PT-2025-33712 · WordPress · Js Archive List

Michael Mazzolini · Published 2025-08-19 · Updated 2025-08-24 · CVE-2025-7670

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: JS Archive List plugin for WordPress versions up to and including 6.1.5

Description: The JS Archive List plugin for WordPress is susceptible to time-based SQL Injection through the build sql where() function. This is due to insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries. This allows unauthenticated attackers to append additional SQL queries to existing queries, potentially enabling the extraction of sensitive information from the database.

Recommendations: Update the JS Archive List plugin to a version later than 6.1.5.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-7670

Affected Products

Js Archive List

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-7670 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7670 · Vendor Advisory
• https://github.com/Skatox/jquery-archive-list/commit/1c4a5749b187cc65d2c4b192b9c9890a36bf1fd2 · Note
• https://twitter.com/VulmonFeeds/status/1957726104359166053 · Twitter Post
• https://twitter.com/CVEnew/status/1957710063981982167 · Twitter Post
• https://wordpress.org/plugins/jquery-archive-list-widget/#developers · Note
• https://plugins.trac.wordpress.org/browser/jquery-archive-list-widget/tags/6.1.5/classes/class-jq-archive-list-datasource.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/72857d52-ac81-4eb2-93fa-7bb03265bccf?source=cve · Note
• https://twitter.com/cracbot/status/1959571435476914401 · Twitter Post
• https://t.me/cveNotify/132763 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3341291 · Note
• https://t.me/CVEtracker/30337 · Telegram Post