CVE-2025-15700

HighCVSS 8.8/10Last modified Oct 19, 2026

Description

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
UnknownAWP Classifieds< 4.4.9

References

Timeline

Published
Oct 9, 2026
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-157013.5The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end paCVE-2025-157028.8The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing uCVE-2025-157033.5The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back iCVE-2025-157053.5The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the forCVE-2025-157083.5The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them CVE-2025-15715.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and ImagCVE-2025-157113.5The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an hrefCVE-2025-157123.5The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outputting them in pCVE-2025-157133.5The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting thCVE-2025-157143.5The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on CVE-2025-15728.8The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_id’ parameter in all CVE-2025-15754.3A vulnerability classified as problematic has been found in Harpia DiagSystem 12. Affected is an unknown function of the file /diagsystem/PA
CVE-2025-15700: High severity, CVSS 8.8 | Vulnix