High severity · published Aug 12, 2025
CVE-2025-8418
B Slider- Gutenberg Slider Block for WP <= 1.1.30 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Plugin Installation
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 1.1.30. This is due to missing capability checks on the activated_plugin function. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server which can make remote code execution possible.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
bSlider – Create Responsive Image, Post, Product, and Video Sliders · bplugins
through 1.1.30 · source: vendor
Affected product
BC
bSlider – Create Responsive Image, Post, Product, and Video Sliders
bplugins
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8418
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8418
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/b-slider/tags/1.1.28/adminMenu.php#L124
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3342079/b-slider/trunk/adminMenu.php
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/deffd646-5117-4086-bf4b-8a17ffdaad8b?source=cve
More from bSlider – Create Responsive Image, Post, Product, and Video Sliders
4.3
CVE-2025-8676
B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Sensitive Information Exposure
4.3
CVE-2025-8680
B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery
4.3
CVE-2024-13514
B Slider- Gutenberg Slider Block for WP <= 1.1.23 - Authenticated (Contributor+) Private Post Disclosure via bsb-slider Shortcode