CVE-2025-2809

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

The azurecurve Shortcodes in Comments plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Apr 10, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-280909.1maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.CVE-2025-280919.1maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.CVE-2025-280926.3ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.CVE-2025-280936.3ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.CVE-2025-280946.5shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.CVE-2025-280965.4OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers.CVE-2025-280975.5OneNav 1.1.0 is vulnerable to Cross Site Scripting (XSS) in custom headers.CVE-2025-280994.3opencms V2.3 is vulnerable to Arbitrary file read in src/main/webapp/view/admin/document/dataPage.jsp,CVE-2025-28105.5A low privileged local attacker can abuse the affected service by using a hardcoded cryptographic key.CVE-2025-281009.8A SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a attacker to execute arbitrary code via not filtering the content correctly at t CVE-2025-281016.5An arbitrary file deletion vulnerability in the /post/{postTitle} component of flaskBlog v2.6.1 allows attackers to delete article titles cr CVE-2025-281026.1A cross-site scripting (XSS) vulnerability in flaskBlog v2.6.1 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo