CVE Database /
CVE-2025-10036
CVE · Medium
CVE-2025-10036 — Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2025-10036
|
Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
Medium
4.9
|
< 5.2.8
|
5.2.8 |
2025-09-25 |
—
|
CVE-2025-10036
The Featured Image from URL plugin for WordPress contains a security flaw in its get_all_urls function, which fails to properly sanitize user input, allowing malicious users with administrator privileges or higher to inject unauthorized SQL code into database queries and potentially access sensitive data. This vulnerability affects all versions up to 5.2.7, enabling attackers to exploit it and extract confidential information from the database.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings