Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-25081: Embed RSS may let unauthorized users access data

CVE-2025-25081 · published 1 year ago

Summary

The Embed RSS component (versions up to 3.1) does not properly check who can view its content, so someone without permission could see or manipulate the feed. This could expose internal information or allow unwanted changes. Upgrade to the latest version or adjust the access settings to require proper authorization.

Original advisory text

Missing Authorization vulnerability in DeannaS Embed RSS embed-rss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Embed RSS: from n/a through <= 3.1.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.2 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published7 Feb 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-25081 · NVD

Track software like this

Free during beta