CVE-2025-13001 — Vulnerability intelligence

kieranoshea — donations

Published: 2025-12-02T06:15:45.543

CVSS

4.1

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as admin to perform SQL injection attacks

Sources

• CVE-2025-13001
• Exploit, Third Party Advisory