References https://nvd.nist.gov/vuln/detail/CVE-2025-4380 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ap-plugin-scripteo/ads-pro-plugin-multi-purpose-wordpress-advertising-manager-489-unauthenticated-local-file-inclusion-to-remote-code-execution https://wpscan.com/vulnerability/63964564-73e6-45e2-8145-33e2e30d1d57/ https://github.com/advisories/GHSA-635h-h9cr-wcq9 https://cloud.projectdiscovery.io/library/CVE-2025-4380 https://blog.csdn.net/weixin_50860267/article/details/142435591 https://zhuanlan.zhihu.com/p/1932214870562047555 https://s4e.io/tools/ads-pro-plugin-local-file-inclusion-cve-2025-4380 https://hackhalt.com/threat/cve-2025-4380/ https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ap-plugin-scripteo/ads-pro-plugin-multi-purpose-wordpress-advertising-manager-489-unauthenticated-local-file-inclusion
Related VulnerabilitiesPoCCVE-2026-41948: Dify <=1.14.1 - Unauthenticated Plugin Daemon Path TraversalJeecgBoot 积木报表 /jmreport/auto/export/python/plugin 代码执行漏洞PoCCVE-2025-14998: Branda WordPress plugin - Privilege EscalationPoCCVE-2026-55224: MineAdmin < 3.2.0-alpha.2 - Plugin Path Traversal to RCEPoCCVE-2019-1003030: Jenkins Pipeline Groovy Plugin <=2.63 - Insecure DeserializationPoCCVE-2026-3001: Gutenverse Plugin <= 3.4.6 - Cross-Site ScriptingPoCCVE-2025-6389: Sneeit WP Social WordPress Plugin - Unauthenticated RCE via call_user_funcPoCCVE-2026-3296: Everest Forms WordPress Plugin <= 3.4.3 - PHP Object InjectionStripe Payment Plugin for WooCommerce /wc-api/WT_Stripe/ SQL 注入漏洞(CVE-2024-0705)泛微 E-Cology /hrm/hrm_e9/orgChart/js/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.jsp 目录遍历漏洞AVideo /plugin/API/get.json.php 文件包含漏洞(CVE-2026-33513)WWBN AVideo /objects/plugins.json.php 信息泄露漏洞 (CVE-2026-43885)PoCCVE-2025-48157: WordPress Formality Plugin <= 1.5.9 - Local File Inclusion