SQL Injection Vulnerability in Specific Content For Mobile Plugin for WordPress
CVE-2025-11454
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 12 November 2025
What is CVE-2025-11454?
The Specific Content For Mobile – Customize the mobile version without redirections plugin for WordPress is susceptible to SQL Injection due to inadequate escaping of user-supplied parameters and insufficient preparation of SQL queries in the eos_scfm_duplicate_post_as_draft() function. This vulnerability enables authenticated attackers with Contributor-level access or higher to inject additional SQL queries into existing queries, potentially compromising sensitive information stored in the database.
Affected Version(s)
Specific Content For Mobile – Customize the mobile version without redirections * <= 0.5.5