CVE-2025-68054CWE-89sql-injection

CVE-2025-68054

High · published December 16, 2025

CVSS v3.1
8.5
EPSS
0%
Percentile
14.7
In the wild
Unconfirmed
What it is

⚡ A crafty SQL injection vulnerability lurks in CountDown With Image or Video Background, allowing attackers to extract sensitive data like a magician revealing the secrets of their tricks! 🎩✨ This flaw is like a restaurant with a menu that allows patrons to rewrite their orders — if you don’t check what’s being requested, someone could walk away with the chef’s secret recipe! An attacker could potentially extract any data from the database, including user information or sensitive application data, leaving your system vulnerable and your users at risk. This could lead to a full compromise of your application if sensitive data is mishandled. Let’s nip this in the bud before it becomes a serious problem!

Put simply

This flaw is like a restaurant with a menu that allows patrons to rewrite their orders — if you don’t check what’s being requested, someone could walk away with the chef’s secret recipe! This vulnerability allows for Blind SQL Injection in versions of CountDown With Image or Video Background from n/a to 1.5, where improper neutralization of input can let attackers manipulate SQL queries to access confidential data.

What to do

An attacker could potentially extract any data from the database, including user information or sensitive application data, leaving your system vulnerable and your users at risk. This could lead to a full compromise of your application if sensitive data is mishandled. Let’s nip this in the bud before it becomes a serious problem! Upgrade to the latest version of CountDown With Image or Video Background as soon as possible to patch this vulnerability. Implement input validation and prepared statements to further secure your application against SQL injection attacks. Don’t forget to audit your existing queries to ensure they’re safe! You've got this! Take these steps and you'll have your app secured in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-16T14:16Z
References (1)
EPSS history
Timeline
  • 16 DEC 08:12Z
    WordPress CountDown With Image or Video Background plugin <= 1.5 - SQL Injection vulnerability
    cvelistv5