Adding CVE-2025-5287.yaml

[CodeStuffBreakThings]

Likes and Dislikes Wordpress Plugin <=1.0.0 Unauthenticated SQLi Vulnerability

Added CVE-2025-5287

• References:
• GHSA-2q5m-qpc5-76wp
• https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/inprosysmedia-likes-dislikes-post/likes-and-dislikes-plugin-100-authenticated-subscriber-sql-injection
• https://github.com/erumfaham/inprosysmedia-likes-dislikes-post
• https://github.com/Nxploited/CVE-2025-5287
• https://github.com/wiseep/CVE-2025-5287/tree/main

Template Validation

I've validated this template locally?

• YES
• NO

Additional Details (leave it blank if not applicable)

Wordpress has pulled the plugin from their plugins site while they review it. The code can still be found on the plugin author's Github site linked above or on the Wordpress TracBrowser. Given that the last update to the plugin was 4 years ago, it is unlikely that it will receive a patch.

Additional References:

• Nuclei Template Creation Guideline
• Nuclei Template Matcher Guideline
• Nuclei Template Contribution Guideline
• PD-Community Discord server

[princechaddha]

Automated PR Review (Experimental)

---

Thank you for your contribution! You can join our Discord server. It's a great place to connect with fellow contributors and stay updated with the latest developments. Thank you once again.

Required Fixes

• Fix template ID to match the filename (should be CVE-2025-5287).
• Ensure tags are comma-separated without spaces (change likes,dislikes,wordpress,plugin,wp-plugin,unauthenticated,sqli,cve,cve2025,cve-2025-5287 to likes,dislikes,wordpress,plugin,wp-plugin,unauthenticated,sqli,cve,cve2025,cve-2025-5287).

Other Suggestions

• Consider adding more unique matchers to enhance the reliability of the template. For instance, including a response body matcher could further validate the successful exploitation of the vulnerability.
• Including a unique endpoint or message in the body, in addition to the matcher for duration, could help reduce false positives.
• Remediation information is good to include, but you might want to clarify if this is a recommended action or just an advisory.
• Make sure to format the YAML correctly using yamllint to catch indentation issues or trailing spaces before final submission.

I am an AI Template bot, and the team will review the PR shortly.

[CodeStuffBreakThings]

Also I would have set the sleep timer to be higher than 3 but I ran into a strange issue with the sleep-based SQLi. I tried to set the sleep timer to higher than 3, but something was going on with my Nuclei 3.4.5 client. 2 HTTP requests were getting sent and scans were taking 21 seconds to complete when the sleep timer was set to 5. Using sleep(3) the scan took 9 seconds.
It looks like someone had a similar issue: https://discord.com/channels/695645237418131507/1312897172928466964/1312897172928466964

[CodeStuffBreakThings]

I updated the template ID to match the file name. I made sure that the tags have no spaces in them too