CVE-2025-10896

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10896", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-23T18:24:04.128Z", "datePublished": "2025-11-04T04:27:13.331Z", "dateUpdated": "2026-04-08T16:35:52.884Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:52.884Z"}, "affected": [{"vendor": "litonice13", "product": "Image Comparison Addon for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.2.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "litonice13", "product": "Image Hover Effects for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "litonice13", "product": "Content Locker for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "litonice13", "product": "Master Blocks \u2013 Ultimate Gutenberg Blocks for Marketers", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.4.1.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Multiple plugins for WordPress with the Jewel Theme Recommended Plugins Library are vulnerable to Unrestricted Upload of File with Dangerous Type via arbitrary plugin installation in all versions up to, and including, 1.0.2.3. This is due to missing capability checks on the '*_recommended_upgrade_plugin' function which allows arbitrary plugin URLs to be installed. This makes it possible for authenticated attackers with subscriber-level access and above to upload arbitrary plugin packages to the affected site's server via a crafted plugin URL, which may make remote code execution possible."}], "title": "Multiple Plugins <= Multiple Versions - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0ff3a292-3924-4823-867a-fedb2c1cdd00?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Recommended.php#L334"}, {"url": "https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Recommended.php#L43"}, {"url": "https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Assets.php#L70"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3384308%40image-hover-effects-elementor-addon&new=3384308%40image-hover-effects-elementor-addon"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389341%40content-locker-for-elementor&new=3389341%40content-locker-for-elementor&sfp_email=&sfph_mail="}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3390374%40ultimate-blocks-for-gutenberg&new=3390374%40ultimate-blocks-for-gutenberg&sfp_email=&sfph_mail="}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389322%40image-comparison-elementor-addon&new=3389322%40image-comparison-elementor-addon"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "timeline": [{"time": "2025-10-23T19:55:52.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-03T15:52:24.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-04T20:55:40.641094Z", "id": "CVE-2025-10896", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T20:55:54.279Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10896", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-04T20:55:40.641094Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T20:55:46.342Z"}}], "cna": {"title": "Multiple Plugins <= Multiple Versions - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Upload", "credits": [{"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "litonice13", "product": "Master Blocks \u2013 Ultimate Gutenberg Blocks for Marketers", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.4.1.3"}], "defaultStatus": "unaffected"}, {"vendor": "litonice13", "product": "Image Comparison Addon for Elementor", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0.2.2"}], "defaultStatus": "unaffected"}, {"vendor": "litonice13", "product": "Image Hover Effects for Elementor", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0.2.3"}], "defaultStatus": "unaffected"}, {"vendor": "litonice13", "product": "Content Locker for Elementor", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-23T19:55:52.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-03T15:52:24.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0ff3a292-3924-4823-867a-fedb2c1cdd00?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Recommended.php#L334"}, {"url": "https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Recommended.php#L43"}, {"url": "https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Assets.php#L70"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3384308%40image-hover-effects-elementor-addon&new=3384308%40image-hover-effects-elementor-addon"}], "descriptions": [{"lang": "en", "value": "Multiple plugins for WordPress with the Jewel Theme Recommended Plugins Library are vulnerable to Unrestricted Upload of File with Dangerous Type via arbitrary plugin installation in all versions up to, and including, 1.0.2.3. This is due to missing capability checks on the '*_recommended_upgrade_plugin' function which allows arbitrary plugin URLs to be installed. This makes it possible for authenticated attackers with subscriber-level access and above to upload arbitrary plugin packages to the affected site's server via a crafted plugin URL, which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-04T04:27:13.331Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10896", "state": "PUBLISHED", "dateUpdated": "2025-11-04T20:55:54.279Z", "dateReserved": "2025-09-23T18:24:04.128Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-04T04:27:13.331Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Image Comparison Addon for Elementor", "vendor": "litonice13", "versions": [{"lessThanOrEqual": "1.0.2.2", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Image Hover Effects for Elementor", "vendor": "litonice13", "versions": [{"lessThanOrEqual": "1.0.2.3", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Content Locker for Elementor", "vendor": "litonice13", "versions": [{"lessThanOrEqual": "1.0.3", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Master Blocks \u2013 Ultimate Gutenberg Blocks for Marketers", "vendor": "litonice13", "versions": [{"lessThanOrEqual": "1.4.1.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple plugins for WordPress with the Jewel Theme Recommended Plugins Library are vulnerable to Unrestricted Upload of File with Dangerous Type via arbitrary plugin installation in all versions up to, and including, 1.0.2.3. This is due to missing capability checks on the '*_recommended_upgrade_plugin' function which allows arbitrary plugin URLs to be installed. This makes it possible for authenticated attackers with subscriber-level access and above to upload arbitrary plugin packages to the affected site's server via a crafted plugin URL, which may make remote code execution possible."}, {"lang": "es", "value": "M\u00faltiples plugins para WordPress con la biblioteca de plugins recomendados de Jewel Theme son vulnerables a la carga irrestricta de archivos de tipo peligroso a trav\u00e9s de la instalaci\u00f3n arbitraria de plugins en todas las versiones hasta la 1.0.2.3, inclusive. Esto se debe a la falta de comprobaciones de capacidad en la funci\u00f3n '*_recommended_upgrade_plugin', lo que permite la instalaci\u00f3n de URLs de plugins arbitrarias. Esto hace posible que atacantes autenticados con acceso de nivel de suscriptor y superior carguen paquetes de plugins arbitrarios al servidor del sitio afectado a trav\u00e9s de una URL de plugin manipulada, lo que podr\u00eda hacer posible la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2025-10896", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10896", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-04T20:55:40.641094Z", "version": "2.0.3"}}]}, "published": "2025-11-04T05:15:49.360", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Assets.php#L70"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Recommended.php#L334"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Recommended.php#L43"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3384308%40image-hover-effects-elementor-addon&new=3384308%40image-hover-effects-elementor-addon"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389322%40image-comparison-elementor-addon&new=3389322%40image-comparison-elementor-addon"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389341%40content-locker-for-elementor&new=3389341%40content-locker-for-elementor&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3390374%40ultimate-blocks-for-gutenberg&new=3390374%40ultimate-blocks-for-gutenberg&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0ff3a292-3924-4823-867a-fedb2c1cdd00?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T21:22:04.256741+00:00", "value": {"mitigation_remediation": ["Upgrade all affected plugins to a release newer than 1.0.2.3 immediately after it becomes available from the vendor.", "If an upgrade cannot be applied, remove or disable the vulnerable plugins entirely and block any future plugin upload actions for non\u2011administrator accounts by editing the site\u2019s wp-config.php or using a security plugin that restricts upload capabilities.", "Verify that no unauthorized or suspicious plugin files remain on the server; remove any that are found and conduct a scan for malware before reopening normal plugin upload functionality."], "summary": {"action": "Apply Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "WordPress sites that have installed any of the following plugins from the Jewel Theme Recommended Plugins Library: Content Locker for Elementor, Image Comparison Addon for Elementor, Image Hover Effects for Elementor, and Master Blocks \u2013 Ultimate Gutenberg Blocks for Marketers. The issue exists in all released versions up to and including 1.0.2.3, regardless of the site\u2019s theme or other plugins.", "description_and_impact": "The flaw stems from a missing capability check on a plugin upgrade function, allowing any user with subscriber-level access or higher to supply an arbitrary plugin URL and trigger an installation. Once a plugin package is placed on the server, the WordPress core will unpack and activate it, giving the attacker the ability to run code with the same privileges as the user who performed the upload. The vulnerability is rooted in an authorization weakness (CWE-862) and can lead to full system compromise if the uploaded plugin contains malicious payloads.", "risk_and_exploitability": "The CVSS score of 8.8 indicates a high severity, reflecting the potential for significant damage from an authenticated attacker. The EPSS score of less than 1% suggests that, at present, automated exploitation is unlikely, yet the presence of the vulnerability in widely used community plugins keeps it a realistic risk for sites run by organizations with some level of internal access. As the vulnerability is not listed in the CISA KEV catalog, there is no widespread exploit campaign known, but the controlled nature of the attack vector\u2014requiring subscriber+ login\u2014still makes the issue a critical concern for hosts that allow such users to manage site content."}}}}, "created": "2025-11-04T16:33:34.674331+00:00", "updated": "2026-04-22T21:30:27.817621+00:00", "vendors": ["elementor", "elementor$PRODUCT$elementor", "litonice13", "litonice13$PRODUCT$image_hover_effects_for_elementor", "wordpress", "wordpress$PRODUCT$wordpress"]}