PT-2025-40486 · WordPress · Wp Cycle Text Announcement

Peter Thaleikis · Published 2025-10-03 · Updated 2025-10-03 · CVE-2025-9198

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wp cycle text announcement plugin for WordPress versions through 8.1

Description The Wp cycle text announcement plugin for WordPress is susceptible to SQL Injection through the 'cycle-text' shortcode. Insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries allow authenticated attackers with Contributor-level access or higher to inject additional SQL queries. This can lead to the extraction of sensitive information from the database. The vulnerable parameter is the cycle-text shortcode parameter.

Recommendations Update the Wp cycle text announcement plugin to a version later than 8.1.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-9198

Affected Products

Wp Cycle Text Announcement

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-9198 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-cycle-text-announcement/trunk/wp-cycle-text-announcement.php#L129 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3db1375b-169a-450d-86b5-2db99f916034?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1974152064134431064 · Twitter Post