From f8a7154c79ff018818827f553933682f452ea642 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 11 Jun 2025 06:33:19 +0000 Subject: [PATCH] Publish Advisories GHSA-25ff-vj4q-r6hf GHSA-qm4v-488r-489w GHSA-xj4j-7mrg-84hq --- .../GHSA-25ff-vj4q-r6hf.json | 52 +++++++++++++++++++ .../GHSA-qm4v-488r-489w.json | 48 +++++++++++++++++ .../GHSA-xj4j-7mrg-84hq.json | 52 +++++++++++++++++++ 3 files changed, 152 insertions(+) create mode 100644 advisories/unreviewed/2025/06/GHSA-25ff-vj4q-r6hf/GHSA-25ff-vj4q-r6hf.json create mode 100644 advisories/unreviewed/2025/06/GHSA-qm4v-488r-489w/GHSA-qm4v-488r-489w.json create mode 100644 advisories/unreviewed/2025/06/GHSA-xj4j-7mrg-84hq/GHSA-xj4j-7mrg-84hq.json diff --git a/advisories/unreviewed/2025/06/GHSA-25ff-vj4q-r6hf/GHSA-25ff-vj4q-r6hf.json b/advisories/unreviewed/2025/06/GHSA-25ff-vj4q-r6hf/GHSA-25ff-vj4q-r6hf.json new file mode 100644 index 00000000000..5fe5a4a233b --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-25ff-vj4q-r6hf/GHSA-25ff-vj4q-r6hf.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-25ff-vj4q-r6hf", + "modified": "2025-06-11T06:31:01Z", + "published": "2025-06-11T06:31:01Z", + "aliases": [ + "CVE-2025-4666" + ], + "details": "The Zotpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nickname’ parameter in all versions up to, and including, 7.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4666" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/zotpress/trunk/lib/admin/admin.accounts.php#L86" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/zotpress/trunk/lib/admin/admin.functions.php#L66" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/zotpress/trunk/lib/admin/admin.options.form.php#L33" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/zotpress/trunk/lib/admin/admin.options.form.php#L35" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1058078b-3afa-4fe7-913a-b6fc32252bf6?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-11T04:15:53Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-qm4v-488r-489w/GHSA-qm4v-488r-489w.json b/advisories/unreviewed/2025/06/GHSA-qm4v-488r-489w/GHSA-qm4v-488r-489w.json new file mode 100644 index 00000000000..e2cefbcd0f0 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-qm4v-488r-489w/GHSA-qm4v-488r-489w.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qm4v-488r-489w", + "modified": "2025-06-11T06:31:01Z", + "published": "2025-06-11T06:31:01Z", + "aliases": [ + "CVE-2025-4798" + ], + "details": "The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.68.10. This is due to a lack of restriction on the directory an administrator can select for storing downloads. This makes it possible for authenticated attackers, with Administrator-level access and above, to download and read any file on the server, including system and configuration files.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4798" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-options.php#L16" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-options.php#L42" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3294467" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6cd166bc-774e-4083-b5f7-bffba1f7c293?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-11T04:15:58Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-xj4j-7mrg-84hq/GHSA-xj4j-7mrg-84hq.json b/advisories/unreviewed/2025/06/GHSA-xj4j-7mrg-84hq/GHSA-xj4j-7mrg-84hq.json new file mode 100644 index 00000000000..5bca06f6fec --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-xj4j-7mrg-84hq/GHSA-xj4j-7mrg-84hq.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xj4j-7mrg-84hq", + "modified": "2025-06-11T06:31:01Z", + "published": "2025-06-11T06:31:01Z", + "aliases": [ + "CVE-2025-4799" + ], + "details": "The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can be deleted from in all versions up to, and including, 1.68.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability can be paired with CVE-2025-4798 to delete any file within the WordPress root directory.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4799" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-manager.php#L215" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-options.php#L16" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-options.php#L42" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3294467" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f9d9e485-171f-4e36-943d-397d540e31f4?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-36" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-11T04:15:59Z" + } +} \ No newline at end of file