Sec WriteUp ~ CVE Alert

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 13:59:25 +0100 *************** ✏️Title: CVE-2025-25146 | saleandro Songkick Concerts and Festivals Plugin up to 0.9.7 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.294964 *************** ⚙️Information: #Vendor: saleandro #Product: Songkick Concerts and Festivals Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 13:59:26 +0100 *************** ✏️Title: CVE-2025-25145 | jordan.hatch Infusionsoft Analytics Plugin up to 2.0 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.294965 *************** ⚙️Information: #Vendor: jordan.hatch #Product: Infusionsoft Analytics Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 13:59:27 +0100 *************** ✏️Title: CVE-2025-25069 | Apache Kvrocks up to 2.11.0 HTTP Request interpretation input *************** 📎Link: https://vuldb.com/?id.294966 *************** ⚙️Information: #Vendor: Apache #Product: Kvrocks #Risk: problematic #Local: No #Remote: Partially #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:04:22 +0100 *************** ✏️Title: CVE-2025-25106 | FancyWP Starter Templates Plugin up to 2.0.0 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.294967 *************** ⚙️Information: #Vendor: FancyWP #Product: Starter Templates Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:04:25 +0100 *************** ✏️Title: CVE-2025-25117 | Alex Polonski Smart Countdown FX Plugin up to 1.5.5 on WordPress cross site scripting *************** 📎Link: https://vuldb.com/?id.294968 *************** ⚙️Information: #Vendor: Alex Polonski #Product: Smart Countdown FX Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:04:28 +0100 *************** ✏️Title: CVE-2025-25136 | shujahat21 Optimate Ads Plugin up to 1.0.3 on WordPress cross site scripting *************** 📎Link: https://vuldb.com/?id.294969 *************** ⚙️Information: #Vendor: shujahat21 #Product: Optimate Ads Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:04:33 +0100 *************** ✏️Title: CVE-2025-25159 | robert_kolatzek WP doodlez Plugin up to 1.0.10 on WordPress cross site scripting *************** 📎Link: https://vuldb.com/?id.294970 *************** ⚙️Information: #Vendor: robert_kolatzek #Product: WP doodlez Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:08:05 +0100 *************** ✏️Title: CVE-2025-25075 | Venugopal Show Notice or Message on Admin Area Plugin up to 2.0 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.294971 *************** ⚙️Information: #Vendor: Venugopal #Product: Show Notice or Message on Admin Area Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:09:26 +0100 *************** ✏️Title: CVE-2025-25101 | MetricThemes Munk Sites Plugin up to 1.0.7 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.294972 *************** ⚙️Information: #Vendor: MetricThemes #Product: Munk Sites Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:09:26 +0100 *************** ✏️Title: CVE-2025-25103 | bnielsen Indeed API Plugin up to 0.5 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.294973 *************** ⚙️Information: #Vendor: bnielsen #Product: Indeed API Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:09:48 +0100 *************** ✏️Title: CVE-2025-25135 | Victor Barkalov Custom Links On Admin Dashboard Toolbar Plugin up to 3.3 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.294974 *************** ⚙️Information: #Vendor: Victor Barkalov #Product: Custom Links On Admin Dashboard Toolbar Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:10:14 +0100 *************** ✏️Title: CVE-2025-25093 | paulswarthout Child Themes Helper up to 2.2.7 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.294975 *************** ⚙️Information: #Vendor: paulswarthout #Product: Child Themes Helper #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:10:14 +0100 *************** ✏️Title: CVE-2025-25111 | WP Spell Check Plugin up to 9.21 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.294976 *************** ⚙️Information: #Product: WP Spell Check Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:10:15 +0100 *************** ✏️Title: CVE-2025-25138 | Rishi On Page SEO and Whatsapp Chat Button Plugin up to 2.0.0 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.294977 *************** ⚙️Information: #Vendor: Rishi #Product: On Page SEO and Whatsapp Chat Button Plugin #Type: Chat Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:10:16 +0100 *************** ✏️Title: CVE-2025-25104 | mraliende URL-Preview-Box Plugin up to 1.20 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.294978 *************** ⚙️Information: #Vendor: mraliende #Product: URL_Preview_Box Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:10:49 +0100 *************** ✏️Title: CVE-2025-25107 | sainwp OneStore Sites Plugin up to 0.1.1 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.294979 *************** ⚙️Information: #Vendor: sainwp #Product: OneStore Sites Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:10:52 +0100 *************** ✏️Title: CVE-2025-25143 | ibasit GlobalQuran Plugin up to 1.0 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.294980 *************** ⚙️Information: #Vendor: ibasit #Product: GlobalQuran Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:13:19 +0100 *************** ✏️Title: CVE-2025-25072 | thunderbax WP Admin Custom Page Plugin up to 1.5.0 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.294981 *************** ⚙️Information: #Vendor: thunderbax #Product: WP Admin Custom Page Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:13:20 +0100 *************** ✏️Title: CVE-2025-25128 | orlandolac Facilita Form Tracker Plugin up to 1.0 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.294982 *************** ⚙️Information: #Vendor: orlandolac #Product: Facilita Form Tracker Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 07 Feb 2025 14:14:37 +0100 *************** ✏️Title: CVE-2025-25074 | Nirmal Kumar Ram WP Social Stream Plugin up to 1.1 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.294983 *************** ⚙️Information: #Vendor: Nirmal Kumar Ram #Product: WP Social Stream Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security