CVE-2025-15491: Unknown Post Slides

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as with contributor or higher roles to perform LFI attacks

Affected products

• Unknown Post Slides: up to and including 1.0.1

Published 2026-02-07. Last modified 2026-06-17.