What is the CVSS score of CVE-2025-52821?

CVE-2025-52821 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-52821?

A SQL injection vulnerability in Video List Manager versions up to 1.7 poses a high risk of unauthorized database access and potential data theft or manipulation.

How to fix or mitigate CVE-2025-52821?

Within 24 hours: inventory all systems running Video List Manager and isolate affected instances from production environments if possible; establish database access monitoring and alerts. Within 7 days: implement WAF rules blocking SQL injection patterns targeting the vulnerable plugin, apply database principle-of-least-privilege restrictions, and document all affected assets. Within 30 days: evaluate alternative video management solutions, contact vendor for patch timeline, and plan migration strategy with security validation.

Wordpress Plugin CVE-2025-52821

EUVD-2025-28472 HIGH

SQL Injection (CWE-89)

2025-06-20 audit@patchstack.com

WordPress SQLi Wordpress Plugin

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-28472

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 15:15 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in thanhtungtnt Video List Manager allows SQL Injection. This issue affects Video List Manager: from n/a through 1.7.

AnalysisAI

CVE-2025-52821 is a SQL Injection vulnerability in thanhtungtnt Video List Manager versions up to 1.7 that allows authenticated attackers to execute arbitrary SQL commands. The vulnerability has a CVSS score of 8.5 with high confidentiality impact and cross-site scope implications, meaning successful exploitation could lead to unauthorized data access and potential lateral movement within affected systems. While the attack requires valid credentials (PR:L), the network accessibility and low attack complexity make this a significant risk for organizations using this plugin.

Technical ContextAI

This vulnerability stems from improper neutralization of special SQL metacharacters (CWE-89) in the thanhtungtnt Video List Manager plugin. The root cause involves user-supplied input being directly concatenated or insufficiently sanitized before being passed to SQL query construction, allowing attackers to break out of intended query syntax and inject arbitrary SQL commands. This is a classic SQL Injection flaw typically occurring in database abstraction layers or ORM implementations where parameterized queries or prepared statements are not employed. The plugin likely processes video list data through database queries without proper input validation or parameterized query mechanisms, enabling attackers to manipulate query logic to extract, modify, or delete database records.

RemediationAI

Immediate actions: (1) Update thanhtungtnt Video List Manager to a patched version beyond 1.7 if available from the WordPress plugin repository or vendor; (2) If no patch is available, disable the plugin immediately until a fix is released; (3) Apply principle of least privilege—restrict plugin access to trusted administrative users only; (4) Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to the affected plugin; (5) Monitor database query logs for suspicious SQL syntax or unusual data access patterns. Long-term: require use of prepared statements/parameterized queries in all database interactions within the plugin code, conduct security code review, and implement input validation/output encoding standards. Check the WordPress plugin repository for version 1.8+ or later patches.