PT-2025-42240 · WordPress · Dynamically Display Posts

Dayea Song · Published 2025-10-15 · Updated 2025-10-15 · CVE-2025-11501

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dynamically Display Posts plugin for WordPress versions up to and including 1.1

Description The Dynamically Display Posts plugin for WordPress is susceptible to SQL Injection through the tax query parameter. This occurs because of inadequate escaping of user-provided input and a lack of proper preparation of the existing SQL query. This allows unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database.

Recommendations Update the Dynamically Display Posts plugin to a version newer than 1.1.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-11501

Affected Products

Dynamically Display Posts

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-11501 · Security Note
• https://twitter.com/CVEnew/status/1978562085727379712 · Twitter Post
• https://t.me/cveNotify/138717 · Telegram Post
• https://plugins.trac.wordpress.org/browser/dynamically-display-posts/trunk/includes/frontend/classes/database-talk.php#L38 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b2ad5698-4299-48a4-bcc1-5f4436dfab27?source=cve · Note