PT-2025-42240 · WordPress · Dynamically Display Posts

Dayea Song · Publicado 2025-10-15 · Atualizado 2025-10-15 · CVE-2025-11501

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dynamically Display Posts plugin for WordPress versions up to and including 1.1

Description The Dynamically Display Posts plugin for WordPress is susceptible to SQL Injection through the tax query parameter. This occurs because of inadequate escaping of user-provided input and a lack of proper preparation of the existing SQL query. This allows unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database.

Recommendations Update the Dynamically Display Posts plugin to a version newer than 1.1.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-11501

Produtos afetados

Dynamically Display Posts

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-11501 · Nota de Segurança
• https://twitter.com/CVEnew/status/1978562085727379712 · Publicação no Twitter
• https://t.me/cveNotify/138717 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/dynamically-display-posts/trunk/includes/frontend/classes/database-talk.php#L38 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/b2ad5698-4299-48a4-bcc1-5f4436dfab27?source=cve · Nota