CVE-2025-12502

MediumCVSS 6.8/10Last modified Oct 19, 2026

Description

The attention-bar WordPress plugin through 0.7.2.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users such as administrator to perform SQL injection attacks

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Nov 20, 2025
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-125036.5EasyFlow .NET and EasyFlow AiNet developed by Digiwin has a SQL Injection vulnerability, allowing authenticated remote attackers to inject aCVE-2025-125049.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talent Software UNIS allows SQL InjectCVE-2025-125055.4The weDocs plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.1.14. This is due to the pluginCVE-2025-125064.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 tCVE-2025-125078.8The service Bizerba Communication Server (BCS) has an unquoted service path. Due to the way Windows searches the executable for the BCS servCVE-2025-125088.4When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of aCVE-2025-125098.4On a client with an admin user, a Global_Shipping script can be implemented. The script could later be executed on the BRAIN2 server with adCVE-2025-125107.2The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.CVE-2025-125114.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM CVE-2025-125124.3The GenerateBlocks plugin for WordPress is vulnerable to information exposure due to missing object-level authorization checks in versions uCVE-2025-125134.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (HostCVE-2025-125147.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring - Open-ticke