CVE-2025-8676 B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Sensitive Information Exposure
Authenticated subscribers can extract sensitive installed plugin information via the get_active_plugins function in the B Slider WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-8676?
CVE-2025-8676 is a medium-severity vulnerability in bplugins bSlider – Create Responsive Image, Post, Product, and Video Sliders, published on 15 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in versions less than, or equal to, 2.0.0 via the get_active_plugins function. This makes it possible for authenticated attackers, with subscriber-level access and above to extract sensitive data including installed plugin information.
Weakness: CWE-200
Which versions are affected by CVE-2025-8676?
How do I fix CVE-2025-8676?
No fix has been published for CVE-2025-8676 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-8676 being exploited?
There is no known exploitation of CVE-2025-8676 in the wild and no public exploit code.
Sources
Also known as GHSA-pcq4-qjc5-6xw7.