Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through <= 6.5.8.
Published: 2025-03-15
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a classic SQL injection flaw (CWE‑89) in the FS Poster WordPress plugin, allowing an attacker to craft input that is directly incorporated into SQL commands. By exploiting this flaw, an adversary can read, modify, or delete data stored in the WordPress database, potentially exposing sensitive user information or tampering with site content.

Affected Systems

The issue affects the "FS Poster" plugin provided by fs‑code, impacting all installations from any version up through 6.5.8. The vendor list includes only this single plugin.

Risk and Exploitability

The CVSS score of 8.5 rates the vulnerability as high, and the EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is through web requests that target the plugin’s database query endpoints; the description implies that the flaw is triggered by user-supplied data within HTTP requests.

Generated by OpenCVE AI on May 1, 2026 at 13:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FS Poster to a version newer than 6.5.8, ensuring the vendor’s patch contains the fix.
  • Restrict access to the plugin’s administrative and API interfaces so that only trusted, authenticated users can send requests that trigger its SQL logic.
  • Perform a thorough database audit to detect any anomalous changes or evidence of prior exploitation.

Generated by OpenCVE AI on May 1, 2026 at 13:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-6649 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound FS Poster. This issue affects FS Poster: from n/a through 6.5.8.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound FS Poster. This issue affects FS Poster: from n/a through 6.5.8. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through <= 6.5.8.
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}

Tue, 15 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.0004}

 epss

{'score': 0.00055}

Mon, 17 Mar 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 15 Mar 2025 22:15:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound FS Poster. This issue affects FS Poster: from n/a through 6.5.8.
Title WordPress FS Poster plugin <= 6.5.8 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:11:45.683Z

Reserved: 2025-02-17T11:51:47.717Z

Link: CVE-2025-26978

cve-icon Vulnrichment

Updated: 2025-03-17T16:09:46.708Z

cve-icon NVD

Status : Deferred

Published: 2025-03-15T22:15:15.553

Modified: 2026-04-23T15:26:10.563

Link: CVE-2025-26978

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T13:45:06Z

Weaknesses