PT-2025-42300 · WordPress · Wp Jquery Pager

Peter Thaleikis · Publicado 2025-10-15 · Atualizado 2025-10-15 · CVE-2025-10575

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP jQuery Pager plugin versions through 1.4.0

Description The WP jQuery Pager plugin for WordPress is susceptible to SQL Injection through the 'ids' shortcode attribute parameter. This is due to inadequate escaping of user-supplied input and insufficient preparation of the existing SQL query within the WPJqueryPaged::get gallery page imgs() function. Authenticated attackers with Contributor-level access or higher can append additional SQL queries to existing ones, potentially extracting sensitive information from the database.

Recommendations Update the WP jQuery Pager plugin to a version newer than 1.4.0.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-10575

Produtos afetados

Wp Jquery Pager

Referências · 6

• https://twitter.com/CVEnew/status/1978562036482130167 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/wp-jquery-pdf-paged/trunk/wp-jquery-paged.php#L80 · Nota
• https://t.me/CVEtracker/34977 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1978440616984936484 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-10575 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/3a70b64b-a0e8-4b5c-af05-cf8f1d611dec?source=cve · Nota