CVE-2025-13597

AI Feeds = 1.0.11 - 인증되지 않은 임의 파일 업로드 AI Feeds WordPress 플러그인 1.0.11 이하 버전에는 actualizadorgit.php 파일에 인증되지 않은 원격 코드 실행 취약점이 존재합니다. 이 파일은 인증이나 권한 확인 없이 HTTP로 직접 접근할 수 있어, 인증되지 않은 공격자가 임의의 GitHub 저장소를 다운로드하고 플러그인 파일을 덮어써 원격 코드 실행을 유발할 수 있습니다. TL;DR 익스플로잇 CVE-2025-13597.py는 원격 공격자가 shell.php를 업로드하고 원...

CVE-2025-14030

The AI Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aifepostmeta' shortcode in all versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2025-14030

CVE-2025-14030 affects the WordPress AI Feeds plugin. Wordfence catalogs a Stored XSS via the aife_post_meta shortcode in versions up to 1.0.22, exploitable by authenticated users with Contributor-level access or higher. The CVSS from the report is 6.4 (Medium) with network attack vector and low ...

CVE-2025-14030 AI Feeds <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aife_post_meta' Shortcode

The AI Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aifepostmeta' shortcode in all versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2025-14030 AI Feeds <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aife_post_meta' Shortcode

The AI Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aifepostmeta' shortcode in all versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

WordPress AI Feeds plugin <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aife_post_meta' Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'aifepostmeta' Shortcode vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin AI Feeds versions = 1.0.22...

PT-2025-50923

The AI Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aife post meta' shortcode in all versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-14030: Improper Neutralization of Input During Web Page Generation

The AI Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aifepostmeta' shortcode in all versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

WordPress plugin AI Feeds 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...

📄 AI Plugins 1.10.9 Shell Upload

This Metasploit module exploits unauthenticated arbitrary file upload vulnerabilities in multiple WordPress AI plugins including Cibeles AI, AI Feeds, and AI Buddy. The vulnerabilities allow attackers to upload PHP webshells via GitHub integration functionality...

WordPress AI Feeds plugin arbitrary file upload vulnerability

WordPress AI Feeds plugin is an open source software that is mainly used to generate and manage feeds for blogs. WordPress AI Feeds plugin suffers from an arbitrary file upload vulnerability that stems from the application's lack of effective validation of uploaded files. The vulnerability can be...

WordPress AI Feeds plugin <= 1.0.11 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Ryan Kozak in WordPress Plugin AI Feeds versions = 1.0.11...

EUVD-2025-199660

The AI Feeds plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizadorgit.php' file in all versions up to, and including, 1.0.11. This makes it possible for unauthenticated attackers to download arbitrary GitHub repositories and overwrite...

CVE-2025-13597 AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload

The AI Feeds plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizadorgit.php' file in all versions up to, and including, 1.0.11. This makes it possible for unauthenticated attackers to download arbitrary GitHub repositories and overwrite...

Exploit for CVE-2025-13597

AI Feeds extractTo$extractDir; $rootInsideZip = $extractD...

WordPress plugin AI Feeds 代码问题漏洞

WordPress AI Feeds plugin is an open source software that is mainly used to generate and manage feeds for blogs. WordPress AI Feeds plugin suffers from an arbitrary file upload vulnerability that stems from the application's lack of effective validation of uploaded files. The vulnerability can be...

PT-2025-48094

Name of the Vulnerable Software and Affected Versions AI Feeds plugin for WordPress versions through 1.0.11 Description The AI Feeds plugin for WordPress is susceptible to arbitrary file uploads because of a missing capability check in the actualizador git.php file. This allows unauthenticated...

CVE-2025-13597: Unrestricted Upload of File with Dangerous Type

The AI Feeds plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizadorgit.php' file in all versions up to, and including, 1.0.11. This makes it possible for unauthenticated attackers to download arbitrary GitHub repositories and overwrite...