Publish Advisories

GHSA-2w3x-653c-q4pc
GHSA-4735-w7g7-ghx3
GHSA-q746-mv6h-3fx6
GHSA-w48v-4mqc-9p3w

advisories/unreviewed/2025/04/GHSA-2w3x-653c-q4pc/GHSA-2w3x-653c-q4pc.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2w3x-653c-q4pc",
-  "modified": "2025-04-22T03:30:26Z",
+  "modified": "2025-04-24T06:30:30Z",
   "published": "2025-04-22T03:30:26Z",
   "aliases": [
     "CVE-2025-1731"
@@ -22,6 +22,10 @@
     {
       "type": "WEB",
       "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-incorrect-permission-assignment-and-improper-privilege-management-vulnerabilities-in-usg-flex-h-series-firewalls-04-22-2025"
+    },
+    {
+      "type": "WEB",
+      "url": "http://seclists.org/fulldisclosure/2025/Apr/27"
     }
   ],
   "database_specific": {

advisories/unreviewed/2025/04/GHSA-4735-w7g7-ghx3/GHSA-4735-w7g7-ghx3.json

@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4735-w7g7-ghx3",
+  "modified": "2025-04-24T06:30:31Z",
+  "published": "2025-04-24T06:30:31Z",
+  "aliases": [
+    "CVE-2025-2558"
+  ],
+  "details": "The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perform LFI attacks and download arbitrary file from the server",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2558"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/6a8e1c89-a01d-4347-91fc-ba454784b153"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-24T06:15:45Z"
+  }
+}

advisories/unreviewed/2025/04/GHSA-q746-mv6h-3fx6/GHSA-q746-mv6h-3fx6.json

@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-q746-mv6h-3fx6",
+  "modified": "2025-04-24T06:30:31Z",
+  "published": "2025-04-24T06:30:31Z",
+  "aliases": [
+    "CVE-2025-1453"
+  ],
+  "details": "The Category Posts Widget WordPress plugin before 4.9.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1453"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/6bf93a34-a19f-4266-a95d-033551db43e6"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-24T06:15:43Z"
+  }
+}

advisories/unreviewed/2025/04/GHSA-w48v-4mqc-9p3w/GHSA-w48v-4mqc-9p3w.json

@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-w48v-4mqc-9p3w",
+  "modified": "2025-04-24T06:30:31Z",
+  "published": "2025-04-24T06:30:31Z",
+  "aliases": [
+    "CVE-2025-3435"
+  ],
+  "details": "The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the board_header and board_footer parameters in all versions up to, and including, 1.8.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3435"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3272163/mangboard/trunk"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5b97a2f7-b730-4fb7-a41e-dd37f5f87f27?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-24T04:15:49Z"
+  }
+}