CVE-2025-10682

The TARIFFUXX plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4. This is due to insufficient neutralization of user-supplied input used directly in SQL queries. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject additional SQL into queries and extract sensitive information from the database via a crafted id attribute in the 'tariffuxx_configurator' shortcode.

• CWE-89

• https://plugins.trac.wordpress.org/browser/tariffuxx/tags/1.4/classes/Tariffuxx_admin.php#L36
• https://plugins.trac.wordpress.org/browser/tariffuxx/tags/1.4/classes/Tariffuxx_twl.php#L164
• https://plugins.trac.wordpress.org/changeset/3465105/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e897a83b-d746-427d-8c31-64d4eab5848e?source=cve

Published

Oct 15, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10676A weakness has been identified in fuyang_lipengjun platform …4.3
• CVE-2025-10678NetBird VPN when installed using vendor's provided script fa…9.3
• CVE-2025-10679The ReviewX – WooCommerce Product Reviews with Multi-Criteri…7.3
• CVE-2025-1068There is an untrusted search path vulnerability in Esri ArcG…7.3
• CVE-2025-10680OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platform…8.8
• CVE-2025-10681Storage credentials are hardcoded in the mobile app and devi…8.8
• CVE-2025-10683The Easy Email Subscription plugin for WordPress is vulnerab…4.9
• CVE-2025-10684The Construction Light WordPress theme before 1.6.8 does not…4.3
• CVE-2025-10685Heap-based buffer overflow vulnerability in Softing Industri…7.7
• CVE-2025-10686The Creta Testimonial Showcase WordPress plugin before 1.2.4…7.2
• CVE-2025-10687A vulnerability was found in SourceCodester Responsive E-Lea…9.8
• CVE-2025-10688A vulnerability was determined in SourceCodester Pet Groomin…9.8