Cyber Posture

CVE-2025-25151

High

Published: 07 February 2025

Published
07 February 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
EPSS Score 0.0005 15.7th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-25151 is an improper neutralization of special elements used in an SQL command, classified as an SQL Injection vulnerability (CWE-89), affecting the Stylemix uListing plugin for WordPress. This issue impacts all versions of uListing from n/a through 2.1.6 inclusive. The vulnerability was published on 2025-02-07 and carries a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).

Low-privileged remote attackers (PR:L) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation changes the scope to the server (S:C), enabling high-impact confidentiality breaches such as unauthorized access to sensitive data (C:H), alongside low impacts on integrity (I:N) and availability (A:L).

Patchstack has documented this SQL Injection vulnerability specifically in the WordPress uListing plugin version 2.1.6, providing details via their vulnerability database.

Details

CWE(s)
CWE-89

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection vulnerability in a public-facing WordPress plugin directly enables exploitation of public-facing applications over the network.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References