Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-11777 State: PUBLISHED Published: 2025-11-13T17:32:03.975Z Last Updated: 2025-11-13T18:01:46.459Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-11794 State: PUBLISHED Published: 2025-11-14T10:45:39.244Z Last Updated: 2025-11-14T10:45:39.244Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/{user_id}/email/verify/member endpoint References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-11795 State: PUBLISHED Published: 2025-11-12T16:24:30.301Z Last Updated: 2025-11-14T14:10:19.629Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: 3ds Max Problem Types: CWE-787 Description: A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0023
CVE ID: CVE-2025-11797 State: PUBLISHED Published: 2025-11-12T16:24:50.645Z Last Updated: 2025-11-14T14:11:04.823Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: 3ds Max Problem Types: CWE-416 Description: A maliciously crafted DWG file, when parsed through Autodesk 3ds Max, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories
ences: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0023
CVE ID: CVE-2025-11799 State: PUBLISHED Published: 2025-11-21T07:31:54.688Z Last Updated: 2025-11-24T18:02:34.026Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: rustaurius Products: Affiliate AI Lite Problem Types: CWE-79 Description: The Affiliate AI Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'asin' shortcode attribute in the affiai_img shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
ckers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b05f4ef4-aa64-4cf4-a278-604df8407d12?source=cve - https://plugins.trac.wordpress.org/browser/affiliate-ai-lite/tags/1.0.1/includes/afx-img.php#L53 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399153%40affiliate-ai-lite&new=3399153%40affiliate-ai-lite
CVE ID: CVE-2025-11800 State: PUBLISHED Published: 2025-11-21T07:31:58.863Z Last Updated: 2025-11-21T14:55:59.426Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: surbma Products: Surbma | MiniCRM Shortcode Problem Types: CWE-79 Description: The Surbma | MiniCRM Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the 'minicrm' shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when
ated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f7509053-fc70-420a-b998-b7158732c147?source=cve - https://plugins.trac.wordpress.org/browser/surbma-minicrm-shortcode/tags/2.0/surbma-minicrm-shortcode.php#L34
CVE ID: CVE-2025-11801 State: PUBLISHED Published: 2025-11-21T07:31:48.703Z Last Updated: 2025-11-21T14:57:07.823Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: davidangel Products: AudioTube Problem Types: CWE-79 Description: The AudioTube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' shortcode attribute of the 'audiotube' shortcode in all versions up to, and including, 0.0.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/258a2d5d-a176-4b89-bc4c-089d072982dd?source=cve - https://plugins.trac.wordpress.org/browser/audiotube/tags/0.0.3/index.php#L64
CVE ID: CVE-2025-11802 State: PUBLISHED Published: 2025-11-21T07:31:58.013Z Last Updated: 2025-11-21T14:56:11.820Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bartboy011 Products: Bulma Shortcodes Problem Types: CWE-79 Description: The Bulma Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' shortcode attribute in the bulma-notification shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e119d542-7cac-47e4-ae13-5382911f1f5e?source=cve - https://plugins.trac.wordpress.org/browser/bulma-shortcodes/tags/1.0/inc/components.php#L36
CVE ID: CVE-2025-11803 State: PUBLISHED Published: 2025-11-21T08:28:11.139Z Last Updated: 2025-11-24T18:02:12.039Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpfanyi Products: WPSite Shortcode Problem Types: CWE-79 Description: The WPSite Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'format' shortcode attribute in the wpsite_y shortcode and the 'before' attribute in the wpsite_postauthor shortcode in all versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping in error messages. This makes it possible for authenticated attackers, with contributor-level access and above,
escaping in error messages. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0d9712c2-1698-4c67-a700-a4598cb25a95?source=cve - https://plugins.trac.wordpress.org/browser/wpsite-shortcode/tags/1.2/shortcodes/wpsite-date.php#L19 - https://plugins.trac.wordpress.org/browser/wpsite-shortcode/tags/1.2/shortcodes/wpsite-date.php#L35 - https://plugins.trac.wordpress.org/browser/wpsite-shortcode/tags/1.2/shortcodes/wpsite-date.php#L51
CVE ID: CVE-2025-11804 State: PUBLISHED Published: 2025-10-22T08:27:03.292Z Last Updated: 2025-10-22T15:46:11.380Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jobair Products: JB News Ticker Problem Types: CWE-79 Description: The JB News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the 'jbticker' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
ntributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/062af58f-32e6-4551-b82b-a2766ad5644c?source=cve - https://plugins.trac.wordpress.org/browser/jb-news-ticker/tags/1.0/jb-plugin-hook.php#L36 - https://plugins.trac.wordpress.org/browser/jb-news-ticker/tags/1.0/jb-plugin-hook.php#L45
CVE ID: CVE-2025-11805 State: PUBLISHED Published: 2025-11-11T03:30:38.143Z Last Updated: 2025-11-12T20:07:47.648Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: doytch Products: Skip to Timestamp Problem Types: CWE-79 Description: The Skip to Timestamp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skipto' shortcode in all versions up to, and including, 1.4.4. This is due to insufficient input sanitization and output escaping on the 'time' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an i
ributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/48e62d66-d058-419c-93cf-0cb890177751?source=cve - https://wordpress.org/plugins/skip-to-timestamp/ - https://plugins.trac.wordpress.org/browser/skip-to-timestamp/tags/1.4.4/skiptotimestamp.php#L74
CVE ID: CVE-2025-11806 State: PUBLISHED Published: 2025-10-31T02:26:04.351Z Last Updated: 2025-10-31T17:04:00.928Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: qzzr Products: Qzzr Shortcode Plugin Problem Types: CWE-79 Description: The Qzzr Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qzzr' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'quiz' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inje
utor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b5d5d6ec-bb23-4619-b5d9-9bd965b049b5?source=cve - https://wordpress.org/plugins/qzzr-shortcode/ - https://plugins.trac.wordpress.org/browser/qzzr-shortcode/tags/1.0.1/qzzr.php#L35
CVE ID: CVE-2025-11807 State: PUBLISHED Published: 2025-10-22T08:27:05.828Z Last Updated: 2025-10-22T15:15:52.294Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mrgeorgegray Products: Mixlr Shortcode Problem Types: CWE-79 Description: The Mixlr Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mixlr' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'url' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an i
ributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2771f9d4-429f-4691-a65c-073c3a3778fb?source=cve - https://wordpress.org/plugins/mixlr-shortcode/ - https://plugins.trac.wordpress.org/browser/mixlr-shortcode/tags/1.0.1/mixlr-shortcode.php#L30
CVE ID: CVE-2025-11808 State: PUBLISHED Published: 2025-11-21T08:28:14.200Z Last Updated: 2025-11-21T14:55:36.792Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: antiochinteractive Products: Shortcode for Google Street View Problem Types: CWE-79 Description: The Shortcode for Google Street View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'streetview' shortcode in all versions up to, and including, 0.5.7. This is due to insufficient input sanitization and output escaping on the 'id' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages tha
sible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a8a5b5ce-9975-449b-bdd1-d139f1360297?source=cve - https://plugins.trac.wordpress.org/browser/wp-google-street-view-shortcode/tags/0.5.7/gsv-shortcode.php#L108
CVE ID: CVE-2025-11809 State: PUBLISHED Published: 2025-10-22T08:27:04.024Z Last Updated: 2025-10-22T15:44:20.374Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nazakatali32 Products: WP-Force Images Download Problem Types: CWE-79 Description: The WP-Force Images Download plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpfid' shortcode in all versions up to, and including, 1.8. This is due to insufficient input sanitization and output escaping on the 'class' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a
tackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/07775638-270b-4424-8e2a-3ead1d752c88?source=cve - https://plugins.trac.wordpress.org/browser/wp-force-images-download/tags/1.8/wp_fid.php#L155
CVE ID: CVE-2025-11810 State: PUBLISHED Published: 2025-10-22T08:27:06.662Z Last Updated: 2025-10-22T15:01:41.924Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: chrishurst Products: Name: Print Button Shortcode Problem Types: CWE-79 Description: The Print Button Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'print-button' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'target' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute w
ticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3b3f0f80-0004-4373-b0a7-92f2d047415d?source=cve - https://wordpress.org/plugins/print-button-shortcode/ - https://plugins.trac.wordpress.org/browser/print-button-shortcode/tags/1.0.1/print-button-shortcode.php#L46
CVE ID: CVE-2025-11811 State: PUBLISHED Published: 2025-10-22T08:27:07.414Z Last Updated: 2025-10-22T13:23:20.980Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: matthewmarichiba Products: Simple Youtube Shortcode Problem Types: CWE-79 Description: The Simple Youtube Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embed_youtube' shortcode in all versions up to, and including, 1.1.3. This is due to insufficient input sanitization and output escaping on the 'id' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute
nticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4f86d75b-f75e-4d5b-b0b8-a17a68e17048?source=cve - https://wordpress.org/plugins/simple-youtube-shortcode/ - https://plugins.trac.wordpress.org/browser/simple-youtube-shortcode/tags/1.1.3/simple-youtube-shortcode.php#L60
CVE ID: CVE-2025-11812 State: PUBLISHED Published: 2025-11-04T04:27:23.926Z Last Updated: 2025-11-04T14:56:24.438Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: redq Products: Reuse Builder Problem Types: CWE-79 Description: The Reuse Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reuse_builder_single_post_title' shortcode in all versions up to, and including, 1.7. This is due to insufficient input sanitization and output escaping on the 'style' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
ers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f796ade5-db48-4334-9a76-15326f62c9a5?source=cve - https://wordpress.org/plugins/reuse-builder/ - https://plugins.trac.wordpress.org/browser/reuse-builder/tags/1.7/shortcodes/single_post_title.php#L24
CVE ID: CVE-2025-11813 State: PUBLISHED Published: 2025-10-22T08:27:07.033Z Last Updated: 2025-10-22T14:56:22.275Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pressmaninc Products: Responsive iframe GoogleMap Problem Types: CWE-79 Description: The Responsive iframe GoogleMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'responsive_map' shortcode in all versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping on the 'width' and 'height' attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages
possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/47a04186-8eec-4ef6-9fce-9b891a04ed9f?source=cve - https://wordpress.org/plugins/responsive-iframe-googlemap/ - https://plugins.trac.wordpress.org/browser/responsive-iframe-googlemap/tags/1.0.2/responsive-iframe-googlemap.php#L80
CVE ID: CVE-2025-11814 State: PUBLISHED Published: 2025-10-16T04:27:14.576Z Last Updated: 2025-10-16T14:35:29.584Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Brainstorm Force Products: Ultimate Addons for WPBakery Problem Types: CWE-79 Description: The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 3.21.1 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
s that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1f41101c-c54f-4e97-a0fb-79a17d5f0929?source=cve - https://patchstack.com/database/wordpress/plugin/ultimate_vc_addons/vulnerability/wordpress-ultimate-addons-for-wpbakery-page-builder-plugin-3-21-1-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2025-11815 State: PUBLISHED Published: 2025-11-21T07:31:52.812Z Last Updated: 2025-11-24T18:04:11.946Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: admintwentytwenty Products: UiPress lite | Effortless custom dashboards, admin themes and pages Problem Types: CWE-285 Description: The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the uip_save_site_option() function in all versions up to, and including, 3.5.08. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitr
ng, 3.5.08. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary plugin settings. Other AJAX actions are also affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8f8d7397-0201-4194-8604-057f905ef10b?source=cve - https://plugins.trac.wordpress.org/browser/uipress-lite/trunk/admin/core/ajax-functions.php#L396 - https://plugins.trac.wordpress.org/changeset/3398753/
CVE ID: CVE-2025-11816 State: PUBLISHED Published: 2025-11-01T01:47:40.230Z Last Updated: 2025-11-03T18:57:46.543Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wplegalpages Products: Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages Problem Types: CWE-862 Description: The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disconnect_account_request() function in all versions up to, and including, 3.5.1. This makes it possible for unauthenticated attackers to disconnect
function in all versions up to, and including, 3.5.1. This makes it possible for unauthenticated attackers to disconnect the site from its API plan. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2116340a-160f-493c-abe3-75b05282d78a?source=cve - https://plugins.trac.wordpress.org/browser/wplegalpages/tags/3.5.1/admin/class-wp-legal-pages-admin.php#L114 - https://plugins.trac.wordpress.org/browser/wplegalpages/tags/3.5.1/admin/class-wp-legal-pages-admin.php#L138 - https://plugins.trac.wordpress.org/changeset/3385159/wplegalpages/trunk?contextall=1&old=3375554&old_path=%2Fwplegalpages%2Ftrunk