Post Slides <= 1.0.1 - Contributor+ Local File Inclusion

The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as with contributor or higher roles to perform LFI attacks

Problem type

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Unknown

Post Slides

<= 1.0.1 - AFFECTED

References

wpscan.com

https://wpscan.com/vulnerability/eb0424cc-e60c-44a5-aa24-cd1fe042b27a/

exploitvdb-entrytechnical-description

GitHub Security Advisories

GHSA-7gc8-w359-35hg

The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before...

https://github.com/advisories/GHSA-7gc8-w359-35hg

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2025-15491

wpscan.com

https://wpscan.com/vulnerability/eb0424cc-e60c-44a5-aa24-cd1fe042b27a

github.com

https://github.com/advisories/GHSA-7gc8-w359-35hg

JSON source

https://cveawg.mitre.org/api/cve/CVE-2025-15491

Click to expand

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2025-15491",
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "dateUpdated": "2026-02-07T06:00:06.979Z",
    "dateReserved": "2026-01-08T18:41:43.510Z",
    "datePublished": "2026-02-07T06:00:06.979Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan",
        "dateUpdated": "2026-02-07T06:00:06.979Z"
      },
      "title": "Post Slides <= 1.0.1 - Contributor+ Local File Inclusion",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as with contributor or higher roles to perform LFI attacks"
        }
      ],
      "affected": [
        {
          "vendor": "Unknown",
          "product": "Post Slides",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "versionType": "semver",
              "lessThanOrEqual": "1.0.1"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://wpscan.com/vulnerability/eb0424cc-e60c-44a5-aa24-cd1fe042b27a/",
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Khaled Alenazi (Nxploited)",
          "type": "finder"
        },
        {
          "lang": "en",
          "value": "WPScan",
          "type": "coordinator"
        }
      ]
    }
  }
}