CVE-2025-15491

5.5 mediumEPSS 0.3%

Medium (5.5). EPSS 0.3% chance of exploitation in the next 30 days.

The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as with contributor or higher roles to perform LFI attacks

Severity

CVSS 3.1

5.5 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2026-02-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/eb0424cc-e60c-44a5-aa24-cd1fe042b27a/

Check your stack JSON