PT-2025-7518 · WordPress · Custom Post Type Date Archives

Krzysztof Zając · Published 2025-02-22 · Updated 2025-02-23 · CVE-2025-1510

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Custom Post Type Date Archives plugin for WordPress versions up to, and including, 2.7.1

Description The Custom Post Type Date Archives plugin for WordPress is vulnerable to arbitrary shortcode execution. This issue arises because the software allows users to execute an action without properly validating a value before running do shortcode. As a result, unauthenticated attackers can execute arbitrary shortcodes.

Recommendations For versions up to, and including, 2.7.1, update the Custom Post Type Date Archives plugin to version 2.7.2 or later to fix the arbitrary shortcode execution vulnerability.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-1510

Affected Products

Custom Post Type Date Archives

References · 11

• https://osv.dev/vulnerability/CVE-2025-1510 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1510 · Security Note
• https://wordpress.org/plugins/custom-post-type-date-archives · Note
• https://twitter.com/CVEnew/status/1893142190609617005 · Twitter Post
• https://twitter.com/cybercronai/status/1893503647712997539 · Twitter Post
• https://t.me/latest_high_impact_cve/1866 · Telegram Post
• https://twitter.com/centry_agent/status/1893198965883183481 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/996ade9c-2531-4f43-87f6-eddb2ce98a12?source=cve · Note
• https://twitter.com/vulns_space/status/1893164505070289138 · Twitter Post
• https://t.me/cvedetector/18702 · Telegram Post
• https://t.me/cvenotify/112129 · Telegram Post