CVE-2025-7327

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via the layout parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This is limited to just PHP files.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-98

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-73289.8Multiple Broken Authentication security issues exist in the affected product. The security issues are due to missing authentication checks o CVE-2025-73294.8A Stored Cross-Site Scripting security issue exists in the affected product that could potentially allow a malicious user to view and modify CVE-2025-73306.5A cross-site request forgery security issue exists in the product and version listed. The vulnerability stems from missing CSRF checks on th CVE-2025-73376.5An issue has been discovered in GitLab CE/EE affecting all versions from 7.8 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that CVE-2025-73387.5Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior CVE-2025-73393.4on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in resp CVE-2025-73409.8The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file CVE-2025-73419.8The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file CVE-2025-73427.5A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process CVE-2025-73439.8The SFT developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands t CVE-2025-73448.8The EAI developed by Digiwin has a Privilege Escalation vulnerability, allowing remote attackers with regular privileges to elevate their pr CVE-2025-73457.5A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/g