Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

Soledad WordPress Theme: Unauthenticated Shortcode Execution

CVE-2025-8105 · published 1 year ago
Summary

The Soledad theme for WordPress is vulnerable to a security risk that allows attackers to run unauthorized code on your site. This can happen if an attacker sends malicious code to your site, without needing a password. To protect your site, update to a newer version of the Soledad theme, or consider switching to a more secure theme.

Original advisory text
The The Soledad theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.6.7. This is due to the software allowing users to execute an action that ...
The The Soledad theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.6.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published16 Aug 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-8105 · NVD
Track software like this
Free during beta