PT-2025-15362 · WordPress · Team Circle Image Slider With Lightbox

Ala Arfaoui · Published 2025-04-08 · Updated 2025-04-08 · CVE-2019-25223

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Team Circle Image Slider With Lightbox plugin for WordPress versions 1.0.4 and earlier

Description: The issue arises from insufficient escaping of the user-supplied id parameter and lack of sufficient preparation on the existing SQL query, allowing authenticated attackers with Administrator-level access and above to append additional SQL queries to existing ones. This can be used to extract sensitive information from the database.

Recommendations: For versions 1.0.4 and earlier, update to a version later than 1.0.4 to resolve the issue. As a temporary workaround, consider restricting access to the id parameter in the affected plugin until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-25223

Affected Products

Team Circle Image Slider With Lightbox

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-25223 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2061993%40circle-image-slider-with-lightbox&new=2061993%40circle-image-slider-with-lightbox&sfp_email=&sfph_mail= · Note
• https://wordpress.org/plugins/circle-image-slider-with-lightbox · Note
• https://t.me/cvenotify/118164 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/bd3e30ea-8f58-4895-b78c-fb18c94d5253?source=cve · Note
• https://t.me/cvetracker/21080 · Telegram Post