High severity7.2NVD Advisory· Published Nov 14, 2025· Updated Apr 15, 2026

CVE-2025-10686

Description

The Creta Testimonial Showcase WordPress plugin before 1.2.4 is vulnerable to Local File Inclusion. This makes it possible for authenticated attackers, with editor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Creta Testimonial Showcaseinferred
Range: <1.2.4
Package: https://wordpress.org/plugins/creta-testimonial-showcase
WordPress/Testimonials Showcasellm-fuzzy
Range: <1.2.4
Package: https://wordpress.org/plugins/testimonials-showcase

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/27d58c5a-ab87-41aa-a806-53fa96d4351c/nvd

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000