CVE-2025-10638

MediumCVSS 5.3/10Last modified Oct 8, 2026

Description

The NS Maintenance Mode for WP WordPress plugin through 1.3.1 lacks authorization in its subscriber export function allowing unauthenticated attackers to download a list of a site's subscribers containing their name and email address

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Oct 22, 2025
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-106398.8The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An att CVE-2025-10645.4The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_CVE-2025-106409.8An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side authentication checks t CVE-2025-106417.1All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker wi CVE-2025-106423.5A vulnerability has been found in wangchenyi1996 chat_forum up to 80bdb92f5b460d36cab36e530a2c618acef5afd2. This impacts an unknown function CVE-2025-106439.1Wondershare Repairit Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypa CVE-2025-106449.4Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attacke CVE-2025-106455.3The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.05 via the WF_Lice CVE-2025-106464.3The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient capability check on the Bas CVE-2025-106478.8The Embed PDF for WPForms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_handl CVE-2025-106485.3The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabili CVE-2025-106496.5The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection via the cookie in all versions up to, and including, 2.11.21 due