RCE in Kleor Easy Timer
CVE-2025-9519
The Easy Timer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.1 via the plugin's shortcodes. This is due to insufficient restriction of shortcode attributes. This makes it possible for authenticated attackers, with Editor-level access and above, to execute code on the server.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.008 (54.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Kleor Easy Timer — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-9519?
- CVE-2025-9519 is a high-severity vulnerability in Kleor Easy Timer, classified under Code Injection. CVSS score: 7.2/10. Published 2025-09-04.
- How severe is CVE-2025-9519?
- High severity. CVSS v3 base score is 7.2 out of 10.