Code Injection Vulnerability in Jose Content No Cache by WordPress
CVE-2025-28993

8.6HIGH

Key Information:

Vendor

WordPress
Status
Content No Cache
Vendor
CVE Published:
27 June 2025

What is CVE-2025-28993?

A vulnerability in the Jose Content No Cache plugin allows for improper control of code generation, leading to potential code injection scenarios. This flaw affects all versions up to and including 0.1.3. Attackers could exploit this weakness to execute arbitrary code, compromising the security and integrity of WordPress sites utilizing this plugin. Users are advised to review their installations and apply necessary updates to safeguard against this risk.

Affected Version(s)

Content No Cache <= 0.1.3

References

https://patchstack.com/database/wordpress/plugin/content-...
vdb-entry

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HLog (Patchstack Alliance)
.
CVE-2025-28993 : Code Injection Vulnerability in Jose Content No Cache by WordPress