High severity · published Nov 4, 2025
CVE-2025-10896
Multiple Plugins <= Multiple Versions - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Upload
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
Multiple plugins for WordPress with the Jewel Theme Recommended Plugins Library are vulnerable to Unrestricted Upload of File with Dangerous Type via arbitrary plugin installation in all versions up to, and including, 1.0.2.3. This is due to missing capability checks on the '*_recommended_upgrade_plugin' function which allows arbitrary plugin URLs to be installed. This makes it possible for authenticated attackers with subscriber-level access and above to upload arbitrary plugin packages to the affected site's server via a crafted plugin URL, which may make remote code execution possible.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Content Locker for Elementor · litonice13
through 1.0.3 · source: vendor
IC
Image Comparison Addon for Elementor · litonice13
through 1.0.2.2 · source: vendor
IH
Image Hover Effects for Elementor · litonice13
through 1.0.2.3 · source: vendor
MB
Master Blocks – Ultimate Gutenberg Blocks for Marketers · litonice13
through 1.4.1.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10896
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10896
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Assets.php#L70
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Recommended.php#L334
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Recommended.php#L43
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3384308%40image-hover-effects-elementor-addon&new=3384308%40image-hover-effects-elementor-addon
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389322%40image-comparison-elementor-addon&new=3389322%40image-comparison-elementor-addon
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389341%40content-locker-for-elementor&new=3389341%40content-locker-for-elementor&sfp_email=&sfph_mail=