CVE-2025-48119: 
WordPress vulnerability analysis and mitigation

A Code Injection vulnerability (CVE-2025-48119) was identified in RS WP THEMES RS WP Book Showcase WordPress plugin affecting versions through 6.7.41. The vulnerability was discovered by researcher theviper17 and was initially reported on April 12, 2025, before being publicly disclosed on May 16, 2025 (Wiz, Patchstack).

The vulnerability is classified as an Improper Control of Generation of Code (Code Injection) issue, categorized under CWE-94. It received a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating that it is network-accessible, requires low attack complexity, and needs no privileges or user interaction to exploit (Wiz, NVD).

The vulnerability could allow malicious actors to inject their own content into pages and posts of affected WordPress websites. This could potentially be exploited for phishing attacks by injecting malicious content into legitimate web pages (Patchstack).

As of the vulnerability disclosure, no official fix is available for this security issue. The vulnerability was initially reported on April 12, 2025, and published by Patchstack on May 16, 2025 (Patchstack).