PT-2025-42300 · WordPress · Wp Jquery Pager

Peter Thaleikis · Published 2025-10-15 · Updated 2025-10-15 · CVE-2025-10575

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP jQuery Pager plugin versions through 1.4.0

Description The WP jQuery Pager plugin for WordPress is susceptible to SQL Injection through the 'ids' shortcode attribute parameter. This is due to inadequate escaping of user-supplied input and insufficient preparation of the existing SQL query within the WPJqueryPaged::get gallery page imgs() function. Authenticated attackers with Contributor-level access or higher can append additional SQL queries to existing ones, potentially extracting sensitive information from the database.

Recommendations Update the WP jQuery Pager plugin to a version newer than 1.4.0.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10575

Affected Products

Wp Jquery Pager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-10575 · Security Note
• https://twitter.com/CVEnew/status/1978562036482130167 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-jquery-pdf-paged/trunk/wp-jquery-paged.php#L80 · Note
• https://t.me/CVEtracker/34977 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1978440616984936484 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3a70b64b-a0e8-4b5c-af05-cf8f1d611dec?source=cve · Note