CVE-2025-1510
Published: 22 February 2025
Summary
CVE-2025-1510 is a high-severity Code Injection (CWE-94) vulnerability in Keesiemeijer Custom Post Type Date Archives. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-1510 is an arbitrary shortcode execution vulnerability in the Custom Post Type Date Archives plugin for WordPress, affecting all versions up to and including 2.7.1. The issue stems from the plugin allowing execution of an action that fails to properly validate a value prior to invoking the do_shortcode function, enabling attackers to inject and run arbitrary shortcodes. It is classified under CWE-94 (Improper Control of Generation of Code) with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges or user interaction. Exploitation allows execution of arbitrary shortcodes on the target WordPress site, potentially compromising confidentiality, integrity, and availability to a low degree depending on the shortcodes used and site configuration.
Mitigation details and further advisories are available from sources including the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/996ade9c-2531-4f43-87f6-eddb2ce98a12?source=cve and the plugin page at https://wordpress.org/plugins/custom-post-type-date-archives/. Security practitioners should check for plugin updates and review these resources for patching guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4450
Vulnerability details
The The Custom Post Type Date Archives plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.7.1. This is due to the software allowing users to execute an action that does not properly…
more
validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables remote unauthenticated arbitrary shortcode execution on a public-facing WordPress plugin, directly mapping to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of inputs before processing, preventing arbitrary shortcode execution due to insufficient validation prior to invoking do_shortcode.
Mandates identification, prioritization, and remediation of flaws like this plugin vulnerability through patching, eliminating the arbitrary shortcode execution risk.
Requires vulnerability scanning that would identify this known CVE in the Custom Post Type Date Archives plugin, enabling timely remediation.