Now officially on WordPress.org

CVE Database / CVE-2025-10037

CVE · Medium

CVE-2025-10037 — Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2025-10037 Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Medium 4.9 < 5.2.8 5.2.8 2025-09-25 —

CVE-2025-10037

The Featured Image from URL plugin for WordPress contains a security flaw in its get_posts_with_internal_featured_image function, affecting all versions up to 5.2.7. This vulnerability allows attackers with elevated access rights to inject malicious SQL code into existing queries, potentially revealing sensitive database information. The issue stems from inadequate protection against user-supplied input and insufficient sanitization of the underlying SQL query.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings