What is the CVSS score of CVE-2025-62143?

CVE-2025-62143 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-62143

Q: Which versions of Wordpress Plugin are affected by CVE-2025-62143?

Post Video Players WordPress plugin through version 1.163 exposes sensitive embedded data to unauthorized users via improper information disclosure mechanisms.

MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2025-12-31 audit@patchstack.com

WordPress Information Disclosure Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 16:15 nvd

N/A

DescriptionCVE.org

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in nicashmu Post Video Players video-playlist-and-gallery-plugin allows Retrieve Embedded Sensitive Data.This issue affects Post Video Players: from n/a through <= 1.163.

AnalysisAI

Post Video Players WordPress plugin through version 1.163 exposes sensitive embedded data to unauthorized users via improper information disclosure mechanisms. The vulnerability allows attackers to retrieve sensitive system information that should be restricted from public access, affecting the plugin's core video playlist and gallery functionality. With an extremely low EPSS score of 0.04%, active exploitation appears minimal despite the information disclosure risk.

Technical ContextAI

The vulnerability stems from CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), which describes improper access controls on sensitive data. The Post Video Players plugin, which handles video playlist and gallery display on WordPress sites, fails to properly restrict access to embedded sensitive data. This likely involves inadequate capability checks or missing nonce verification on functions that expose metadata, configuration, or system information. WordPress plugins are particularly susceptible to this class of vulnerability when they expose database queries, API responses, or file paths without proper authentication or authorization verification.

Affected ProductsAI

The Post Video Players plugin (video-playlist-and-gallery-plugin) is affected in all versions from an unspecified initial release through version 1.163. The plugin is hosted on the WordPress plugin repository and serves as a video playlist and gallery tool for WordPress sites. The exact CPE designation would be cpe:2.3:a:nicashmu:post_video_players:*:*:*:*:*:wordpress:*:* with version range <=1.163. According to Patchstack reporting, this vulnerability affects the core plugin distribution available through WordPress.org.

RemediationAI

Users should update the Post Video Players plugin to a version newer than 1.163 once released by the vendor. Monitor the Patchstack vulnerability database and the official WordPress plugin repository for patched releases. In the interim, website administrators should review plugin configuration and access logs to identify any unauthorized data retrieval attempts and consider temporarily disabling the plugin if the exposed data is particularly sensitive. The primary advisory and vulnerability details are documented at https://patchstack.com/database/Wordpress/Plugin/video-playlist-and-gallery-plugin/vulnerability/wordpress-post-video-players-plugin-1-163-sensitive-data-exposure-vulnerability.