CVE-2025-10380

The Advanced Views – Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 3.7.19. This is due to insufficient input sanitization and lack of access control when processing custom Twig templates in the Model panel. This makes it possible for authenticated attackers, with author-level access or higher, to execute arbitrary PHP code and commands on the server.

• CWE-1336

• https://plugins.trac.wordpress.org/browser/acf-views/tags/3.7.19/src/Template_Engines/Twig.php#L106
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3364566%40acf-views&new=3364566%40acf-views&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/52b04517-f0be-4bbf-818c-70a12d76bfec?source=cve

Published

Sep 23, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10373A security vulnerability has been detected in Portabilis i-E…6.1
• CVE-2025-10374A security flaw has been discovered in Shenzhen Sixun Busine…7.3
• CVE-2025-10375The Web Accessibility By accessiBe plugin for WordPress is v…4.3
• CVE-2025-10376The Course Redirects for Learndash plugin for WordPress is v…4.3
• CVE-2025-10377The System Dashboard plugin for WordPress is vulnerable to C…4.3
• CVE-2025-1038The “Diagnostics Tools” page of the web-based configuration …7.5
• CVE-2025-10383The Contest Gallery – Upload, Vote & Sell with PayPal and St…6.4
• CVE-2025-10384A flaw has been found in yangzongzhuan RuoYi up to 4.8.1. Af…5.4
• CVE-2025-10385A vulnerability has been found in Mercury KM08-708H GiGA WiF…8.8
• CVE-2025-10386A vulnerability was found in Yida ECMS Consulting Enterprise…4.3
• CVE-2025-10387A vulnerability was determined in codesiddhant Jasmin Ransom…8.8
• CVE-2025-10388A vulnerability was identified in Selleo Mentingo 2025.08.27…3.5