CVE-2025-10635: 
WordPress vulnerability analysis and mitigation

The Find Me On WordPress plugin through version 2.0.9.1 contains a SQL injection vulnerability identified as CVE-2025-10635. The vulnerability was discovered by Khaled Alenazi (Nxploited) and publicly disclosed on September 17, 2025. The issue affects subscribers and users with higher privileges who can exploit unsanitized parameters in SQL statements (WPScan).

The vulnerability stems from improper parameter sanitization and escaping in SQL statements. It has been assigned a CVSS v3.1 base score of 7.7 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. The attack vector is network-based, requires low attack complexity, needs low privileges, and no user interaction. The vulnerability can be exploited by sending a specially crafted POST request to wp-admin/admin-ajax.php with a subscriber cookie (WPScan).

When successfully exploited, this vulnerability allows authenticated users with subscriber-level access or higher to perform SQL injection attacks. The CVSS scoring indicates high impact on confidentiality while maintaining normal integrity and availability of the system (NVD).