WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection
CVE-2025-13652
Verified
Description
CBX Bookmark & Favorite WordPress plugin <= 2.0.4 contains a SQL injection caused by insufficient escaping of the 'orderby' parameter, letting authenticated attackers with Subscriber-level access extract sensitive database information
Severity
Critical
CVSS Score
9.1
Exploit Probability
1%
Affected Product
cbx-bookmark-favorite
Published Date
April 10, 2026
Template Author
neosmith1
CVE-2025-13652.yaml
9.1Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2025-13652
CWE ID:
cwe-89
Remediation Steps
Update to a version later than 2.0.4 or the latest available version.