{"id":"CVE-2025-14434","aliases":["EUVD-2025-205885","GHSA-j4mr-6qvv-6q4w"],"status":"published","title":"Ultimate Post Kit \u003c 4.0.16 – Unauthenticated Arbitrary Post Content Disclosure","description":"The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upk_alex_grid_loadmore_posts without ensuring that posts to be displayed are published authentication. This allows an unauthenticated attacker to query arbitrary posts and retrieve rendered HTML content of private and unpublished ones.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00281,"percentile":0.20846,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2025-12-31T06:00:11Z","modified":"2026-06-17T08:35:55Z","products":[{"vendor":"unknown","product":"ultimate post kit addons for elementor"}],"references":[{"url":"https://wpscan.com/vulnerability/bf3c3193-fc9c-454b-ad4f-94ba1669a312/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14434"},{"url":"https://wpscan.com/vulnerability/bf3c3193-fc9c-454b-ad4f-94ba1669a312"},{"url":"https://github.com/advisories/GHSA-j4mr-6qvv-6q4w"}],"sources":{"cve":[{"id":"CVE-2025-14434","title":"Ultimate Post Kit \u003c 4.0.16 – Unauthenticated Arbitrary Post Content Disclosure","description":"The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upk_alex_grid_loadmore_posts without ensuring that posts to be displayed are published authentication. This allows an unauthenticated attacker to query arbitrary posts and retrieve rendered HTML content of private and unpublished ones.","status":"published","published":"2025-12-31T06:00:11.262Z","modified":"2026-01-02T14:37:14.868Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:32:28.621398Z"}],"euvd":[{"id":"EUVD-2025-205885","description":"The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upk_alex_grid_loadmore_posts without ensuring that posts to be displayed are published authentication. This allows an unauthenticated attacker to query arbitrary posts and retrieve rendered HTML content of private and unpublished ones.","status":"published","published":"2025-12-31T06:00:11Z","modified":"2026-01-02T14:37:14Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:59.455836Z"}],"ghsa":[{"id":"GHSA-j4mr-6qvv-6q4w","title":"The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX ...","description":"The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upk_alex_grid_loadmore_posts without ensuring that posts to be displayed are published authentication. This allows an unauthenticated attacker to query arbitrary posts and retrieve rendered HTML content of private and unpublished ones.","status":"published","published":"2025-12-31T06:30:17Z","modified":"2026-01-02T15:30:28Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:05:25.370391Z"}],"nvd":[{"id":"CVE-2025-14434","description":"The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upk_alex_grid_loadmore_posts without ensuring that posts to be displayed are published authentication. This allows an unauthenticated attacker to query arbitrary posts and retrieve rendered HTML content of private and unpublished ones.","status":"published","published":"2025-12-31T06:15:40.41Z","modified":"2026-06-17T08:35:55.39Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:11:54.323368Z"}]}}