CVE-2025-54726

CRITICAL EXPLOITED NUCLEI

Miguel Useche JS Archive List - SQL Injection

Title source: llm

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows SQL Injection.This issue affects JS Archive List: from n/a through < 6.1.6.

Exploits (1)

nomisec WORKING POC

by RandomRobbieBF · infoleak

https://github.com/RandomRobbieBF/CVE-2025-54726

View Code ZIP pw:eip

Nuclei Templates (1)

WordPress JS Archive List <= 6.1.5 - SQL Injection

HIGHVERIFIEDby Shivam Kamboj

FOFA: body="jquery-archive-list-widget"

References (2)

[Vdb Entry] https://patchstack.com/database/Wordpress/Plugin/jquery-archive-list-widget/vulnerability/wordpress-js-archive-list-plugin-6-1-6-sql-injection-vulnerability?_s_id=cve

[Third Party Advisory] https://patchstack.com/database/wordpress/plugin/jquery-archive-list-widget/vulnerability/wordpress-js-archive-list-plugin-6-1-6-sql-injection-vulnerability?_s_id=cve

Scores

CVSS v3 9.3

EPSS 0.0092

EPSS Percentile 76.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Details

VulnCheck KEV 2026-03-31

CWE

CWE-89

Status published

Products (1)

Miguel Useche/JS Archive List < 6.1.6

Published Aug 20, 2025

Tracked Since Feb 18, 2026