CVE-2025-12707 Library Management System SQL Injection

CVE-2025-12707 is a high-severity vulnerability. AttackerView checks WordPress sites for it with a live exploit check.

Deterministic high WordPress Added 7mo ago cve-verified-cve-2025-12707

Is my site vulnerable to CVE-2025-12707?

Detects the Library Management System WordPress plugin at version 3.2.1 or earlier, where the bid parameter in the book shortcode handler has insufficient escaping, allowing unauthenticated attackers to inject SQL and extract sensitive data from the database.

Related WordPress exploits

CVE-2026-119977 Unauthenticated Remote Code Execution Through the Core Upgrade Staging Directory
CVE-2026-63030 Unauthenticated REST Batch Route Confusion
CVE-2026-87902 Unauthenticated Page-Template Path Traversal (LFI to RCE)
CVE-2026-6518 Admin File Upload to RCE via CMP Coming Soon & Maintenance
CVE-2026-5617 Subscriber-to-Admin Takeover via Cookie Forgery
CVE-2026-1555 WebStack Theme Unauthenticated Arbitrary File Upload
CVE-2026-0740 Unauthenticated Arbitrary File Upload via Ninja Forms File Uploads
CVE-2026-2942 Unauthenticated Arbitrary File Upload via ProSolution WP Client
CVE-2026-5032 Security Token Exposure via User-Agent Bypass
CVE-2026-0686 Webmention Plugin Unauthenticated SSRF
CVE-2026-5130 Unauthenticated Admin Takeover via Cookie Forgery
CVE-2026-4021 Admin Account Takeover via MySQL Integer Coercion
CVE-2026-4020 Unauthenticated System Report Exposure via REST API
CVE-2026-32525 Authenticated Remote Code Execution via SSR Validation Callback
CVE-2026-4373 Unauthenticated Arbitrary File Read via Media Field Path Traversal
CVE-2026-3300 Unauthenticated Remote Code Execution via Form Calculation
CVE-2026-3090 Stored XSS via Post SMTP Email Logs
CVE-2026-3658 Unauthenticated SQL Injection via REST API Fields Parameter
CVE-2026-7567 Unauthenticated Admin Takeover via Temporary Login Token Type Confusion
CVE-2026-1238 Unauthenticated Stored XSS via Fingerprint Tracking
CVE-2026-4257 Remote Code Execution via Twig Template Injection
CVE-2026-3334 SQL Injection in CMS Commander Backup Restore
CVE-2026-2579 Unauthenticated SQL Injection via Product Search
CVE-2026-23550 Unauthenticated Admin Access via Authentication Bypass
CVE-2026-1463 Local File Inclusion via Gallery Template Parameter
CVE-2026-3533 Subscriber File Upload via Broken Access Control
CVE-2026-2991 Patient Account Takeover via KiviCare Social Login Bypass
CVE-2026-2941 Linksy Search and Replace Subscriber-to-Admin Privilege Escalation
CVE-2025-2005 Front End Users Unauthenticated File Upload
CVE-2026-2448 SiteOrigin Page Builder Local File Inclusion
CVE-2026-2413 Ally Plugin SQL Injection via URL Path
CVE-2026-3585 The Events Calendar Authenticated LFI via CSV Import
CVE-2026-1357 WPvivid File Upload via Crypto Fail-Open
CVE-2026-3891 Pix for WooCommerce Unauthenticated File Upload
CVE-2026-2628 SSO Plugin Authentication Bypass
CVE-2026-2631 Datalogics Plugin Privilege Escalation
CVE-2026-4001 WooCommerce Custom Product Addons Pro RCE
CVE-2026-3584 Kali Forms Remote Code Execution
CVE-2026-1648 Performance Monitor Unauthenticated SSRF
CVE-2026-4484 Privilege Escalation via LMS Instructor API
CVE-2026-4347 Arbitrary File Move via Form Plugin Path Traversal
CVE-2026-4662 Unauthenticated SQL Injection via JetEngine Listing AJAX Handler
CVE-2026-4283 Unauthenticated Account Destruction via GDPR Plugin Missing Authorization
CVE-2026-4314 Subscriber-to-Admin Privilege Escalation via Menu Editor Plugin
CVE-2026-2580 Unauthenticated SQL Injection via WP Maps Orderby Parameter
CVE-2025-15484 WooCommerce Store Takeover via Permission Bypass
CVE-2026-3535 Unauthenticated Arbitrary File Upload via DSGVO Google Web Fonts GDPR Plugin
CVE-2026-3296 PHP Object Injection via Everest Forms Unserialize
CVE-2026-3614 Subscriber-to-Admin Privilege Escalation via AcyMailing AJAX Router
CVE-2026-77770 miniOrange 2FA Unauthenticated Arbitrary Option Deletion

Is your app exploitable through CVE-2025-12707?

Scan your domain free