CVE-2025-10575

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10575", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-16T18:39:03.867Z", "datePublished": "2025-10-15T08:25:53.166Z", "dateUpdated": "2026-04-08T16:47:00.382Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:00.382Z"}, "affected": [{"vendor": "ivycat", "product": "WP jQuery Pager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP jQuery Pager plugin for WordPress is vulnerable to SQL Injection via the 'ids' shortcode attribute parameter handled by the WPJqueryPaged::get_gallery_page_imgs() function in all versions up to, and including, 1.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "WP jQuery Pager <= 1.4.0 - Authenticated (Contributor+) SQL Injection via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3a70b64b-a0e8-4b5c-af05-cf8f1d611dec?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-jquery-pdf-paged/trunk/wp-jquery-paged.php#L80"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "timeline": [{"time": "2025-10-14T19:45:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-24T20:29:44.932157Z", "id": "CVE-2025-10575", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T20:29:49.520Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10575", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-24T20:29:44.932157Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-15T19:41:09.253Z"}}], "cna": {"title": "WP jQuery Pager <= 1.4.0 - Authenticated (Contributor+) SQL Injection via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "ivycat", "product": "WP jQuery Pager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-14T19:45:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3a70b64b-a0e8-4b5c-af05-cf8f1d611dec?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-jquery-pdf-paged/trunk/wp-jquery-paged.php#L80"}], "descriptions": [{"lang": "en", "value": "The WP jQuery Pager plugin for WordPress is vulnerable to SQL Injection via the 'ids' shortcode attribute parameter handled by the WPJqueryPaged::get_gallery_page_imgs() function in all versions up to, and including, 1.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:00.382Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10575", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:47:00.382Z", "dateReserved": "2025-09-16T18:39:03.867Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-15T08:25:53.166Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP jQuery Pager", "vendor": "ivycat", "versions": [{"lessThanOrEqual": "1.4.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP jQuery Pager plugin for WordPress is vulnerable to SQL Injection via the 'ids' shortcode attribute parameter handled by the WPJqueryPaged::get_gallery_page_imgs() function in all versions up to, and including, 1.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin WP jQuery Pager para WordPress es vulnerable a inyecci\u00f3n SQL a trav\u00e9s del par\u00e1metro de atributo del shortcode 'ids' manejado por la funci\u00f3n WPJqueryPaged::get_gallery_page_imgs() en todas las versiones hasta la 1.4.0, inclusive, debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, a\u00f1adan consultas SQL adicionales en consultas ya existentes que pueden ser utilizadas para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2025-10575", "lastModified": "2026-10-08T12:10:00.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10575", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-24T20:29:44.932157Z", "version": "2.0.3"}}]}, "published": "2025-10-15T09:15:40.740", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-jquery-pdf-paged/trunk/wp-jquery-paged.php#L80"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3a70b64b-a0e8-4b5c-af05-cf8f1d611dec?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:08:30.198936+00:00", "value": {"mitigation_remediation": ["Upgrade WP jQuery Pager to the latest version (1.4.1 or newer) to eliminate the injection vector.", "If an immediate upgrade is not feasible, disable the plugin or remove all instances of the 'ids' shortcode from content and restrict its usage to trusted users only.", "Restrict Contributor-level accounts to trusted personnel, apply least\u2011privilege access controls, and audit user roles to prevent malicious use of the injection point."], "summary": {"action": "Apply patch", "impact": "SQL Injection with potential data leakage for authenticated users"}, "threat_synthesis": {"affected_systems": "All WordPress sites that have installed Ivycat\u2019s WP jQuery Pager plugin version 1.4.0 or earlier are vulnerable. The plugin is available through the WordPress plugin repository, and any site running these versions should be examined.", "description_and_impact": "The WP jQuery Pager plugin contains a vulnerability that allows an authenticated user with Contributor level or higher to inject arbitrary SQL via the 'ids' attribute in the shortcode handler. This flaw stems from insufficient escaping of the user supplied parameter and the lack of prepared statements, enabling attackers to append additional queries to the existing statement. Such an injection can result in the extraction of sensitive database information, exposing user credentials, site content, or other confidential data. The official CVSS score of 6.5 indicates a moderate severity with significant potential impact on confidentiality and integrity.", "risk_and_exploitability": "The risk of exploitation is characterized by a moderate CVSS rating of 6.5 and a very low EPSS probability of less than 1%, meaning the vulnerability is unlikely to be widely exploited at present. However, the flaw is not included in CISA\u2019s KEV catalog, which suggests no known active exploitation. Attackers would need authenticated Contributor-level access and would typically perform the injection by inserting a malicious shortcode in a post or page. Successful exploitation leads to arbitrary SQL execution and data exfiltration, with full database compromise as the potential worst\u2011case outcome."}}}}, "created": "2025-10-21T09:41:10.001317+00:00", "updated": "2026-04-22T14:15:20.401345+00:00", "vendors": ["ivycat", "ivycat$PRODUCT$wp_jquery_pager", "wordpress", "wordpress$PRODUCT$wordpress"]}