PT-2025-51092 · WordPress · Filter & Grids

Michael Mazzolini · Published 2025-12-13 · Updated 2025-12-13 · CVE-2025-10289

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Filter & Grids plugin for WordPress versions prior to 3.2.1

Description The Filter & Grids plugin for WordPress is susceptible to SQL Injection through the phrase parameter. Insufficient input validation and inadequate SQL query preparation allow unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database. This issue is confirmed to affect MariaDB databases, causing syntax errors in MySQL.

Recommendations Update the Filter & Grids plugin to version 3.2.1 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10289

Affected Products

Filter & Grids

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-10289 · Security Note
• https://twitter.com/CVEnew/status/1999865331846918201 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378420%40ymc-smart-filter&new=3378420%40ymc-smart-filter&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f8bbab6e-ed2f-4b90-a658-aae85906d06e?source=cve · Note
• https://t.me/CVEtracker/39709 · Telegram Post