CVE-2025-10137

MediumCVSS 5.4/10Last modified Oct 11, 2026

Description

The Snow Monkey theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 29.1.5 via the request() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Sep 26, 2025
Last modified
Oct 11, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-101386.4The This-or-That plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'thisorthat' shortcode in all versions uCVE-2025-101396.4The WP BookWidgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bw_link' shortcode in all versions upCVE-2025-10148.8Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerabiliCVE-2025-101406.4The Quick Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quick-login' shortcode in all verCVE-2025-101416.4The Digiseller plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ds' shortcode in all versions up to, and CVE-2025-101424.9The PagBank / PagSeguro Connect para WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versiCVE-2025-101437.5The Catch Dark Mode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0 via the 'catch_darkCVE-2025-101446.5The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attribute of the `productCVE-2025-101466.1The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘user_ids’ parameter in all versions up toCVE-2025-101479.8The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_CVE-2025-101485.3curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed CVE-2025-101498.2The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store.
CVE-2025-10137: Medium severity, CVSS 5.4 | Vulnix