8.5Alta

CVE-2025-22728WordPress Workreap (theme's plugin) plugin <= 3.3.6 - SQL Injection vulnerability

AmentoTech Workreap (theme's plugin) Publicada: 2026-01-08 12:17 (hace 10 meses)

Descripción

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows SQL Injection.This issue affects Workreap (theme's plugin): from n/a through <= 3.3.6.

Debilidad (CWE): CWE-89

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
AmentoTech	Workreap (theme's plugin)	≤ 3.3.6

Referencias y parches

https://patchstack.com/database/Wordpress/Plugin/workreap/vulnerability/wordpress-workreap-theme-s-plugin-plu… vdb-entry

Puntuación CVSS

8.5Alta

Fuente: Patchstack · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Bajos
Interacción del usuario: Ninguna
Alcance: Cambiado
Confidencialidad: Alto
Integridad: Ninguno
Disponibilidad: Bajo

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Todas las puntuaciones (2)

cna	CVSS 3.1	8.5Alta
audit@patchstack.com	CVSS 3.1	8.5Alta

EPSS (probabilidad de explotación en 30 días)

0.36%

superior al 30 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2025-01-07
Publicada2026-01-08 12:17
Llegó a IP-DB2026-10-25 00:01
Última actualización2026-10-07 12:10

Asignada por (CNA): Patchstack
Estado en NVD: Deferred

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — WordPress plugins & themes

6.5Media

CVE-2026-125796 hace 1 hora

WordPress JS Help Desk plugin <= 5.0.5 - Broken Access Control vulnerability

Ahmad JS Help Desk

Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 5.0.5.

7.1Alta

CVE-2026-125760 hace 1 hora

WordPress Bit Assist plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerability

Bit Apps Bit Assist

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bit Apps Bit Assist bit-assist allows DOM-Based XSS.This issue affects Bit Assist: from n/a through 1.8.4.

7.1Alta

CVE-2026-125804 hace 1 hora

WordPress AI Engine plugin <= 3.9.3 - Cross Site Scripting (XSS) vulnerability

Meow Apps AI Engine

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meow Apps AI Engine ai-engine allows Stored XSS.This issue affects AI Engine: from n/a through 3.9.3.

7.1Alta

CVE-2026-125818 hace 1 hora

WordPress wpDiscuz plugin <= 7.6.75 - Cross Site Scripting (XSS) vulnerability

AdvancedCoding wpDiscuz

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.75.

7.5Alta

CVE-2026-125823 hace 1 hora

WordPress Gutenverse plugin <= 4.2.2 - Denial of Service Attack vulnerability

Jegstudio Gutenverse

Allocation of Resources Without Limits or Throttling vulnerability in Jegstudio Gutenverse gutenverse allows HTTP DoS.This issue affects Gutenverse: from n/a through 4.2.2.

5.0Media

CVE-2026-125826 hace 1 hora

WordPress PowerPress Podcasting plugin <= 11.18.3 - Arbitrary File Deletion vulnerability

Blubrry Podcasting PowerPress Podcasting

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Path Traversal.This issue affects PowerPress Podcasting: from n/a through 11.18.3.