by Kastro
Paper/Archive/CVE-2025-14892

CVE-2025-14892

Unknown Prime Listing Manager — Prime Listing Manager <= 1.1 - Unauthenticated Privilege Escalation

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 35.5.355 × 207.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Prime Listing Manager WordPress plugin through 1.1 allows an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions due to a hardcoded secret.

Affected

ProductAffectedFixed inSource
Prime Listing Manager≤ 1.1–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/d12332ec-1d0c-4ff5-94e0-7c4470bdb79c