CVE-2025-11377

13th percentile - higher than 13% of all known CVEs

The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 0.92.0 via the 'catlist' shortcode due to insufficient restrictions on which posts can be included. An authenticated attacker with Contributor-level access or higher can extract data from password-protected, private, or draft posts that they should not have access to.

An attacker with a Contributor account can access sensitive information such as private posts or drafts, potentially leading to data leakage. This may breach the confidentiality of the organization's content.

Update the List category posts plugin to a version later than 0.92.0. Restrict Contributor permissions and regularly review content access permissions.