PT-2025-38500 · Gopiplus · Woo Superb Slideshow Transition Gallery With Random Effect

Peter Thaleikis · Publicado 2025-09-16 · Atualizado 2025-10-03 · CVE-2025-9199

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Woo superb slideshow transition gallery with random effect plugin for WordPress versions through 9.1

Description The software is susceptible to SQL Injection through the 'woo-superb-slideshow' shortcode. Insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries allow authenticated attackers with Contributor-level access or higher to inject additional SQL queries. This can lead to the extraction of sensitive information from the database.

Recommendations Update the plugin to a version newer than 9.1.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-9199

Produtos afetados

Woo Superb Slideshow Transition Gallery With Random Effect

Referências · 6

• https://plugins.trac.wordpress.org/browser/woo-superb-slideshow-transition-gallery-with-random-effect/trunk/woo-superb-slideshow-transition-gallery-with-random-effect.php#L61 · Nota
• https://twitter.com/CVEnew/status/1974076260105032105 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/8e4c42e6-92f3-4c2f-8748-877c6df39e62?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-9199 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1974149503977508981 · Publicação no Twitter
• https://t.me/CVEtracker/32672 · Publicação no Telegram