Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-12045 State: PUBLISHED Published: 2025-11-04T11:19:27.966Z Last Updated: 2025-11-04T18:53:30.602Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeisle Products: Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More Problem Types: CWE-79 Description: The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the category and tag 'name' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with
.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/139a264b-082b-45db-ac9e-4974bf86c56f?source=cve - https://plugins.trac.wordpress.org/browser/themeisle-companion/trunk/obfx_modules/elementor-extra-widgets/widgets/elementor/posts-grid.php#L1912 - https://plugins.trac.wordpress.org/browser/themeisle-companion/trunk/obfx_modules/elementor-extra-widgets/widgets/elementor/pos
/plugins.trac.wordpress.org/browser/themeisle-companion/trunk/obfx_modules/elementor-extra-widgets/widgets/elementor/posts-grid.php#L1878 - https://research.cleantalk.org/cve-2025-12045/ - https://plugins.trac.wordpress.org/changeset/3388856/
CVE ID: CVE-2025-12047 State: PUBLISHED Published: 2025-11-12T19:18:57.396Z Last Updated: 2025-11-12T21:03:27.695Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Lenovo Products: Scanner Pro Problem Types: CWE-295 Description: A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances, could allow an attacker on the same logical network to disclose sensitive user files from the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/434327
CVE ID: CVE-2025-12048 State: PUBLISHED Published: 2025-11-12T19:19:05.108Z Last Updated: 2025-11-12T21:03:22.396Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Scanner Pro Problem Types: CWE-434 Description: An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code execution or unauthorized control of the affected system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/434326
CVE ID: CVE-2025-12055 State: PUBLISHED Published: 2025-10-27T06:36:36.526Z Last Updated: 2025-11-03T17:32:04.323Z Vendors: MPDV Mikrolab GmbH Products: MIP 2, FEDRA 2, HYDRA X Problem Types: CWE-22 Description: HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36 with Servicepack 8 (week 36/2025), which allows an attacker to read arbitrary files from the Windows operating system. The "Filename" parameter of the public $SCHEMAS$ ressource is vulnerable and can be exploited easily. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consu
ed easily. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/mpdv
CVE ID: CVE-2025-12056 State: PUBLISHED Published: 2025-11-19T06:46:09.940Z Last Updated: 2025-11-21T17:14:57.297Z Vendors: Shelly Products: Pro 3EM Problem Types: CWE-125 Description: Out-of-bounds Read in Shelly Pro 3EM (before v1.4.4) allows Overread Buffers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-12056 - https://www.cisa.gov/news-events/ics-advisories/icsa-25-322-03
CVE ID: CVE-2025-12057 State: PUBLISHED Published: 2025-11-19T06:00:05.080Z Last Updated: 2025-11-19T19:28:46.929Z Vendors: Unknown Products: WavePlayer Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/110db433-01ec-47ea-b74f-c3faa1757a3c/
CVE ID: CVE-2025-12058 State: PUBLISHED Published: 2025-10-29T08:48:29.689Z Last Updated: 2025-10-29T14:11:03.027Z Vendors: Keras Products: Keras Problem Types: CWE-502 Description: The Keras.Model.load_model method, including when executed with the intended security mitigation safe_mode=True, is vulnerable to arbitrary local file loading and Server-Side Request Forgery (SSRF). This vulnerability stems from the way the StringLookup layer is handled during model loading from a specially crafted .keras archive. The constructor for the StringLookup layer accepts a vocabulary argument that can specify a local file path or a remote file path. * Arbitrary Local File Read: An attacker can create a
rgument that can specify a local file path or a remote file path. * Arbitrary Local File Read: An attacker can create a malicious .keras file that embeds a local path in the StringLookup layer's configuration. When the model is loaded, Keras will attempt to read the content of the specified local file and incorporate it into the model state (e.g., retrievable via get_vocabulary()), allowing an attacker to read arbitrary local files on the hosting system. * Server-Side Request Forgery (SSRF): Keras utilizes tf.io.gfile for file operations. Since tf.io.gfile supports remote filesystem handlers (such as GCS and HDFS) and HTTP/HTTPS protocols, the same mechanism can be leveraged to fetch content
ilesystem handlers (such as GCS and HDFS) and HTTP/HTTPS protocols, the same mechanism can be leveraged to fetch content from arbitrary network endpoints on the server's behalf, resulting in an SSRF condition. The security issue is that the feature allowing external path loading was not properly restricted by the safe_mode=True flag, which was intended to prevent such unintended data access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/keras-team/keras/security/advisories/GHSA-qg93-c7p6-gg7f - https://github.com/keras-team/keras/pull/21751
CVE ID: CVE-2025-12060 State: PUBLISHED Published: 2025-10-30T17:10:43.868Z Last Updated: 2025-11-01T03:55:52.355Z Vendors: Keras Products: Keras Problem Types: CWE-22 Description: The keras.utils.get_file API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special symlinks, which, when extracted, allows them to write arbitrary files to any location on the filesystem outside of the intended destination folder. This vulnerability is linked to the underlying Python tarfile weakness, i
em outside of the intended destination folder. This vulnerability is linked to the underlying Python tarfile weakness, identified as CVE-2025-4517. Note that upgrading Python to one of the versions that fix CVE-2025-4517 (e.g. Python 3.13.4) is not enough. One additionally needs to upgrade Keras to a version with the fix (Keras 3.12). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/keras-team/keras/pull/21760 - https://github.com/keras-team/keras/security/advisories/GHSA-hjqc-jx6g-rwp9
CVE ID: CVE-2025-12064 State: PUBLISHED Published: 2025-11-08T03:27:46.417Z Last Updated: 2025-11-10T20:01:06.059Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: f1logic Products: WP2Social Auto Publish Problem Types: CWE-79 Description: The WP2Social Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional A
es that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/32eb02b8-71cd-4cdb-aa9d-3fd1850fb126?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3386972%40facebook-auto-publish&new=3386972%40facebook-auto-publish&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12065 State: PUBLISHED Published: 2025-11-04T04:27:21.798Z Last Updated: 2025-11-04T15:10:58.084Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: carticon Products: WP Carticon Problem Types: CWE-79 Description: The WP Carticon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carticon_js_script' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-s
ct arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c346b7d8-d1d4-473d-9388-e38631658c78?source=cve - https://wordpress.org/plugins/wp-carticon/
CVE ID: CVE-2025-12066 State: PUBLISHED Published: 2025-11-21T09:27:00.990Z Last Updated: 2025-11-21T14:55:14.299Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: etruel Products: WP Delete Post Copies Problem Types: CWE-79 Description: The WP Delete Post Copies plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only af
bove, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/92ab1f56-5ca6-48e8-b380-ac2e302d63d2?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3394571%40etruel-del-post-copies&new=3394571%40etruel-del-post-copies&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12068 State: REJECTED Published: N/A Last Updated: 2025-11-12T15:46:40.727Z Description: No description available.
CVE ID: CVE-2025-12069 State: PUBLISHED Published: 2025-11-04T03:26:47.094Z Last Updated: 2025-11-04T18:48:00.111Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: stiand Products: WP Global Screen Options Problem Types: CWE-352 Description: The WP Global Screen Options plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing nonce validation on the `updatewpglobalscreenoptions` action handler. This makes it possible for unauthenticated attackers to modify global screen options for all users via a forged request granted they can trick an administrator into performing an action such as c
n options for all users via a forged request granted they can trick an administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dae86d7c-3bbb-4872-acd7-08ff8d437b8e?source=cve - https://plugins.trac.wordpress.org/browser/wp-global-screen-options/tags/0.2/wp_global_screen_options.php#L16
CVE ID: CVE-2025-12070 State: PUBLISHED Published: 2025-11-04T03:26:45.215Z Last Updated: 2025-11-04T18:50:13.151Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: viaads Products: ViaAds Problem Types: CWE-352 Description: The ViaAds plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing nonce validation on the `ViaAds_pluginHandler` function. This makes it possible for unauthenticated attackers to modify the plugin's API key and cookie consent settings via a forged request granted they can trick an administrator into performing an action such as clicking on a link. Additional Anal
ed request granted they can trick an administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/00f65117-e8f7-41d8-bdf4-c1fab03e4792?source=cve - https://plugins.trac.wordpress.org/browser/viaads/tags/2.1.1/apikey.php#L81
CVE ID: CVE-2025-12072 State: PUBLISHED Published: 2025-10-24T08:23:56.994Z Last Updated: 2025-10-24T16:45:11.243Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: mynamevenu24 Products: Disable Content Editor For Specific Template Problem Types: CWE-352 Description: The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing nonce validation on template configuration updates. This makes it possible for unauthenticated attackers to add or delete template configurations via a forged request granted they can trick an administrator into perform
ckers to add or delete template configurations via a forged request granted they can trick an administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/243200f4-5a5d-4275-bf2b-f4cb6099d145?source=cve - https://plugins.trac.wordpress.org/browser/disable-contect-editor-for-specific-template/tags/2.0/disable-editor-specific-template.php#L57
CVE ID: CVE-2025-12078 State: PUBLISHED Published: 2025-11-18T08:27:37.836Z Last Updated: 2025-11-18T21:08:01.217Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: artibot Products: ArtiBot Free Chat Bot for WebSites Problem Types: CWE-79 Description: The ArtiBot Free Chat Bot for WebSites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking
trary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/efe48adb-af9f-45dc-b693-ae56dce1bfe2?source=cve - https://wordpress.org/plugins/artibot/
CVE ID: CVE-2025-12079 State: PUBLISHED Published: 2025-11-18T09:27:37.488Z Last Updated: 2025-11-18T21:11:44.313Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: f1logic Products: WP Twitter Auto Publish Problem Types: CWE-79 Description: The WP Twitter Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional
ages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/562456ac-a113-4b3d-bc5d-6dedde635d5e?source=cve - https://wordpress.org/plugins/twitter-auto-publish/
CVE ID: CVE-2025-12080 State: PUBLISHED Published: 2025-10-27T08:45:52.604Z Last Updated: 2025-10-27T15:53:29.322Z Vendors: Google Products: WearOS Problem Types: CWE-345 Description: On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents utilizing the sms:, smsto:, mms:, and mmsto: Uniform Resource Identifier (URI) schemes is incorrectly implemented. Due to this misconfiguration, an attacker capable of invoking an Android intent can exploit this vulnerability to send messages on the user’s behalf to arbitrary receivers without requiring any further user interaction or specific permissions. This allows for the sile
to arbitrary receivers without requiring any further user interaction or specific permissions. This allows for the silent and unauthorized transmission of messages from a compromised Wear OS device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://towerofhanoi.it/writeups/cve-2025-12080/
CVE ID: CVE-2025-12082 State: PUBLISHED Published: 2025-10-29T23:14:19.017Z Last Updated: 2025-10-30T14:41:28.623Z Vendors: Drupal Products: CivicTheme Design System Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-112
CVE ID: CVE-2025-12083 State: PUBLISHED Published: 2025-10-29T23:14:33.900Z Last Updated: 2025-10-30T14:40:11.746Z Vendors: Drupal Products: CivicTheme Design System Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-113
CVE ID: CVE-2025-12085 State: PUBLISHED Published: 2025-11-21T05:32:05.922Z Last Updated: 2025-11-21T14:58:36.778Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: elextensions Products: ELEX WordPress HelpDesk & Customer Ticketing System Problem Types: CWE-862 Description: The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_settings_empty_trash' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to empty the ticket trash. Additional Analyst N
ble for authenticated attackers, with Subscriber-level access and above, to empty the ticket trash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/89696d1c-8e6e-402a-9d7a-03fe0f364a72?source=cve - https://plugins.trac.wordpress.org/changeset/3399391/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-ajax-functions-two.php
CVE ID: CVE-2025-12086 State: PUBLISHED Published: 2025-11-21T07:31:47.110Z Last Updated: 2025-11-21T14:57:29.611Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpswings Products: Return Refund and Exchange For WooCommerce Problem Types: CWE-639 Description: The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the 'wps_rma_cancel_return_request' AJAX endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other users refund requests. Additi
sible for authenticated attackers, with Subscriber-level access and above, to delete other users refund requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/126e2b92-322e-440c-a924-1b604330f164?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3394215%40woo-refund-and-exchange-lite&new=3394215%40woo-refund-and-exchange-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12087 State: PUBLISHED Published: 2025-11-12T04:29:08.619Z Last Updated: 2025-11-12T18:33:33.764Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: acowebs Products: Wishlist and Save for later for Woocommerce Problem Types: CWE-639 Description: The Wishlist and Save for later for Woocommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.22 via the 'awwlm_remove_added_wishlist_page' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete wishlist items from other user's
possible for authenticated attackers, with Subscriber-level access and above, to delete wishlist items from other user's wishlists. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/17e8a743-7985-4b28-b854-ac052a834f3a?source=cve - https://plugins.trac.wordpress.org/log/aco-wishlist-for-woocommerce/
CVE ID: CVE-2025-12088 State: PUBLISHED Published: 2025-11-18T09:27:38.684Z Last Updated: 2025-11-18T21:01:20.614Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bhargavbhandari90 Products: Meta Display Block Problem Types: CWE-79 Description: The Meta Display Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Meta Display Block in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additi
and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/68251e79-d064-4be4-a218-92a03e27b59d?source=cve - https://wordpress.org/plugins/meta-display-block/
CVE ID: CVE-2025-12089 State: PUBLISHED Published: 2025-11-13T03:27:36.705Z Last Updated: 2025-11-13T14:34:40.979Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: supsysticcom Products: Data Tables Generator by Supsystic Problem Types: CWE-22 Description: The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cleanCache() function in all versions up to, and including, 1.10.45. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the