng settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/df7e57a7-ba15-4181-89f9-e3f1f5de36cf?source=cve - https://plugins.trac.wordpress.org/browser/vm-menu-reorder/trunk/vm-menu-class.php#L275
CVE ID: CVE-2025-9894 State: PUBLISHED Published: 2025-09-27T06:47:14.091Z Last Updated: 2025-09-29T19:06:28.278Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: cristianr909090 Products: Sync Feedly Problem Types: CWE-352 Description: The Sync Feedly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the crsf_cron_job_func function. This makes it possible for unauthenticated attackers to trigger content synchronization from Feedly, potentially creating multiple posts via a forged request granted they can trick a site administrator into performi
edly, potentially creating multiple posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3889aa6f-987a-4a2d-80fd-28628a6ed287?source=cve - https://plugins.trac.wordpress.org/browser/sync-feedly/trunk/sync-feedly.php#L156
CVE ID: CVE-2025-9895 State: PUBLISHED Published: 2025-10-03T11:17:20.655Z Last Updated: 2025-10-03T13:59:06.987Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: umarbajwa Products: Notification Bar Problem Types: CWE-352 Description: The Notification Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the 'subscriber-list-empty.php' file. This makes it possible for unauthenticated attackers to empty the subscriber list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additio