CVE-2025-8680

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8680", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-06T18:49:06.064Z", "datePublished": "2025-08-15T02:24:23.123Z", "dateUpdated": "2026-04-08T17:14:47.839Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:47.839Z"}, "affected": [{"vendor": "bplugins", "product": "bSlider \u2013 Create Responsive Image, Post, Product, and Video Sliders", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Server-Side Request Forgery in version less than, or equal to, 2.0.0 via the fs_api_request function. This makes it possible for authenticated attackers, with subscriber-level access and above to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services."}], "title": "B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac245316-228e-4508-b3fe-f7071fb1bc8e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/b-slider/tags/1.1.30/bplugins_sdk/inc/Base/FSActivate.php#L166"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3343487%40b-slider&new=3343487%40b-slider&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "wesley"}], "timeline": [{"time": "2025-07-28T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-08-06T19:05:41.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-08-14T14:02:06.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-15T12:43:28.009741Z", "id": "CVE-2025-8680", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-15T12:43:33.637Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8680", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-15T12:43:28.009741Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-15T12:43:30.520Z"}}], "cna": {"title": "B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "wesley"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "bplugins", "product": "B Slider- Gutenberg Slider Block for WP", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-28T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-08-06T19:05:41.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-08-14T14:02:06.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac245316-228e-4508-b3fe-f7071fb1bc8e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/b-slider/tags/1.1.30/bplugins_sdk/inc/Base/FSActivate.php#L166"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3343487%40b-slider&new=3343487%40b-slider&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Server-Side Request Forgery in version less than, or equal to, 2.0.0 via the fs_api_request function. This makes it possible for authenticated attackers, with subscriber-level access and above to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-08-15T02:24:23.123Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8680", "state": "PUBLISHED", "dateUpdated": "2025-08-15T12:43:33.637Z", "dateReserved": "2025-08-06T18:49:06.064Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-15T02:24:23.123Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "bSlider \u2013 Create Responsive Image, Post, Product, and Video Sliders", "vendor": "bplugins", "versions": [{"lessThanOrEqual": "2.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Server-Side Request Forgery in version less than, or equal to, 2.0.0 via the fs_api_request function. This makes it possible for authenticated attackers, with subscriber-level access and above to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services."}, {"lang": "es", "value": "El complemento B Slider - Gutenberg Slider Block for WP para WordPress es vulnerable a Server-Side Request Forgery en versiones anteriores o iguales a la 2.0.0 mediante la funci\u00f3n fs_api_request. Esto permite a atacantes autenticados, con acceso de suscriptor o superior, realizar solicitudes web a ubicaciones arbitrarias desde la aplicaci\u00f3n web, las cuales pueden utilizarse para consultar y modificar informaci\u00f3n de servicios internos."}], "id": "CVE-2025-8680", "lastModified": "2026-06-17T10:07:25.857", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8680", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-15T12:43:28.009741Z", "version": "2.0.3"}}]}, "published": "2025-08-15T03:15:37.260", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/b-slider/tags/1.1.30/bplugins_sdk/inc/Base/FSActivate.php#L166"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3343487%40b-slider&new=3343487%40b-slider&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac245316-228e-4508-b3fe-f7071fb1bc8e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T22:03:34.249115+00:00", "value": {"mitigation_remediation": ["Upgrade the B Slider plugin to the latest release that removes the fs_api_request vulnerability", "If an update is unavailable, temporarily disable the B Slider plugin until a patch is released", "Restrict subscriber roles from executing the fs_api_request functionality by tightening capability checks or removing the relevant capabilities from subscriber roles"], "summary": {"action": "Patch ASAP", "impact": "Authenticated Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "The plugin bSlider supplied by bplugins is affected for all versions of the plugin up to and including 2.0.0 installed on WordPress sites. Any installation where the plugin is active and the vulnerable fs_api_request endpoint is reachable is susceptible, regardless of other plugins or themes.", "description_and_impact": "The vulnerability lies in the fs_api_request function of the B Slider \u2013 Gutenberg Slider Block for WP plugin, permitting an authenticated attacker with subscriber-level or higher permissions to initiate HTTP requests from the server to arbitrary URLs. This Server\u2011Side Request Forgery enables the attacker to probe, read, or modify data on internal services that the web application can reach, thereby potentially exposing sensitive information or altering system state. The weakness is classified as CWE\u2011918, a typical SSRF vulnerability.", "risk_and_exploitability": "The CVSS base score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests that exploitation is currently unlikely, with no listings in the CISA KEV catalog. Exploitation requires the attacker to be authenticated with subscriber-level or higher access, so the attack vector is through authenticated HTTP traffic directed at the plugin\u2019s API. An attacker who obtains such credentials can use the SSRF path to query internal endpoints, potentially leaking confidential data or disrupting internal services."}}}}, "created": "2025-08-15T07:47:39.823334+00:00", "updated": "2026-04-20T22:15:06.181944+00:00", "vendors": ["bplugins", "bplugins$PRODUCT$b_slider", "wordpress", "wordpress$PRODUCT$wordpress"]}