ByteOS Network

Vulnerability Details :

CVE-2025-52744

Assigner Org ID-21595511-bba5-4825-b968-b78d1f9984a3

Published At-20 Feb, 2026 | 15:46

Updated At-25 Feb, 2026 | 20:51

WordPress Inpersttion For Theme plugin <= 1.0 - Arbitrary Code Execution vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in inpersttion Inpersttion For Theme err-our-team allows Code Injection.This issue affects Inpersttion For Theme: from n/a through <= 1.0.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:Patchstack

Assigner Org ID:21595511-bba5-4825-b968-b78d1f9984a3

Published At:20 Feb, 2026 | 15:46

Updated At:25 Feb, 2026 | 20:51

▼CVE Numbering Authority (CNA)

WordPress Inpersttion For Theme plugin <= 1.0 - Arbitrary Code Execution vulnerability

Affected Products

Vendor

inpersttion

Product

Inpersttion For Theme

Collection URL

https://wordpress.org/plugins

Package Name

err-our-team

Default Status

unaffected

Versions

Affected

From n/a through <= 1.0 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-94	Improper Control of Generation of Code ('Code Injection')

Type: CWE

CWE ID: CWE-94

Description: Improper Control of Generation of Code ('Code Injection')

Impacts

CAPEC ID	Description
CAPEC-242	Code Injection

CAPEC ID: CAPEC-242

Description: Code Injection

Credits

finder

Peter Thaleikis | Patchstack Bug Bounty Program

References

Hyperlink	Resource
https://patchstack.com/database/Wordpress/Plugin/err-our-team/vulnerability/wordpress-inpersttion-for-theme-plugin-1-0-arbitrary-code-execution-vulnerability?_s_id=cve	vdb-entry

Hyperlink: https://patchstack.com/database/Wordpress/Plugin/err-our-team/vulnerability/wordpress-inpersttion-for-theme-plugin-1-0-arbitrary-code-execution-vulnerability?_s_id=cve

Resource:

vdb-entry

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics

Version	Base score	Base severity	Vector
3.1	7.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Version: 3.1

Base score: 7.6

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:audit@patchstack.com

Published At:20 Feb, 2026 | 16:22

Updated At:25 Feb, 2026 | 21:16

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Type: Secondary

Version: 3.1

Base score: 7.6

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Weaknesses

CWE ID	Type	Source
CWE-94	Secondary	audit@patchstack.com

CWE ID: CWE-94

Type: Secondary

Source: audit@patchstack.com

References

Hyperlink	Source	Resource
https://patchstack.com/database/Wordpress/Plugin/err-our-team/vulnerability/wordpress-inpersttion-for-theme-plugin-1-0-arbitrary-code-execution-vulnerability?_s_id=cve	audit@patchstack.com	N/A

Hyperlink: https://patchstack.com/database/Wordpress/Plugin/err-our-team/vulnerability/wordpress-inpersttion-for-theme-plugin-1-0-arbitrary-code-execution-vulnerability?_s_id=cve

Source: audit@patchstack.com

Resource: N/A

Similar CVEs

6Records found

CVE-2025-8905

Matching Score-6

Assigner-Wordfence

View Details

Matching Score-6

Assigner-Wordfence

CVSS Score-6.3||MEDIUM

EPSS-0.26% / 49.31%

7 Day CHG~0.00%

Published-15 Aug, 2025 | 08:25

Updated-15 Aug, 2025 | 16:07

Inpersttion For Theme <= 1.0 - Authenticated (Contributor+) Arbitrary Function Call

The Inpersttion For Theme plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the theme_section_shortcode() function. This is due to the plugin not restricting what functions can be called. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server which is limited to arbitrary functions without any user supplied parameters.

Vendor-inpersttion

Product-Inpersttion For Theme

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2024-27191

Matching Score-6

Assigner-Patchstack

View Details

Matching Score-6

Assigner-Patchstack

CVSS Score-8.5||HIGH

EPSS-1.01% / 76.78%

7 Day CHG~0.00%

Published-03 Apr, 2024 | 12:04

Updated-19 Aug, 2024 | 19:27

WordPress Slivery Extender plugin <= 1.0.2 - Auth. Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Inpersttion Slivery Extender allows Code Injection.This issue affects Slivery Extender: from n/a through 1.0.2.

Vendor-Inpersttion inpersttion

Product-Slivery Extender slivery_extender

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2024-48279

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.6||HIGH

EPSS-0.69% / 71.55%

7 Day CHG~0.00%

Published-15 Oct, 2024 | 00:00

Updated-31 Mar, 2025 | 17:19

A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2. This vulnerability allows remote attackers to execute arbitrary HTML code via the searchkey parameter in a POST HTTP request.

Vendor-n/a PHPGurukul LLP

Product-user_registration_\&_login_and_user_management_system n/a user_registration_and_login_and_user_management_system

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2024-46639

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.6||HIGH

EPSS-0.06% / 17.44%

7 Day CHG~0.00%

Published-23 Sep, 2024 | 00:00

Updated-26 Sep, 2024 | 13:32

A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box.

Vendor-n/a evolutionscript

Product-n/a helpdeskz

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2024-36581

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.6||HIGH

EPSS-0.07% / 20.94%

7 Day CHG~0.00%

Published-17 Jun, 2024 | 00:00

Updated-02 Aug, 2024 | 03:37

A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm.

Vendor-n/a prototype_solution

Product-n/a abw_badger_database

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2023-5044

Matching Score-4

Assigner-Kubernetes

View Details

Matching Score-4

Assigner-Kubernetes

CVSS Score-7.6||HIGH

EPSS-8.74% / 92.34%

7 Day CHG~0.00%

Published-25 Oct, 2023 | 19:19

Updated-12 Jun, 2025 | 14:53

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.

Vendor-Kubernetes

Product-ingress-nginx ingress-nginx

CWE ID-CWE-20

Improper Input Validation

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2025-52744

Credits

WordPress Inpersttion For Theme plugin <= 1.0 - Arbitrary Code Execution vulnerability

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs