CVE-2025-28893CWE-94

WordPress Visual Text Editor plugin <= 1.2.1 - Remote Code Execution (RCE) vulnerability

Critical · published March 26, 2025

CVSS v3.1
9.9
EPSS
1%
Percentile
56.0
In the wild
Unconfirmed
What it is

🚨 A sneaky code injection flaw is lurking in the Govind Visual Text Editor, allowing an attacker to execute their own code remotely! 🔥 Think of this vulnerability like a magician slipping a fake card into your wallet without you noticing — once it's in there, they can pull off all sorts of tricks, manipulating your data and actions as they please. This could lead to absolutely devastating consequences: an attacker could gain full control over your system, manipulate data, or even execute harmful scripts without breaking a sweat! With versions from n/a up to 1.2.1 vulnerable, the potential for chaos is high. Imagine the damage of a rogue magician running wild in your bank vault!

Put simply

Think of this vulnerability like a magician slipping a fake card into your wallet without you noticing — once it's in there, they can pull off all sorts of tricks, manipulating your data and actions as they please. This critical vulnerability allows for Remote Code Inclusion due to improper control of code generation in the Govind Visual Text Editor, meaning attackers could execute arbitrary code by sending crafted input.

What to do

This could lead to absolutely devastating consequences: an attacker could gain full control over your system, manipulate data, or even execute harmful scripts without breaking a sweat! With versions from n/a up to 1.2.1 vulnerable, the potential for chaos is high. Imagine the damage of a rogue magician running wild in your bank vault! To protect your systems, immediately upgrade the Visual Text Editor to version 1.2.2 or later. Regularly audit your applications for other vulnerabilities and implement input validation to safeguard against similar attacks. Security heroes, assemble! You've got this! Follow these steps, and you'll ensure your environment stays secure. 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00795 · 56.0th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-03-26T14:24Z
EPSS history
Timeline
  • 26 MAR 14:24Z
    WordPress Visual Text Editor plugin <= 1.2.1 - Remote Code Execution (RCE) vulnerability
    cvelistv5