CVE-2025-12583: Neofix Simple Downloads List

Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days.

The Simple Downloads List plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_neofix_sdl_edit' AJAX endpoint along with many others in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to alter many of the plugin's settings/downloads and inject malicious web scripts.

Affected products

• Neofix Simple Downloads List: up to and including 1.4.3

Published 2025-11-08. Last modified 2026-10-07.