PT-2025-5191 · WordPress · Typomedia Foundation Wordpress Custom Sidebar

João Pedro S Alcântara · Published 2025-01-16 · Updated 2025-01-16 · CVE-2025-23912

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Typomedia Foundation WordPress Custom Sidebar versions prior to 2.3

Description The issue is related to the improper neutralization of special elements used in an SQL command, allowing Blind SQL Injection. This problem enables attackers to execute malicious code.

Recommendations For versions prior to 2.3, update to a version that contains a fix for this issue to prevent Blind SQL Injection attacks. As a temporary workaround, consider restricting access to sensitive database areas until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-23912

Affected Products

Typomedia Foundation Wordpress Custom Sidebar

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-23912 · Security Note
• https://patchstack.com/database/wordpress/plugin/wordpress-custom-sidebar/vulnerability/wordpress-wordpress-custom-sidebar-plugin-2-3-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1880019998082486568 · Twitter Post
• https://twitter.com/CveFindCom/status/1879990261817680083 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/wordpress-custom-sidebar/vulnerability/wordpress-wordpress-custom-sidebar-plugin-2-3-sql-injection-vulnerability?_s_id=cve · Note