PT-2025-11362 · Unknown · Ohio Extra

Published 2025-03-15 · Updated 2025-11-20 · CVE-2025-26924

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Ohio Extra versions n/a through 3.4.7

Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', which allows for code injection in Ohio Extra.

Recommendations: For versions n/a through 3.4.7, update to a version that fixes the code injection issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-26924

Affected Products

Ohio Extra

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-26924 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/ohio-extra/vulnerability/wordpress-ohio-theme-extra-plugin-3-4-7-shortcode-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/WolfgangSesin/status/1901206192279769203 · Twitter Post
• https://t.me/cvedetector/20382 · Telegram Post
• https://twitter.com/dailycve/status/1991302729977987402 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/ohio-extra/vulnerability/wordpress-ohio-theme-extra-plugin-3-4-7-shortcode-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/CVETracker/status/1901363024293699618 · Twitter Post
• https://t.me/cvetracker/19200 · Telegram Post
• https://twitter.com/CVEnew/status/1901034175978701227 · Twitter Post