CVE-2025-48091: WordPress AnyComment plugin <= 0.3.6 - SQL Injection vulnerability

Q: Who is exposed to this vulnerability?

Sites using the AnyComment plugin are affected through version 0.3.6. The provided data does not identify any unaffected fixed version.

Q: What access does an attacker need?

The CVSS vector indicates an attacker needs network access and low-level privileges, with no user interaction required. The issue can impact confidentiality and availability beyond the initially vulnerable component scope.

Published Oct 22, 2025

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alexander AnyComment anycomment allows SQL Injection.This issue affects AnyComment: from n/a through <= 0.3.6.

Affected Software

2 affected components

Alexander AnyComment<=0.3.6

WordPress AnyComment<=0.3.6

Event History

Oct 22, 2025

CVE Published

via MITRE·02:32 PM

Data Sourced

via MITRE·02:32 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Sites using the AnyComment plugin are affected through version 0.3.6. The provided data does not identify any unaffected fixed version.

What access does an attacker need?

The CVSS vector indicates an attacker needs network access and low-level privileges, with no user interaction required. The issue can impact confidentiality and availability beyond the initially vulnerable component scope.

CVE-2025-48091: WordPress AnyComment plugin <= 0.3.6 - SQL Injection vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

What access does an attacker need?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What access does an attacker need?