SQL Injection Vulnerability in List Category Posts Plugin for WordPress

CVE-2025-10163

What is CVE-2025-10163?

The List Category Posts Plugin for WordPress is susceptible to a time-based SQL Injection through the ‘starting_with’ parameter in the catlist shortcode. This vulnerability arises from inadequate escaping of user-supplied data and poor query preparation. Authenticated attackers with Contributor-level access can exploit this flaw to execute additional SQL queries, potentially leading to unauthorized access and extraction of sensitive information from the database.

References