CVE-2025-2942

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jul 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-294207.5PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function.CVE-2025-294217.5PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function.CVE-2025-294255.5Code-projects Online Class and Exam Scheduling System 1.0 is vulnerable to SQL Injection in exam_save.php via the parameters member and firs CVE-2025-294264.6Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/class.php via the id and cy CVE-2025-294275.9Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in profile.php via the member_first a CVE-2025-294296.1Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/program.php via the id, cod CVE-2025-294304.1Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/room.php via the id and rom CVE-2025-294313.2Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/department.php via the id, CVE-2025-29446.4The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Button and Countdown Widgets CVE-2025-294487.5Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, caus CVE-2025-294496.5An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the link identification function.CVE-2025-29458.8Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with