CVE-2025-10187

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10187", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-09T15:31:45.520Z", "datePublished": "2025-10-18T06:42:45.183Z", "dateUpdated": "2026-04-08T16:50:09.935Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:09.935Z"}, "affected": [{"vendor": "creative-solutions-1", "product": "GSpeech TTS \u2013 WordPress Text To Speech Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.17.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The GSpeech TTS \u2013 WordPress Text To Speech Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' parameter in all versions up to, and including, 3.17.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "GSpeech TTS \u2013 WordPress Text To Speech Plugin <= 3.17.13 - Authenticated (Admin+) SQL injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/484dded3-dbe7-4a11-877a-a19504d30206?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/gspeech/trunk/includes/gspeech_backend.php#L109"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3376552%40gspeech&new=3376552%40gspeech&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Moose Love"}], "timeline": [{"time": "2025-10-17T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-20T18:55:20.540201Z", "id": "CVE-2025-10187", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-20T18:55:31.797Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10187", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-20T18:55:20.540201Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-20T18:55:26.154Z"}}], "cna": {"title": "GSpeech TTS \u2013 WordPress Text To Speech Plugin <= 3.17.13 - Authenticated (Admin+) SQL injection", "credits": [{"lang": "en", "type": "finder", "value": "Moose Love"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "creative-solutions-1", "product": "GSpeech TTS \u2013 WordPress Text To Speech Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.17.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-17T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/484dded3-dbe7-4a11-877a-a19504d30206?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/gspeech/trunk/includes/gspeech_backend.php#L109"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3376552%40gspeech&new=3376552%40gspeech&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The GSpeech TTS \u2013 WordPress Text To Speech Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' parameter in all versions up to, and including, 3.17.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:09.935Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10187", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:50:09.935Z", "dateReserved": "2025-09-09T15:31:45.520Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-18T06:42:45.183Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "GSpeech TTS \u2013 WordPress Text To Speech Plugin", "vendor": "creative-solutions-1", "versions": [{"lessThanOrEqual": "3.17.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The GSpeech TTS \u2013 WordPress Text To Speech Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' parameter in all versions up to, and including, 3.17.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin GSpeech TTS - WordPress Text To Speech Plugin para WordPress es vulnerable a inyecci\u00f3n SQL a trav\u00e9s del par\u00e1metro 'field' en todas las versiones hasta la 3.17.13, inclusive, debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y a la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes autenticados, con acceso de nivel de Administrador y superior, a\u00f1adan consultas SQL adicionales a consultas ya existentes que pueden utilizarse para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2025-10187", "lastModified": "2026-10-09T10:10:00.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10187", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-20T18:55:20.540201Z", "version": "2.0.3"}}]}, "published": "2025-10-18T07:15:34.520", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/gspeech/trunk/includes/gspeech_backend.php#L109"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3376552%40gspeech&new=3376552%40gspeech&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/484dded3-dbe7-4a11-877a-a19504d30206?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T13:03:55.802096+00:00", "value": {"mitigation_remediation": ["Upgrade the GSpeech TTS plugin to the latest version (\u2265\u202f3.18) or apply the vendor\u2019s official patch.", "If an upgrade cannot be performed immediately, disable or remove the plugin from the WordPress installation until a fix is available.", "Audit all WordPress administrator accounts to confirm that only legitimate users have admin privileges, and consider tightening role permissions or implementing multi\u2011factor authentication."], "summary": {"action": "Patch", "impact": "SQL injection allowing extraction of sensitive database information"}, "threat_synthesis": {"affected_systems": "All versions of the GSpeech TTS \u2013 WordPress Text To Speech Plugin up to and including 3.17.13, supplied by creative\u2011solutions-1, are affected. The flaw is only exploitable by users who have Administrator level access through the WordPress dashboard.", "description_and_impact": "The GSpeech TTS \u2013 WordPress Text To Speech Plugin contains a parameter, 'field', that is not properly escaped when incorporated into an SQL statement. As a result, authenticated users with Administrator or higher privileges can inject additional SQL commands, enabling the extraction of sensitive data from the WordPress database. This vulnerability is a classic instance of CWE\u201189, where improper input validation leads to injection of arbitrary SQL queries.", "risk_and_exploitability": "The CVSS score of 4.9 indicates moderate severity, and the EPSS score of less than 1\u202f% suggests that exploit attempts are currently rare. The vulnerability is not listed in CISA KEV, but the requirement for an authenticated admin account means that a successful attack requires compromised credentials or a brute\u2011force gain of admin rights. In organizations where user accounts are tightly controlled and strong authentication mechanisms are in place, the immediate risk is lower, but any exposure of an admin account presents a significant threat of data exfiltration."}}}}, "created": "2025-10-20T13:21:29.736511+00:00", "updated": "2026-04-22T13:15:17.840206+00:00", "vendors": ["creative-solutions-1", "creative-solutions-1$PRODUCT$gspeech_tts_wordpress_text_to_speech_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}