Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
kers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f99622df-0bf3-4252-8bd3-f84c61fcd39a?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3390481%40html-forms&new=3390481%40html-forms&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12126 State: PUBLISHED Published: 2025-11-11T03:30:50.707Z Last Updated: 2025-11-12T20:05:05.807Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: ryanmoyer Products: The Total Book Project Problem Types: CWE-639 Description: The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform several actions like moving/deleting/creating chapters in books that do not belong to them. Additional Ana
e, to perform several actions like moving/deleting/creating chapters in books that do not belong to them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b473fd-2444-4a54-b558-4656634a6903?source=cve - https://wordpress.org/plugins/the-total-book-project/
CVE ID: CVE-2025-12132 State: PUBLISHED Published: 2025-11-11T03:30:40.770Z Last Updated: 2025-11-12T20:06:21.893Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: larsactionhero Products: WP Custom Admin Login Page Logo Problem Types: CWE-352 Description: The WP Custom Admin Login Page Logo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8.4. This is due to missing or incorrect nonce validation on the wpclpl_save functionality. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action
modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6164b272-aa12-4ee3-a73a-64882ff5a899?source=cve - https://wordpress.org/plugins/wp-custom-login-page-logo/
CVE ID: CVE-2025-12134 State: PUBLISHED Published: 2025-10-24T09:23:31.083Z Last Updated: 2025-10-24T12:30:05.035Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: bdthemes Products: ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns Problem Types: CWE-862 Description: The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_popup_status() function in all versions up to, and including, 2.3.11. This makes it possible for unauthenticated attac
e_popup_status() function in all versions up to, and including, 2.3.11. This makes it possible for unauthenticated attackers to enable/disable popups. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/da9f89a2-f816-4445-8aea-11b622451ee9?source=cve - https://plugins.trac.wordpress.org/changeset/3377160
CVE ID: CVE-2025-12135 State: PUBLISHED Published: 2025-11-21T07:31:51.599Z Last Updated: 2025-11-24T18:05:38.396Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: iqonicdesign Products: WPBookit Problem Types: CWE-79 Description: The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css_code' parameter in all versions up to, and including, 1.0.6 due to a missing capability check on the save_custome_code() function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
hat will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7d7b2c79-c4f7-4611-a22a-685d4421a4ab?source=cve - https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/class.wpb-admin-routes-handler.php#L15 - https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/class.wpb-admin-routes.php#L118 - https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/controllers/class.wpb-setting-controller.php#L16 - https://github.com/d0n601/CVE-2025-12135 - https://ryankozak.com/posts/cve-2025-12135/ - https://plugins.trac.
php#L16 - https://github.com/d0n601/CVE-2025-12135 - https://ryankozak.com/posts/cve-2025-12135/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3398463%40wpbookit&new=3398463%40wpbookit&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12136 State: PUBLISHED Published: 2025-10-24T09:23:30.497Z Last Updated: 2025-10-24T12:30:11.866Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: devowl Products: Real Cookie Banner: GDPR & ePrivacy Cookie Consent Problem Types: CWE-918 Description: The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.2.4. This is due to insufficient validation on the user-supplied URL in the '/scanner/scan-without-login' REST API endpoint. This makes it possible for authenticated attackers, with administrator-level access and above, to make web reques
point. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services via the `url` parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7f559d7f-3faf-4549-b529-f4db03dce2dd?source=cve - https://infosecstuff.com/SSRF-Real-Cookie-Banner - https://plugins.trac.wordpress.org/browser/real-cookie-banner/trunk/inc/rest/Scanner.php#L48 - https://plugins.trac.wordpress.org/browser/real-cookie-banner/trunk/inc/rest/Scanner.php#L210 - https:
Scanner.php#L48 - https://plugins.trac.wordpress.org/browser/real-cookie-banner/trunk/inc/rest/Scanner.php#L210 - https://plugins.trac.wordpress.org/browser/real-cookie-banner/trunk/inc/rest/Scanner.php#L223 - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery - https://plugins.trac.wordpress.org/changeset/3378727
CVE ID: CVE-2025-12137 State: PUBLISHED Published: 2025-11-01T06:40:40.047Z Last Updated: 2025-11-03T13:30:23.253Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: jcollings Products: Import WP – Export and Import CSV and XML files to WordPress Problem Types: CWE-73 Description: The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.14.16. This is due to the plugin's REST API endpoint accepting arbitrary absolute file paths without proper validation in the 'attach_file()' function when handling 'file_local' actions. This makes it possible for authentica
per validation in the 'attach_file()' function when handling 'file_local' actions. This makes it possible for authenticated attackers, with administrator-level access and above, to read arbitrary files on the server's filesystem, including sensitive configuration files and system files via the 'local_url' parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f10636ea-06aa-4186-a891-ed4bb0800c41?source=cve - https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Rest/RestManager.php#L1079 - https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Importer/ImporterManager.php#L43
r.php#L1079 - https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Importer/ImporterManager.php#L435 - https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Filesystem/Filesystem.php#L212 - https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Filesystem/Filesystem.php#L56 - https://owasp.org/www-community/attacks/Path_Traversal - https://cwe.mitre.org/data/definitions/36.html - https://github.com/importwp/importwp/commit/94cc524aa0c81be6463a9e8d154b00220e34709c - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3387749%40jc-importer&new=3387749%40jc-importer&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12138 State: PUBLISHED Published: 2025-11-21T07:31:48.303Z Last Updated: 2025-11-21T14:57:12.908Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: bww Products: URL Image Importer Problem Types: CWE-434 Description: The URL Image Importer plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.0.6. This is due to the plugin relying on a user-controlled Content-Type HTTP header to validate file uploads in the 'uimptr_import_image_from_url()' function which writes the file to the server before performing proper validation. This makes it possible for authenticate
unction which writes the file to the server before performing proper validation. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible via the uploaded PHP file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1da18430-1bd0-4f63-9e22-5d26de2be410?source=cve - https://plugins.trac.wordpress.org/browser/url-image-importer/trunk/url-image-importer.php#L198 - https://plugins.trac.wordpress.org/browser/url-image-importer/trunk/url-image-importer.php#L1319 - https://plugins.trac.wordpress.o
gins.trac.wordpress.org/browser/url-image-importer/trunk/url-image-importer.php#L1319 - https://plugins.trac.wordpress.org/browser/url-image-importer/trunk/url-image-importer.php#L1353 - https://plugins.trac.wordpress.org/browser/url-image-importer/trunk/url-image-importer.php#L1358 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3395852%40url-image-importer&new=3395852%40url-image-importer&sfp_email=&sfph_mail=#file9
CVE ID: CVE-2025-12139 State: PUBLISHED Published: 2025-11-05T06:35:00.585Z Last Updated: 2025-11-05T14:35:34.262Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: princeahmed Products: File Manager for Google Drive – Integrate Google Drive Problem Types: CWE-200 Description: The File Manager for Google Drive – Integrate Google Drive with WordPress plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.5.3 via the "get_localize_data" function. This makes it possible for unauthenticated attackers to extract sensitive data including Google OAuth credentials (client_id and client_secret) and Google account emai
ckers to extract sensitive data including Google OAuth credentials (client_id and client_secret) and Google account email addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/607073ad-3a4a-4a21-af0f-3ade81382605?source=cve - https://plugins.trac.wordpress.org/browser/integrate-google-drive/tags/1.5.3/includes/class-enqueue.php#L88 - https://plugins.trac.wordpress.org/browser/integrate-google-drive/tags/1.5.3/includes/class-enqueue.php#L232 - https://plugins.trac.wordpress.org/browser/integrate-google-drive/tags/1.5.3/includes/class-enqueue.php#L243 - https://plugins.trac.wordpress.org/changeset/3387825/integrate
google-drive/tags/1.5.3/includes/class-enqueue.php#L243 - https://plugins.trac.wordpress.org/changeset/3387825/integrate-google-drive
CVE ID: CVE-2025-12142 State: PUBLISHED Published: 2025-10-29T12:00:42.236Z Last Updated: 2025-10-29T13:30:33.090Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: ABB Products: Terra AC wallbox Problem Types: CWE-120 Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A8107&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-12147 State: PUBLISHED Published: 2025-10-29T15:29:54.302Z Last Updated: 2025-10-29T15:53:51.291Z Vendors: floragunn Products: Search Guard FLX Problem Types: CWE-200, CWE-732 Description: In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields. When an FLS exclusion rule (e.g., ~field) is applied to a field which contains an object as its value, the object is correctly removed from the _source returned by search operations. However, the object members (i.e., child attributes) remain accessible to search queries. This exposure allows adversaries to infer or reconstruct the original contents of the exclu
ccessible to search queries. This exposure allows adversaries to infer or reconstruct the original contents of the excluded object. Workaround - If you cannot upgrade immediately and FLS exclusion rules are used for object valued attributes (like ~object), add an additional exclusion rule for the members of the object (like ~object.*). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search-guard.com/cve-advisory/ - https://docs.search-guard.com/latest/changelog-searchguard-flx-3_1_2
CVE ID: CVE-2025-12148 State: PUBLISHED Published: 2025-10-29T15:31:32.419Z Last Updated: 2025-10-29T16:11:51.396Z Vendors: floragunn Products: Search Guard FLX Problem Types: CWE-200, CWE-732 Description: In Search Guard versions 3.1.1 and earlier, Field Masking (FM) rules are improperly enforced on fields of type IP (IP Address). While the content of these fields is properly redacted in the _source document returned by search operations, the results do return documents (hits) when searching based on a specific IP values. This allows to reconstruct the original contents of the field. Workaround - If you cannot upgrade immediately, you can avoid the problem by using field level security (FLS
the field. Workaround - If you cannot upgrade immediately, you can avoid the problem by using field level security (FLS) protection on fields of the affected types instead of field masking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search-guard.com/cve-advisory/ - https://docs.search-guard.com/latest/changelog-searchguard-flx-3_1_2
CVE ID: CVE-2025-12149 State: PUBLISHED Published: 2025-11-14T13:58:42.775Z Last Updated: 2025-11-14T16:51:01.897Z Vendors: floragunn Products: Search Guard FLX Problem Types: CWE-200, CWE-863 Description: In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security (DLS) is correctly enforced elsewhere, when the search is triggered from a Signals watch, the DLS rule is not enforced, allowing access to all documents in the queried indices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search-guard.com/cve-advisory/ - https://docs.search-guard.com/latest/changelog-searchguard-flx-3_1_3 - https://docs.search-guard.com/latest/changelog-searchguard-flx
search-guard.com/latest/changelog-searchguard-flx-3_1_3 - https://docs.search-guard.com/latest/changelog-searchguard-flx-4_0_0
CVE ID: CVE-2025-12152 State: REJECTED Published: N/A Last Updated: 2025-11-12T15:18:09.718Z Description: No description available.
CVE ID: CVE-2025-12155 State: PUBLISHED Published: 2025-11-10T08:49:45.811Z Last Updated: 2025-11-10T15:18:43.851Z Vendors: Google Cloud Products: Looker Problem Types: CWE-77 Description: A Command Injection vulnerability, resulting from improper file path sanitization (Directory Traversal) in Looker allows an attacker with Developer permission to execute arbitrary shell commands when a user is deleted on the host system. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required for these. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all suppor
for these. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.12.100+ * 24.18.192+ * 25.0.69+ * 25.6.57+ * 25.8.39+ * 25.10.22+ Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/support/bulletins#gcp-2025-052
CVE ID: CVE-2025-12156 State: PUBLISHED Published: 2025-11-04T04:27:18.698Z Last Updated: 2025-11-04T16:08:38.677Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: aitool Products: Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One Problem Types: CWE-862 Description: The Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_post_data() function in versions 2.0.7 to 2.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create and publish arbitrary pos
kes it possible for authenticated attackers, with Subscriber-level access and above, to create and publish arbitrary posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7bcfb35d-6d86-4481-be97-58c2c410e0cd?source=cve - https://wordpress.org/plugins/ai-auto-tool/
CVE ID: CVE-2025-12157 State: PUBLISHED Published: 2025-11-04T04:27:16.185Z Last Updated: 2025-11-04T17:16:00.320Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: tanvirahmed1984 Products: Simple User Capabilities Problem Types: CWE-862 Description: The Simple User Capabilities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_reset_capability' AJAX endpoint in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to reset any user's capabilities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threa
ny user's capabilities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3a1d0432-aff0-477e-aa6e-4de3e4d789cb?source=cve - https://plugins.svn.wordpress.org/simple-user-capabilities/tags/1.0/user_access.php - https://wordpress.org/plugins/simple-user-capabilities/
CVE ID: CVE-2025-12158 State: PUBLISHED Published: 2025-11-04T04:27:22.881Z Last Updated: 2025-11-04T15:01:57.048Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: tanvirahmed1984 Products: Simple User Capabilities Problem Types: CWE-862 Description: The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to elevate the role of any user account to administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threa
count to administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dd75b8ec-1961-4a7a-92e6-1517e638974b?source=cve - https://plugins.svn.wordpress.org/simple-user-capabilities/tags/1.0/user_access.php - https://wordpress.org/plugins/simple-user-capabilities/
CVE ID: CVE-2025-12160 State: PUBLISHED Published: 2025-11-21T09:27:01.407Z Last Updated: 2025-11-21T14:55:08.429Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: nmedia Products: Simple User Registration Problem Types: CWE-79 Description: The Simple User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpr_admin_msg' parameter in all versions up to, and including, 6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnr
scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9bb5e60d-f7c9-4b47-ba6f-0f2d1d060263?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3396064%40wp-registration&new=3396064%40wp-registration&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12161 State: PUBLISHED Published: 2025-11-08T03:27:48.931Z Last Updated: 2025-11-10T14:14:47.685Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: burhandodhy Products: Smart Auto Upload Images – Import External Images Problem Types: CWE-434 Description: The Smart Auto Upload Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the auto-image creation functionality in all versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution
tor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/86dab8e6-b9fd-45ca-bdd1-8665f3bb75f2?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=%2Fsmart-auto-upload-images%2Ftags%2F1.2.0&old=3388129&new_path=%2Fsmart-auto-upload-images%2Ftags%2F1.2.1&new=3388129&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12167 State: PUBLISHED Published: 2025-11-08T03:27:45.362Z Last Updated: 2025-11-10T20:12:07.256Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: rnzo Products: Contact Form 7 AWeber Extension Problem Types: CWE-862 Description: The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_aweber_logreset' AJAX endpoint in all versions up to, and including, 0.1.42. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the AWeber logs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
er-level access and above, to reset the AWeber logs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f4ecda0-1eaa-44e7-8ef5-20c967b5da9f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3390662%40integrate-contact-form-7-and-aweber&new=3390662%40integrate-contact-form-7-and-aweber&sfp_email=&sfph_mail=