CVE-2025-1509: The The Show Me The Cookies plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This is due to the software allowing users to execute an acti

high Affects show-me-the-cookies (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2025-02-22; advisory modified 2026-06-17.

The The Show Me The Cookies plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This is due to the software allowing users to execute an acti

Package: show-me-the-cookies (WordPress plugin) WordPress
Affected versions: =1.0
Fixed in: no fix recorded
Severity: high CVSS 7.3
Exploitation: not on CISA KEV · EPSS 1% (49.3th percentile)
Published: 2025-02-22
Source: nvd

References

CWE-94

NVD record show-me-the-cookies (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2017-9841 KEV critical Code Injection in PHPUnit same weakness: CWE-94
CVE-2021-3129 KEV critical Unauthenticated remote code execution via insecure file handling in debug mode same weakness: CWE-94
CVE-2025-32432 KEV critical Craft CMS Allows Remote Code Execution same weakness: CWE-94
CVE-2018-7602 KEV critical A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and same weakness: CWE-94
CVE-2024-56145 KEV critical Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled same weakness: CWE-94
CVE-2025-54068 KEV critical Livewire is vulnerable to remote command execution during component property update hydrat same weakness: CWE-94