CVE-2025-60095

MediumCVSS 4.3

Published: 26/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

The Stackable plugin for WordPress has an insertion of sensitive information into sent data vulnerability that allows retrieval of embedded sensitive data. This issue affects versions from n/a through 3.18.1.

Risk Assessment

An attacker could access sensitive information that should be protected, potentially leading to data leakage and privacy breaches.

Recommendation

Update the Stackable plugin to the latest version that fixes this vulnerability, or disable it if no update is available.

Other vulnerabilities in Stackable

CVE-2025-60094Medium
The Stackable (stackable-ultimate-gutenberg-blocks) plugin for WordPress in versions up to and including 3.18.1 contains a Missing Authorization vulnerability. It enables exploitation of incorrectly configured access control security levels.

Original NVD description (English source)

Insertion of Sensitive Information Into Sent Data vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Retrieve Embedded Sensitive Data.This issue affects Stackable: from n/a through <= 3.18.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS