PT-2025-47673 · WordPress · Uipress Lite

Abrahack · CVE-2025-11003 · Published 2025-11-21 · Updated 2025-11-21

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions UiPress lite versions prior to 3.5.09

Description The UiPress lite plugin for WordPress allows authenticated attackers with Subscriber-level access or higher to save templates containing custom JavaScript due to a missing capability check on the uip save ui template function. This can lead to unauthorized modification of data.

Recommendations Update UiPress lite to version 3.5.09 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-11003

Affected Products

Uipress Lite

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-11003 · Security Note
• https://twitter.com/CVEnew/status/1991776205071409646 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b2a01ccc-c98e-4fcc-8eaf-721ec46584fc?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1991872998203068764 · Twitter Post
• https://plugins.trac.wordpress.org/browser/uipress-lite/tags/3.5.08/admin/classes/PostTypes/UiTemplates.php#L416 · Note
• https://plugins.trac.wordpress.org/browser/uipress-lite/tags/3.5.08/admin/core/uiBuilder.php#L613 · Note