CVE-2025-9199

Woo superb slideshow transition gallery with random effect <= 9.1 - Authenticated (Contributor+) SQL Injection

Published Oct 3, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slideshow' shortcode in all versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Analysis

Technical impact

The affected WordPress plugin processes the 'woo-superb-slideshow' shortcode with a parameter that is not properly escaped, creating an SQL injection vector. Exposing this flaw allows authenticated users with Contributor+ privileges to append arbitrary SQL statements to the existing database query. The attacker could exfiltrate sensitive data from the WordPress database, compromising confidentiality without affecting availability.

Affected Systems

WordPress users running the gopiplus Woo superb slideshow transition gallery with random effect plugin in versions 9.1 and earlier are affected. The vulnerability exists in all releases up to and including 9.1, regardless of package/installation method.

Risk and Exploitability

With a CVSS score of 6.5, this vulnerability carries a moderate severity. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Nevertheless, because the payload requires only Contributor+ level access, an attacker who gains or already possesses such privileges could exploit the flaw, and the injection could be performed from within the WordPress administration interface.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

gopiplus

Woo superb slideshow transition gallery with random effect

unaffected

Version	Status	Constraints
`0`	affected	≤ 9.1

No data.

Vendor	Product	Versions
Gopiplus	Woo Superb Slideshow Transition Gallery	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Woo superb slideshow transition gallery with random effect plugin to a version newer than 9.1 (or apply the vendor‑supplied patch if available).
If an upgrade is not immediately possible, remove or disable the plugin until a fix is applied.
Limit Contributor+ and higher roles to trusted users only, and closely monitor role assignments.
As a temporary protective measure, implement a web‑application firewall rule that blocks unexpected SQL syntax patterns in requests that contain the 'woo-superb-slideshow' shortcode.

Generated by OpenCVE AI on April 21, 2026 at 02:35 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-32264	The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slideshow' shortcode in all versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.283% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://plugins.trac.wordpress.org/browser/woo-superb-slideshow-transition-gallery-with-random-effect/trunk/woo-superb-slideshow-transition-gallery-with-random-effect.php#L61
https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4c42e6-92f3-4c2f-8748-877c6df39e62?source=cve

History

Nov 24, 2025 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 6, 2025 2:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Gopiplus Gopiplus woo Superb Slideshow Transition Gallery Wordpress Wordpress wordpress
Vendors & Products		Gopiplus Gopiplus woo Superb Slideshow Transition Gallery Wordpress Wordpress wordpress

Oct 3, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 3, 2025 11:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slideshow' shortcode in all versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Title		Woo superb slideshow transition gallery with random effect <= 9.1 - Authenticated (Contributor+) SQL Injection
Weaknesses		CWE-89
References		https://plugins.trac.wordpress.org/browser/woo-superb-slideshow-transition-gallery-with-random-effect/trunk/woo-superb-slideshow-transition-gallery-with-random-effect.php#L61 https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4c42e6-92f3-4c2f-8748-877c6df39e62?source=cve
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`