Vulnerability details

CVE-2025-10686

Creta Testimonial Showcase

Creta Testimonial Showcase < 1.2.4 - Editor+ Local File Inclusion

CVSS 3.1

7.2High

Official description

The Creta Testimonial Showcase WordPress plugin before 1.2.4 is vulnerable to Local File Inclusion. This makes it possible for authenticated attackers, with editor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files.

CVSS scores

Score	Version	Source	Vector
7.2High	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
—	Creta Testimonial Showcase	v < 1.2.4	CVEProject cvelistV5 (CNA)

References and advisories

https://wpscan.com/vulnerability/27d58c5a-ab87-41aa-a806-53fa96d4351c/ exploitvdb-entrytechnical-description

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-11-14
Last updated: 2025-11-14
State: Published
Assigner (CNA): WPScan

Exploit prediction (EPSS)

0.52%

Probability of exploitation in 30 days

44.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total