PT-2025-44934 · WordPress · Jewel Theme Recommended Plugins

Youcef Hamdani · Published 2025-11-04 · Updated 2025-11-10 · CVE-2025-10896

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress plugins with the Jewel Theme Recommended Plugins Library versions up to and including 1.0.2.3

Description The software is susceptible to unrestricted file upload due to missing capability checks within the * recommended upgrade plugin function. This allows authenticated attackers with subscriber-level access or higher to upload arbitrary plugin packages to the server by using a crafted plugin URL, potentially leading to remote code execution.

Recommendations Update to a version beyond 1.0.2.3.

Fix

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-10896

Affected Products

Jewel Theme Recommended Plugins

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-10896 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3384308%40image-hover-effects-elementor-addon&new=3384308%40image-hover-effects-elementor-addon · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3390374%40ultimate-blocks-for-gutenberg&new=3390374%40ultimate-blocks-for-gutenberg&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Assets.php#L70 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0ff3a292-3924-4823-867a-fedb2c1cdd00?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389322%40image-comparison-elementor-addon&new=3389322%40image-comparison-elementor-addon · Note
• https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Recommended.php#L334 · Note
• https://t.me/cveNotify/141498 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389341%40content-locker-for-elementor&new=3389341%40content-locker-for-elementor&sfp_email=&sfph_mail= · Note
• https://twitter.com/MNovofastovsky/status/1987836130021220498 · Twitter Post
• https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Recommended.php#L43 · Note