{"id":"CVE-2025-8594","aliases":["EUVD-2025-34142","GHSA-2m7w-32cj-4pj7"],"status":"published","title":"Pz-LinkCard \u003c 2.5.7 - Contributor+ SSRF","description":"The Pz-LinkCard WordPress plugin before 2.5.7 does not validate a parameter before making a request to it, which could allow users with a role as low as Contributor to perform SSRF attack.","severity":{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00233,"percentile":0.14314,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2025-10-14T06:00:07Z","modified":"2026-10-08T12:10:00Z","products":[{"vendor":"poporon","product":"pz-linkcard"},{"vendor":"unknown","product":"pz-linkcard"}],"references":[{"url":"https://wpscan.com/vulnerability/17104590-d84e-41b7-83ac-9b15fcfb537a/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8594"},{"url":"https://wpscan.com/vulnerability/17104590-d84e-41b7-83ac-9b15fcfb537a"},{"url":"https://github.com/advisories/GHSA-2m7w-32cj-4pj7"}],"sources":{"cve":[{"id":"CVE-2025-8594","title":"Pz-LinkCard \u003c 2.5.7 - Contributor+ SSRF","description":"The Pz-LinkCard WordPress plugin before 2.5.7 does not validate a parameter before making a request to it, which could allow users with a role as low as Contributor to perform SSRF attack.","status":"published","published":"2025-10-14T06:00:07.251Z","modified":"2025-10-14T13:39:01.218Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"adp"}],"updated_at":"2026-11-02T14:32:38.351095Z"}],"euvd":[{"id":"EUVD-2025-34142","description":"The Pz-LinkCard WordPress plugin before 2.5.7 does not validate a parameter before making a request to it, which could allow users with a role as low as Contributor to perform SSRF attack.","status":"published","published":"2025-10-14T06:00:07Z","modified":"2025-10-14T13:39:01Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T20:31:33.532032Z"}],"ghsa":[{"id":"GHSA-2m7w-32cj-4pj7","title":"The Pz-LinkCard WordPress plugin before 2.5.7 does not validate a parameter before making a...","description":"The Pz-LinkCard WordPress plugin before 2.5.7 does not validate a parameter before making a request to it, which could allow users with a role as low as Contributor to perform SSRF attack.","status":"published","published":"2025-10-14T06:31:13Z","modified":"2025-10-14T15:32:29Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:03:57.454768Z"}],"nvd":[{"id":"CVE-2025-8594","description":"The Pz-LinkCard WordPress plugin before 2.5.7 does not validate a parameter before making a request to it, which could allow users with a role as low as Contributor to perform SSRF attack.","status":"published","published":"2025-10-14T06:15:35.06Z","modified":"2026-10-08T12:10:00.217Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"updated_at":"2026-11-02T14:11:36.851295Z"}]}}