CVE-2021-25052: Wow-Company Button Generator

High severity, CVSS 8.8. EPSS: 3% chance of exploitation in the next 30 days.

The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.

Affected products

• Wow-Company Button Generator: before 2.3.3 (fixed in 2.3.3)

Published 2022-01-10. Last modified 2026-06-17.