CVE-2025-30590

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dourou Flickr set slideshows flickr-set-slideshows allows SQL Injection.This issue affects Flickr set slideshows: from n/a through <= 0.9.

Overview

State: PUBLISHED
Assigner (CNA): Patchstack
CVSS severity: HIGH
CVSS score: 8.5 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Effective score: 8.5 / 10 HIGH source: CNA overview
CWE(s): CWE-89
Reserved: 2025-03-24
Published: 2025-03-24 14:47 UTC
Last updated: 2026-04-28 18:11 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30590.json
Linked Threat: CVE-2025-30590 — Flickr set slideshows <= 0.9 - Authenticated (Contributor+) SQL Injection

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2025-03-24 14:15:31 UTC
NVD last modified: 2026-06-17 09:08:58 UTC
NVD CVSS v3.1: 8.5 / 10 HIGH source: audit@patchstack.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Exploitability subscore: 3.1 / 10
Impact subscore: 4.7 / 10
EPSS score: 0.0039 (probability of exploitation in next 30 days)
EPSS percentile: 31.46% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2025-7931
Assigner: Patchstack
Published: Mar 24, 2025, 1:47:15 PM
Updated: Apr 28, 2026, 4:11:54 PM
EUVD base score (CVSS 3.1): 8.5 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
EUVD-reported EPSS: 0.1100
Vendors: Dourou
Products: Flickr set slideshows (0 ≤0.9)

Flickr set slideshows (n/a ≤0.9)
Aliases: GHSA-vr3r-vj49-p3w8

ENISA description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dourou Flickr set slideshows flickr-set-slideshows allows SQL Injection.This issue affects Flickr set slideshows: from n/a through <= 0.9.

EUVD references (1)

https://patchstack.com/database/Wordpress/Plugin/flickr-set-slideshows/vulnerability/wordpress-flickr-set-slideshows-0-9-sql-injection-vulnerability?_s_id=cve

Affected products (1)

Vendor	Product	Versions	Platforms
Dourou	Flickr set slideshows	`0` (affected)	—

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://patchstack.com/database/Wordpress/Plugin/flickr-set-slideshows/vulnerability/wordpress-flickr-set-slideshows-0-9-sql-injection-vulnerability?_s_id=cve vdb-entry

MITRE references (1) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://patchstack.com/database/Wordpress/Plugin/flickr-set-slideshows/vulnerability/wordpress-flickr-set-slideshows-0-9-sql-injection-vulnerability?_s_id=cve vdb-entry

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (1)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://patchstack.com/database/Wordpress/Plugin/flickr-set-slideshows/vulnerability/wordpress-flickr-set-slideshows-0-9-sql-injection-vulnerability?_s_id=cve audit@patchstack.com

Indicators (2)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
domain	`injection.this`	no local data	2026-05-18 21:19 UTC
cve	`CVE-2025-30590`	no local data	2026-06-06 13:52 UTC

Remediations (14)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Wordfence remediation: Flickr set slideshows

Wordfence

No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

2026-06-06 13:52 UTC
May 2025 Windows Patch Tuesday: Critical Zero-Days and Security ...

web:windowsforum.com

In the wake of the May 2025 Patch Tuesday, Microsoft has once again underscored its critical role in defending the world's most widely used operating system. With a security update repatching 72 unique vulnerabilities—among which five were actively exploited zero-days and two were publicly disclosed as zero-days before a fix was available—Windows administrators and enterprise IT security ...

2026-05-22 13:08 UTC
Microsoft's Patch Tuesday updates: Keeping up with the latest fixes

web:www.computerworld.com

Here's a look at the most recent Patch Tuesday release from Microsoft as well as a collection of recent updates so you can track what's changed.

2026-05-22 13:08 UTC
Patch Tuesday - Cisco Talos Blog

web:blog.talosintelligence.com

Microsoft Patch Tuesday for October 2025 — Snort rules and prominent vulnerabilities Microsoft has released its monthly security update for October 2025 , addressing 175 Microsoft CVEs and 21 non-Microsoft CVEs . Among these, 17 vulnerabilities are considered critical and 11 are flagged as important and considered more likely to be exploited.

2026-05-22 13:08 UTC
Microsoft September 2025 Patch Tuesday fixes 81 flaws, two zero-days

web:www.bleepingcomputer.com

Today is Microsoft's September 2025 Patch Tuesday, which includes security updates for 81 flaws, including two publicly disclosed zero-day vulnerabilities.

2026-05-22 03:20 UTC
Microsoft and Adobe Patch Tuesday, October 2025 Security Update Review

web:blog.qualys.com

As cybersecurity threats evolve, Microsoft's October 2025 Patch Tuesday delivers one of the most comprehensive security updates of the year. Here's a quick breakdown of what you need to know.

2026-05-22 03:20 UTC
ArcGIS Server Security 2025 Update 2 Patch - Esri

web:www.esri.com

Key highlights The ArcGIS Server Security 2025 update 2 is available This patch resolves 10 Medium severity vulnerabilities This security patch is cumulative, and includes fixes provided in the ArcGIS Server Security 2025 update 1.

2026-05-22 03:20 UTC
Latest Windows Update Problems and How to Fix Them

web:www.maketecheasier.com

Check out the latest Windows 11 and Windows 10 update problems and their solutions, as recommended by Microsoft experts.

2026-05-22 03:20 UTC
Patch Tuesday - October 2025 - Rapid7

web:www.rapid7.com

Microsoft has published 172 new vulnerabilities, including six zero-day vulnerabilities. Windows 10 moves past the end of support, sort of. Critical RCE in Windows Server Update Service.

2026-05-22 03:20 UTC
Patch Tuesday 2025 Year In Review | Tenable®

web:www.tenable.com

Key takeaways: Microsoft's 2025 Patch Tuesday releases addressed 1,130 CVEs . This is the second year in a row where the CVE count was over 1,000. Elevation of Privilege vulnerabilities accounted for 38.3% of all Patch Tuesday vulnerabilities in 2025 , followed by Remote Code Execution flaws at 30.8%. 41 zero-day vulnerabilities were addressed across all Patch Tuesday releases in 2025 , including ...

2026-05-22 03:20 UTC
UPDATE: Microsoft Releases Guidance on Exploitation of ... - CISA

web:www.cisa.gov

. For more information see MAR-251132.c1.v1 Exploitation of SharePoint Vulnerabilities and CISA Releases Malware Analysis Report Associated with Microsoft SharePoint Vulnerabilities. Update (07/31/ 2025 ): CISA has updated this alert to provide clarification on antivirus and endpoint detection and response (EDR) solutions, and details regarding mitigations related to the IIS server. Update (07 ...

2026-05-22 03:20 UTC
Microsoft Patch Tuesday October 2025 - SANS ISC

web:isc.sans.edu

Microsoft Patch Tuesday October 2025 , Author: Johannes Ullrich

2026-05-22 03:20 UTC
Patch Tuesday, October 2025 'End of 10' Edition

web:krebsonsecurity.com

October's Patch Tuesday also marks the final month that Microsoft will ship security updates for Windows 10 systems.

2026-05-22 03:20 UTC
Security Update Guide - Loading - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-22 03:20 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2025-30590.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30590",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-25T17:47:05.235168Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T17:48:52.946Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "flickr-set-slideshows",
          "product": "Flickr set slideshows",
          "vendor": "Dourou",
          "versions": [
            {
              "lessThanOrEqual": "0.9",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "timomangcut | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:36:12.797Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dourou Flickr set slideshows flickr-set-slideshows allows SQL Injection.<p>This issue affects Flickr set slideshows: from n/a through <= 0.9.</p>"
            }
          ],
          "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dourou Flickr set slideshows flickr-set-slideshows allows SQL Injection.This issue affects Flickr set slideshows: from n/a through <= 0.9."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:11:54.920Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/flickr-set-slideshows/vulnerability/wordpress-flickr-set-slideshows-0-9-sql-injection-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Flickr set slideshows plugin <= 0.9 - SQL Injection Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-30590",
    "datePublished": "2025-03-24T13:47:15.268Z",
    "dateReserved": "2025-03-24T13:00:32.064Z",
    "dateUpdated": "2026-04-28T16:11:54.920Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}