CVE-2025-6253

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.3.0 via the prepare_template() function due to a missing capability check and insufficient controls on the filename specified. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Aug 12, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-62549.8The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8. This is due to theCVE-2025-625498.8Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a netCVE-2025-62556.4The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ paramCVE-2025-625508.8Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network.CVE-2025-625527.8Relative path traversal in Microsoft Office Access allows an unauthorized attacker to execute code locally.CVE-2025-625537.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-625547.8Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-625557.0Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-625567.8Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-625577.8Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-625587.8Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-625597.8Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-6253: High severity, CVSS 7.5 | Vulnix