Server-Side Template Injection in Advanced Views Plugin for WordPress
CVE-2025-10380
8.8HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 23 September 2025
What is CVE-2025-10380?
The Advanced Views – Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to and including 3.7.19. This vulnerability arises due to inadequate input sanitization and a lack of access control during the processing of custom Twig templates in the Model panel. Authenticated attackers with author-level access or higher can exploit this issue to execute arbitrary PHP code on the server, potentially compromising the site's security.
Affected Version(s)
Advanced Views – Display Posts, Custom Fields, and More * <= 3.7.19