Vulnerability · Published Jul 1, 2025 · Assigned by Patchstack
CVE-2025-49029WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability
Critical 9.1
In plain English
A critical-severity code injection in Custom Login And Signup Widget from bitto.kazi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)2.4%top 16.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC
Official description
Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.kazi Custom Login And Signup Widget custom-login-and-signup-widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through <= 1.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bitto.kazi | Custom Login And Signup Widget | 0 – through 1.0 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H