CVE-2025-4578

The File Provider WordPress plugin (versions up to and including 1.2.3 ) is vulnerable to unauthenticated SQL injection . The root cause is the insufficient sanitization and escaping of the fileId parameter before its use in a SQL statement within an AJAX action. An unauthenticated attacker can a...

CVE-2025-4580

The File Provider WordPress plugin (versions 1.2.3 and earlier ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of CSRF checks when updating settings. An attacker could exploit this to force a logged-in administrator to modify plugin settings or delete items. As a worka...