Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-12018 State: PUBLISHED Published: 2025-11-12T07:27:41.747Z Last Updated: 2025-11-12T18:13:13.575Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: sourcefound Products: MembershipWorks – Membership, Events & Directory Problem Types: CWE-79 Description: The MembershipWorks – Membership, Events & Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execu
ated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7cd412d8-6d14-4803-aae6-087e02f9d75f?source=cve - https://wordpress.org/plugins/memberfindme/ - https://github.com/zast-ai/vulnerability-reports/blob/main/wordpress/plugin/memberfindme/stored-xss.md - https://plugins.trac.wordpress.org/browser/memberfindme/tags/6.14/memberfindme.php#L103 - https://plugins.tr
ed-xss.md - https://plugins.trac.wordpress.org/browser/memberfindme/tags/6.14/memberfindme.php#L103 - https://plugins.trac.wordpress.org/browser/memberfindme/tags/6.14/memberfindme.php#L437 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3393026%40memberfindme&new=3393026%40memberfindme&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12019 State: PUBLISHED Published: 2025-11-11T03:30:52.841Z Last Updated: 2025-11-12T20:04:21.753Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: mervinpraison Products: Featured Image Problem Types: CWE-79 Description: The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects mul
inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fa16605a-12bd-48a8-b9a9-db53bf3c2c39?source=cve - https://wordpress.org/plugins/featured-image/ - https://github.com/zast-ai/vulnerability-reports/blob/main/wordpress/plugin/featured-image/stored-xss.md - https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L26 - https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-ima
-image/tags/2.1/featured-image.php#L26 - https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L35 - https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L65
CVE ID: CVE-2025-12020 State: PUBLISHED Published: 2025-11-11T03:30:41.188Z Last Updated: 2025-11-12T20:06:16.441Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kanwei_doublethedonation Products: Double the Donation – A workplace giving tool Problem Types: CWE-79 Description: The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbit
ing. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/63ba2d29-26dc-4c5f-9d9d-9a13e25c44b9?source=cve - https://wordpress.org/plugins/double-the-donation/ - https://plugins.trac.wordpress.org/browser/double-the-donation/tags/2.0.0/doublethedonation.php#L59 - https://plugins.trac.wordpress.org/browser/double-the-donation/
uble-the-donation/tags/2.0.0/doublethedonation.php#L59 - https://plugins.trac.wordpress.org/browser/double-the-donation/tags/2.0.0/doublethedonation.php#L79
CVE ID: CVE-2025-12021 State: PUBLISHED Published: 2025-11-11T03:30:41.928Z Last Updated: 2025-11-12T20:06:04.257Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: hectavex Products: WP-OAuth Problem Types: CWE-79 Description: The WP-OAuth plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analys
at execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72702870-8a1a-446b-8f9f-bd435e9257f2?source=cve - https://plugins.trac.wordpress.org/browser/wp-oauth/tags/0.4.1/login-google.php#L42 - https://plugins.trac.wordpress.org/browser/wp-oauth/tags/0.4.1/wp-oauth.php#L430 - https://plugins.trac.wordpress.org/browser/wp-oauth/tags/0.4.1/wp-oauth.php#L545
CVE ID: CVE-2025-12022 State: PUBLISHED Published: 2025-11-21T05:32:06.379Z Last Updated: 2025-11-21T14:58:31.374Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: elextensions Products: ELEX WordPress HelpDesk & Customer Ticketing System Problem Types: CWE-862 Description: The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_settings_restore_trash' AJAX endpoint in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to restore all deleted tickets. Addition
t possible for authenticated attackers, with Subscriber-level access and above, to restore all deleted tickets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/982b23c5-2414-48f7-a2f5-96fef54f8d69?source=cve - https://plugins.trac.wordpress.org/changeset/3399391/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-archive-ajax-functions.php
CVE ID: CVE-2025-12023 State: PUBLISHED Published: 2025-11-21T05:32:05.530Z Last Updated: 2025-11-21T14:58:42.480Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: elextensions Products: ELEX WordPress HelpDesk & Customer Ticketing System Problem Types: CWE-862 Description: The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_crm_restore_data() function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to restore tickets. Additional Analyst Notes: - CISA AD
authenticated attackers, with Subscriber-level access and above, to restore tickets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4599b145-cb89-48d4-8581-e1ee7a7bd323?source=cve - https://plugins.trac.wordpress.org/changeset/3399391/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-ajax-functions.php
CVE ID: CVE-2025-12024 State: REJECTED Published: N/A Last Updated: 2025-10-21T15:33:33.985Z Description: No description available.
CVE ID: CVE-2025-12025 State: PUBLISHED Published: 2025-11-25T07:28:23.149Z Last Updated: 2025-11-25T07:28:23.149Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: mahabubs Products: YouTube Subscribe Problem Types: CWE-79 Description: The YouTube Subscribe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects
to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9996cdc7-4d97-4b27-b697-09bbdbcd865d?source=cve - https://wordpress.org/plugins/easy-youtube-subscribe/ - https://plugins.trac.wordpress.org/browser/easy-youtube-subscribe/tags/3.0.0/includes/sm-youtube-subscription-shortcode.php#L242 - https://plugins.trac.wordpress.org/browser/easy-youtube-subscribe/tags/3.0.0/includes/sm-youtube-subscription-shortcode.php#L246
CVE ID: CVE-2025-12028 State: PUBLISHED Published: 2025-10-24T08:23:58.518Z Last Updated: 2025-10-24T12:31:06.184Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: indieweb Products: IndieAuth Problem Types: CWE-352 Description: The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the `login_form_indieauth()` function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for unauthenticated attackers to force authenticated users to approve OAuth authorization requests for attacker-controlled applications via a for
kers to force authenticated users to approve OAuth authorization requests for attacker-controlled applications via a forged request granted they can trick a user into performing an action such as clicking on a link or visiting a malicious page while logged in. The attacker can then exchange the stolen authorization code for an access token, effectively taking over the victim's account with the granted scopes (create, update, delete). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/42b373da-d5a6-4e3b-90f4-059da3641841?source=cve - https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-
90f4-059da3641841?source=cve - https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L411 - https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L418 - https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L476
CVE ID: CVE-2025-12031 State: PUBLISHED Published: 2025-10-21T17:22:36.176Z Last Updated: 2025-10-21T18:17:10.703Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-1004 Description: HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute may allow reading the sensitive cookies from the javascript contextThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12032 State: PUBLISHED Published: 2025-11-25T07:28:19.855Z Last Updated: 2025-11-25T07:28:19.855Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: vithanhlam Products: Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile Problem Types: CWE-79 Description: The Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vithanhlam_zsocial_save_messager’, 'vithanhlam_zsocial_save_zalo', 'vithanhlam_zsocial_save_hotline', and 'vithanhlam_zsocial_save_contact' parameters in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible
versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/26d12c52-d08f-4a6c-ba59-0e26dfb33ae5?source=cve - https://wordpress.org/plugins/zweb-social-mobile/
CVE ID: CVE-2025-12033 State: PUBLISHED Published: 2025-10-22T06:40:58.636Z Last Updated: 2025-10-22T13:32:15.279Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: rpetersen29 Products: Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website Problem Types: CWE-79 Description: The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pro_version_activation_code' parameter in all versions up to, and including, 3.0.10 due to insufficient input sanitization and output escap
ion_code' parameter in all versions up to, and including, 3.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9b620481-8f45-4616-9b22-2dd14733325c?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3363618%40simple-banner&new=3363
=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3363618%40simple-banner&new=3363618%40simple-banner&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12034 State: PUBLISHED Published: 2025-10-25T06:49:20.557Z Last Updated: 2025-10-27T15:54:50.525Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: alignak Products: Fast Velocity Minify Problem Types: CWE-79 Description: The Fast Velocity Minify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only aff
ove, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1c02e03a-7f96-4efa-9071-4a76fb21900d?source=cve - https://github.com/peixotorms/fast-velocity-minify/commit/55a8b53a2ec6d358f8d7ad181170b9d8112e78ab - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3383015%40fast-velocity-minify&new=3383015%40fast-velocity-minify&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12036 State: PUBLISHED Published: 2025-11-06T22:24:32.370Z Last Updated: 2025-11-08T04:55:14.335Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/452296415
CVE ID: CVE-2025-12038 State: PUBLISHED Published: 2025-11-01T05:40:23.582Z Last Updated: 2025-11-03T13:31:10.279Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpfolderly Products: Folderly Problem Types: CWE-863 Description: The Folderly plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the /wp-json/folderly/v1/config/clear-all-data REST API endpoint in all versions up to, and including, 0.3. This makes it possible for authenticated attackers, with Author-level access and above, to clear all data like terms and categories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
above, to clear all data like terms and categories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/81d43850-c6aa-4340-a0e0-41e04e958848?source=cve - https://plugins.trac.wordpress.org/changeset/3384176/folderly/trunk/includes/Rest#file0
CVE ID: CVE-2025-12039 State: PUBLISHED Published: 2025-11-21T08:28:11.703Z Last Updated: 2025-11-24T18:01:18.721Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: devsmip Products: BigBuy Dropshipping Connector for WooCommerce Problem Types: CWE-200 Description: The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 2.0.5 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to retrieve the output of phpinfo(). Additional Analyst Notes: - CISA ADP Vulnri
possible for unauthenticated attackers to retrieve the output of phpinfo(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/19a3d5a5-4673-41e7-9868-99699852f330?source=cve - https://plugins.trac.wordpress.org/browser/bigbuy-wc-dropshipping-connector/tags/2.0.5/src/Controller/ApiController.php#L225 - https://plugins.trac.wordpress.org/browser/bigbuy-wc-dropshipping-connector/tags/2.0.5/src/Controller/ApiController.php#L260
CVE ID: CVE-2025-12040 State: PUBLISHED Published: 2025-11-25T07:28:21.014Z Last Updated: 2025-11-25T07:28:21.014Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: themehunk Products: Wishlist for WooCommerce Problem Types: CWE-639 Description: The Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.9 via several functions in class-th-wishlist-frontend.php due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to modify other user's wishlists References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d7c8f79-4df
rs to modify other user's wishlists References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d7c8f79-4dfd-4d6f-b533-dc7a5998dfc1?source=cve - https://wordpress.org/plugins/th-wishlist/
CVE ID: CVE-2025-12041 State: PUBLISHED Published: 2025-10-31T09:27:20.353Z Last Updated: 2025-10-31T18:43:16.544Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: apos37 Products: ERI File Library Problem Types: CWE-862 Description: The ERI File Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'erifl_file' AJAX action in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download files restricted to specific user roles. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/16e1d3
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/16e1d37a-4eb7-45dc-8993-a501fb2aaf73?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3385895%40eri-file-library&new=3385895%40eri-file-library
CVE ID: CVE-2025-12042 State: PUBLISHED Published: 2025-11-08T03:27:46.819Z Last Updated: 2025-11-10T17:22:37.226Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: werbeagenturcommotion Products: Course Booking System Problem Types: CWE-862 Description: The Course Booking System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in the csv-export.php file in all versions up to, and including, 6.1.5. This makes it possible for unauthenticated attackers to directly access the file and obtain an export of all booking data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/t
export of all booking data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/38b2b477-5b8a-42c2-b346-57707d9a34a5?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389366%40course-booking-system&new=3389366%40course-booking-system&sfp_email=&sfph_mail=#file86
CVE ID: CVE-2025-12043 State: PUBLISHED Published: 2025-11-25T07:28:18.304Z Last Updated: 2025-11-25T07:28:18.304Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: autochat Products: Autochat Automatic Conversation Problem Types: CWE-862 Description: The Autochat Automatic Conversation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_auycht_saveCid' AJAX endpoint in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to connect and disconnect the client ID. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/089b3a1b-0
connect and disconnect the client ID. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/089b3a1b-0f4b-4ba5-85d8-c1f6b74fe7eb?source=cve - https://wordpress.org/plugins/auyautochat-for-wp/
CVE ID: CVE-2025-12044 State: PUBLISHED Published: 2025-10-23T19:15:16.567Z Last Updated: 2025-10-23T20:00:16.601Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-770 Description: Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [+HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393] which allowed for processing JSON payloads before applying rate limits. This vulnerability, CVE-2025-12044, is fixed in Vau
ch allowed for processing JSON payloads before applying rate limits. This vulnerability, CVE-2025-12044, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-31-vault-vulnerable-to-denial-of-service-due-to-rate-limit-regression/76710