CVE-2025-10723CWE-22path-traversal

CVE-2025-10723

Low · published October 24, 2025

CVSS v3.1
2.7
EPSS
0%
Percentile
22.2
In the wild
Unconfirmed
What it is

The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to function/s, allowing any admins to perform LFI attacks

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00306 · 22.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-10-24T10:15Z
References (1)
https://wpscan.com/vulnerability/88a99f9d-dc7f-4c04-8734-77295c8656bf/ · [email protected]
EPSS history
Timeline
  • 24 OCT 06:00Z
    PixelYourSite < 11.1.2 - Admin+ LFI
    cvelistv5