AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2025-14947

MEDIUM · CVSS 6.5 EPSS 0.37%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-01-23 · Last synced 2026-08-04

CyberRota Analysis

This is a medium severity vulnerability with a CVSS score of 6.5. It affects WordPress. Exploitation may require the attacker to be authenticated.

CVE
CVE-2025-14947
Severity
MEDIUM
CVSS
6.5
EPSS
0.37%
WordPress

Original NVD Description

The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_callback_create_bunny_stream_video`, `ajax_callback_get_bunny_stream_video`, and `ajax_callback_delete_bunny_stream_video` functions in all versions up to, and including, 4.6.4. This makes it possible for unauthenticated attackers to create and delete videos on the Bunny Stream CDN associated with the victim's account, provided they can obtain a valid nonce which is exposed in public player templates.