Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-7667 State: PUBLISHED Published: 2025-07-15T11:20:04.307Z Last Updated: 2025-07-15T13:14:26.317Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: josxha Products: Restrict File Access Problem Types: CWE-352 Description: The Restrict File Access plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the 'restrict-file-access' page. This makes it possible for unauthenticated attackers to to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php), via a fo
server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php), via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e1105717-134b-48cc-960d-f78437c06793?source=cve - https://plugins.trac.wordpress.org/browser/restrict-file-access/trunk/admin/admin.php#L78
CVE ID: CVE-2025-7668 State: PUBLISHED Published: 2025-08-16T03:38:50.955Z Last Updated: 2025-08-18T13:41:00.740Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: timothyja Products: Linux Promotional Plugin Problem Types: CWE-352 Description: The Linux Promotional Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'inux-promotional-plugin.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an a
s and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8a3e3d91-5ce5-4db1-856e-c1d12471f9ed?source=cve - https://plugins.trac.wordpress.org/browser/linux-promotional-plugin/trunk/linux-promotional-plugin.php - https://wordpress.org/plugins/linux-promotional-plugin/
CVE ID: CVE-2025-7669 State: PUBLISHED Published: 2025-07-19T02:22:58.889Z Last Updated: 2025-07-21T16:55:19.602Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: avishika Products: Avishi WP PayPal Payment Button Problem Types: CWE-352 Description: The Avishi WP PayPal Payment Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the 'avishi-wp-paypal-payment-button/index.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site adminis
attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8416b394-28ae-41de-8784-2ae39f4d201f?source=cve - https://plugins.trac.wordpress.org/browser/avishi-wp-paypal-payment-button/trunk/index.php - https://wordpress.org/plugins/avishi-wp-paypal-payment-button/
CVE ID: CVE-2025-7670 State: PUBLISHED Published: 2025-08-19T07:26:27.112Z Last Updated: 2025-08-19T13:18:39.988Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: skatox Products: JS Archive List Problem Types: CWE-89 Description: The JS Archive List plugin for WordPress is vulnerable to time-based SQL Injection via the build_sql_where() function in all versions up to, and including, 6.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive
nticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72857d52-ac81-4eb2-93fa-7bb03265bccf?source=cve - https://plugins.trac.wordpress.org/browser/jquery-archive-list-widget/tags/6.1.5/classes/class-jq-archive-list-datasource.php - https://wordpress.org/plugins/jquery-archive-list-widget/#developers - https://github.com/Skatox/jquery-archive-list/commit/1c4a5749b187cc65d2c4b192b9c9890a36bf1fd2 - https://plugins.trac.wordpress.org/changeset/3341291/
CVE ID: CVE-2025-7672 State: PUBLISHED Published: 2025-07-15T07:23:20.499Z Last Updated: 2025-07-15T13:29:17.250Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: JiranSoft Products: CrossEditor4 Problem Types: CWE-79, CWE-276 Description: The improper default setting in JiranSoft CrossEditor4 on Windows, Linux, Unix (API modules) potentaily allows Stored XSS. This issue affects CrossEditor4: from 4.0.0.01 before 4.6.0.23. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.namoeditor.co.kr/crosseditor-summary
CVE ID: CVE-2025-7673 State: PUBLISHED Published: 2025-07-16T07:11:02.974Z Last Updated: 2025-07-19T03:55:18.953Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: VMG8825-T50K firmware Problem Types: CWE-120 Description: A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0 could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and potentially execute arbitrary code by sending a specially crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/service-provider/global/en/zyxel-
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/service-provider/global/en/zyxel-security-advisory-remote-code-execution-and-denial-service-vulnerabilities-cpe
CVE ID: CVE-2025-7674 State: PUBLISHED Published: 2025-08-05T16:53:05.316Z Last Updated: 2025-08-05T20:32:32.486Z Vendors: Roche Diagnostics Products: navify Monitoring Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Roche Diagnostics navify Monitoring allows an attacker to manipulate input data, which may lead to a denial of service (DoS) due to negatively impacting the server's performance. This vulnerability has no impact on data confidentiality or integrity. This issue affects navify Monitoring before 1.08.00. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://preview-owp.roche.com/content/dam/diagnostics/Blueprint/en/pdf/navify%20Monit
SA ADP Vulnrichment: References: - https://preview-owp.roche.com/content/dam/diagnostics/Blueprint/en/pdf/navify%20Monitoring%20-%20API%20Input%20Validation%20Vulnerability%20-%20Product%20Security%20Advisory.pdf
CVE ID: CVE-2025-7675 State: PUBLISHED Published: 2025-07-29T17:57:36.134Z Last Updated: 2025-09-25T18:38:48.179Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Shared Components, AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel Problem Types: CWE-787 Description: A maliciously crafted 3DM file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additio
bility to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0015
CVE ID: CVE-2025-7676 State: PUBLISHED Published: 2025-07-28T16:34:28.584Z Last Updated: 2025-07-28T17:18:40.248Z Vendors: Microsoft, Inc Products: Windows 11 Problem Types: CWE-427 Description: DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL in the same directory as the executable. Vulnerable versions of Windows 11 for ARM attempt to load Base DLLs that would ordinarily not be loaded from the application directory. Fixed in release 24H2, but present in all earlier versions of Windows 11 for ARM CPUs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githu
versions of Windows 11 for ARM CPUs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/refs/heads/main/2025-04.txt
CVE ID: CVE-2025-7677 State: PUBLISHED Published: 2025-08-11T18:36:23.850Z Last Updated: 2025-09-08T15:14:32.740Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ABB Products: Aspect Problem Types: CWE-120 Description: A denial-of-service (DoS) attack is possible if access to the local network is provided to unauthorized users. This is due to a buffer copy issue that may lead to a software crash. This issue affects all versions of ASPECT. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A4462&LanguageCode=en&DocumentPartId=pdf&Action=Launch
CVE ID: CVE-2025-7679 State: PUBLISHED Published: 2025-08-11T18:36:26.588Z Last Updated: 2025-09-04T00:35:39.266Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: Aspect Problem Types: CWE-306 Description: The ASPECT system allows users to bypass authentication. This issue affects all versions of ASPECT Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A4462&LanguageCode=en&DocumentPartId=pdf&Action=Launch
CVE ID: CVE-2025-7683 State: PUBLISHED Published: 2025-08-16T03:38:51.686Z Last Updated: 2025-08-18T13:35:07.502Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: janyksteenbeek Products: LatestCheckins Problem Types: CWE-352 Description: The LatestCheckins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. This is due to missing or incorrect nonce validation on the 'LatestCheckins' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a li
ipts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9b2b1500-04b6-40fb-8d1f-9c210f95788b?source=cve - https://plugins.trac.wordpress.org/browser/latestcheckins/trunk/wzw-admin.php - https://wordpress.org/plugins/latestcheckins/
CVE ID: CVE-2025-7684 State: PUBLISHED Published: 2025-08-16T03:38:48.319Z Last Updated: 2025-08-18T19:00:41.831Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: remysharp Products: Last.fm Recent Album Artwork Problem Types: CWE-352 Description: The Last.fm Recent Album Artwork plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the 'lastfm_albums_artwork.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into perform
settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3bf6671d-f481-4fe5-b966-2591ab76b0b5?source=cve - https://plugins.trac.wordpress.org/browser/lastfm-recent-album-artwork/trunk/lastfm_albums_artwork.php - https://wordpress.org/plugins/lastfm-recent-album-artwork/
CVE ID: CVE-2025-7685 State: PUBLISHED Published: 2025-07-22T09:22:43.582Z Last Updated: 2025-07-22T20:02:44.308Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: sflack Products: Like & Share My Site Problem Types: CWE-352 Description: The Like & Share My Site plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the 'lsms_admin' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a
cripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5f126296-0a6e-4d47-8f1a-ce2aa097f21d?source=cve - https://plugins.trac.wordpress.org/browser/like-share-my-site/trunk/lsms.php
CVE ID: CVE-2025-7686 State: PUBLISHED Published: 2025-08-16T03:38:53.603Z Last Updated: 2025-08-18T13:16:36.771Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: lmyoaoa Products: weichuncai(WP伪春菜) Problem Types: CWE-352 Description: The weichuncai(WP伪春菜) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the sm-options.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a lin
pts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fe46ec14-4795-4ac7-afd0-de92ccef877d?source=cve - https://plugins.trac.wordpress.org/browser/weichuncai/trunk/sm-options.php
CVE ID: CVE-2025-7687 State: PUBLISHED Published: 2025-07-22T09:22:42.217Z Last Updated: 2025-07-22T14:44:07.954Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: anop-goswami Products: Latest Post Accordian Slider Problem Types: CWE-352 Description: The Latest Post Accordian Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the 'lpaccordian' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action
inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/04a2c05a-11bb-450e-9ce9-783685730573?source=cve - https://plugins.trac.wordpress.org/browser/latest-post-accordian-slider/trunk/lpaccordian.php
CVE ID: CVE-2025-7688 State: PUBLISHED Published: 2025-08-15T08:25:38.743Z Last Updated: 2025-08-15T16:19:51.745Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: jason-lau Products: Add User Meta Problem Types: CWE-352 Description: The Add User Meta plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the 'add-user-meta' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1535a174-ab59-4c6e-8080-ef818e00b070?source=cve - https://plugins.trac.wordpress.org/browser/add-user-meta/trunk/plugin.php - https://wordpress.org/plugins/add-user-meta/
CVE ID: CVE-2025-7689 State: PUBLISHED Published: 2025-07-29T09:23:46.386Z Last Updated: 2025-07-29T13:41:31.529Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: themefic Products: Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings Problem Types: CWE-862 Description: The Hydra Booking plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the tfhb_reset_password_callback() function in versions 1.1.0 to 1.1.18. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the password of an Administrator user, achi
or authenticated attackers, with Subscriber-level access and above, to reset the password of an Administrator user, achieving full privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/93027dd1-f36a-4954-a8d2-b77bbbaef6fb?source=cve - https://wordpress.org/plugins/hydra-booking/#developers - https://plugins.trac.wordpress.org/changeset/3334439/
CVE ID: CVE-2025-7690 State: PUBLISHED Published: 2025-07-24T09:22:22.365Z Last Updated: 2025-07-24T13:05:34.655Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: mindnl Products: Affiliate Plus Problem Types: CWE-352 Description: The Affiliate Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation on the 'affiplus_settings' page. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP
an trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f3fc6230-043f-4079-a82a-1b5d191dbf7d?source=cve - https://plugins.trac.wordpress.org/browser/affiliate-plus/trunk/affipsettings.php - https://plugins.trac.wordpress.org/browser/affiliate-plus/trunk/affiplus.php - https://wordpress.org/plugins/affiliate-plus/
CVE ID: CVE-2025-7691 State: PUBLISHED Published: 2025-09-26T09:05:06.532Z Last Updated: 2025-09-27T03:55:25.291Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-267 Description: A privilege escalation issue has been discovered in GitLab EE affecting all versions from 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 that could have allowed a developer with specific group management permissions to escalate their privileges and obtain unauthorized access to additional system capabilities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/
ilities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/555786 - https://hackerone.com/reports/3200469
CVE ID: CVE-2025-7692 State: PUBLISHED Published: 2025-07-22T09:22:42.768Z Last Updated: 2025-07-22T13:20:49.176Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: gsayed786 Products: Orion Login with SMS Problem Types: CWE-288 Description: The Orion Login with SMS plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the olws_handle_verify_phone() function not utilizing a strong enough OTP value, exposing the hash needed to generate the OTP value, and no restrictions on the number of attempts to submit the code. This makes it possible for unauthenticated attackers to log in as other users, includ
er of attempts to submit the code. This makes it possible for unauthenticated attackers to log in as other users, including administrators, if they have access to their phone number. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/31a47cbd-c19b-4ac3-87ed-2d4c5c0e9cb7?source=cve - https://wordpress.org/plugins/orion-login-with-sms/
CVE ID: CVE-2025-7693 State: PUBLISHED Published: 2025-08-18T17:53:08.848Z Last Updated: 2025-08-18T18:05:39.060Z Vendors: Rockwell Automation Products: PLC - Micro850 L50E Problem Types: CWE-20 Description: A security issue exists due to improper handling of malformed CIP Forward Close packets during fuzzing. The controller enters a solid red Fault LED state and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and Fault LED become flashing red and reports fault code 0xF015. To recover, clear the fault. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/
Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1736.html
CVE ID: CVE-2025-7694 State: PUBLISHED Published: 2025-08-02T03:28:18.889Z Last Updated: 2025-08-04T15:19:17.956Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: WofficeIO Products: Woffice Core Problem Types: CWE-22 Description: The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_manager_delete() function in all versions up to, and including, 5.4.26. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-
rbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/41a362cf-e27e-436a-85f1-7c48e2e098eb?source=cve - https://hub.woffice.io/woffice/changelog - https://themeforest.net/item/woffice-intranetextranet-wordpress-theme/11671924
CVE ID: CVE-2025-7695 State: PUBLISHED Published: 2025-07-24T09:22:21.270Z Last Updated: 2025-07-24T13:13:39.837Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: alexacrm Products: Dataverse Integration Problem Types: CWE-862 Description: The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within its reset_password_link REST endpoint in versions 2.77 through 2.81. The endpoint’s handler accepts a client-supplied id, email, or login, looks up that user, and calls get_password_reset_key() unconditionally. Because it only checks that the caller is authenticated, and not that they own or may edit