CVE-2025-10635

HighCVSS 7.7/10Last modified Oct 8, 2026

Description

The Find Me On WordPress plugin through 2.0.9.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers and above to perform SQL injection attacks

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Oct 8, 2025
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-106363.5The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high priv CVE-2025-106375.3The Social Feed Gallery plugin for WordPress is vulnerable to Information Exposure in versions less than, or equal to, 4.9.2. This is due to CVE-2025-106385.3The NS Maintenance Mode for WP WordPress plugin through 1.3.1 lacks authorization in its subscriber export function allowing unauthenticated CVE-2025-106398.8The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An att CVE-2025-10645.4The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_CVE-2025-106409.8An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side authentication checks t CVE-2025-106417.1All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker wi CVE-2025-106423.5A vulnerability has been found in wangchenyi1996 chat_forum up to 80bdb92f5b460d36cab36e530a2c618acef5afd2. This impacts an unknown function CVE-2025-106439.1Wondershare Repairit Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypa CVE-2025-106449.4Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attacke CVE-2025-106455.3The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.05 via the WF_Lice CVE-2025-106464.3The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient capability check on the Bas