CVE-2025-49897

WordPress Vertical scroll slideshow gallery v2 plugin <= 9.1 - SQL Injection vulnerability

View on CVE.org
Published Aug 15, 2025 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Vertical scroll slideshow gallery v2 allows Blind SQL Injection. This issue affects Vertical scroll slideshow gallery v2: from n/a through 9.1.

Analysis

AI-generated

Technical impact

The vulnerability is an SQL Injection flaw that allows attackers to inject SQL commands into the plugin’s queries, resulting in a blind SQL injection attack. This weakness can lead to unauthorized retrieval or modification of database contents, thereby compromising the confidentiality and integrity of data stored by the WordPress site.

Affected Systems

The flaw exists in the gopiplus Vertical scroll slideshow gallery v2 plugin, affecting all releases from the initial version through 9.1. Characters such as the plugin name and version range are explicitly listed as impacted.

Risk and Exploitability

The CVSS score of 8.8 signals a high severity level, while the EPSS score of less than 1% indicates that known exploitation attempts are currently rare. The vulnerability is not listed in CISA’s KEV, which suggests it has not yet been documented as actively exploited in the field. Exploitation is possible from a web request targeting the plugin’s endpoints, and the attack does not require privileged user access—making it a plausible threat for remote attackers.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the gopiplus Vertical scroll slideshow gallery v2 plugin to a version newer than 9.1.
  • If an update is not yet available, disable or remove the plugin entirely from the site to eliminate the attack surface.
  • Deploy a Web Application Firewall with SQL injection protection rules to block malicious requests targeting the plugin’s endpoints.
  • Restrict the database user privileges to read‑only where feasible, limiting potential damage from exploitation.
  • Monitor web and database logs for signs of SQL injection attempts and respond promptly to anomalies.

Generated by OpenCVE AI on May 1, 2026 at 06:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-25028 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Vertical scroll slideshow gallery v2 allows Blind SQL Injection. This issue affects Vertical scroll slideshow gallery v2: from n/a through 9.1.
History
Type Values Removed Values Added
Description Incorrect Privilege Assignment vulnerability in gopiplus School Management school-management allows Privilege Escalation.This issue affects School Management: from n/a through <= 93.2.0. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Vertical scroll slideshow gallery v2 allows Blind SQL Injection. This issue affects Vertical scroll slideshow gallery v2: from n/a through 9.1.
Title WordPress School Management Plugin <= 93.2.0 - Privilege Escalation Vulnerability WordPress Vertical scroll slideshow gallery v2 plugin <= 9.1 - SQL Injection vulnerability
Weaknesses CWE-89
References
Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Vertical scroll slideshow gallery v2 allows Blind SQL Injection. This issue affects Vertical scroll slideshow gallery v2: from n/a through 9.1. Incorrect Privilege Assignment vulnerability in gopiplus School Management school-management allows Privilege Escalation.This issue affects School Management: from n/a through <= 93.2.0.
Title WordPress Vertical scroll slideshow gallery v2 plugin <= 9.1 - SQL Injection vulnerability WordPress School Management Plugin <= 93.2.0 - Privilege Escalation Vulnerability
Weaknesses CWE-266
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Gopiplus
Gopiplus vertical Scroll Slideshow Gallery V2
Wordpress
Wordpress wordpress
Vendors & Products Gopiplus
Gopiplus vertical Scroll Slideshow Gallery V2
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Vertical scroll slideshow gallery v2 allows Blind SQL Injection. This issue affects Vertical scroll slideshow gallery v2: from n/a through 9.1.
Title WordPress Vertical scroll slideshow gallery v2 plugin <= 9.1 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}
Earlier changes (2)
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:13 PM
Reserved
Jun 11, 2025, 4:06 PM

View source JSON

Updated
Aug 15, 2025, 7:10 PM

JSON

Status
Deferred
Published
Aug 15, 2025, 4:15 PM
Modified
Jun 17, 2026, 9:32 AM

View source JSON

No data.

Updated
May 1, 2026, 6:45 AM

JSON