EUVD-2025-17490CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon allows XML Entity Linking. This issue affects Category Icon: from n/a through 1.0.2.
Analysis
CVE-2025-31039 is an XML External Entity (XXE) injection vulnerability in the Pixelgrade Category Icon WordPress plugin (versions through 1.0.2) that allows authenticated attackers with high privileges to read arbitrary files, execute remote code, or cause denial of service through improper XML entity validation. The vulnerability has a critical CVSS score of 9.1 but requires administrator-level privileges to exploit; active exploitation status and proof-of-concept availability are not confirmed from the provided intelligence.
Technical Context
This vulnerability exploits CWE-611 (Improper Restriction of XML External Entity Reference), a class of attacks where XML parsers are configured to process external entity definitions without proper validation. The Category Icon plugin likely processes XML input (potentially from user-uploaded files, plugin configuration, or API responses) without disabling XXE protections in its XML parser. This could affect PHP's SimpleXML, DOMDocument, or similar parsing libraries. The 'XML Entity Linking' description suggests the vulnerability allows attackers to define custom entity references pointing to local files (file:// protocol) or remote resources, enabling information disclosure or server-side request forgery (SSRF). The affected product is CPE wp:plugin:pixelgrade-category-icon through version 1.0.2; remediation likely requires updating to a patched version (not specified in provided data) or disabling XXE processing via PHP configuration (libxml_disable_entity_loader, etc.).
Affected Products
Category Icon (1.0.2 and earlier)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today