CVE-2025-8105

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

The The Soledad theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.6.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Aug 16, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-81076.3In OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-level access by executi CVE-2025-81086.7An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This v CVE-2025-81098.8Software installed and run as a non-privileged user may conduct ptrace system calls to issue writes to GPU origin read only memory.CVE-2025-81108.8Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.CVE-2025-81136.1The Ebook Store WordPress plugin before 5.8015 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribu CVE-2025-81144.7A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) proces CVE-2025-81155.4A vulnerability has been found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this vulnerability CVE-2025-81166.1PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft special URL, which will resul CVE-2025-81177.5PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset pas CVE-2025-81186.5PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_timeout. Information about attem CVE-2025-81194.3PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which w CVE-2025-81209.8Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to uploa