CVE-2025-60119: 
WordPress vulnerability analysis and mitigation

A sensitive data exposure vulnerability was discovered in CoSchedule WordPress plugin versions up to 3.3.10. The vulnerability (CVE-2025-60119) was reported on September 26, 2025, by security researcher Bao from BlueRock. This security issue allows unauthorized users to retrieve embedded sensitive data from the CoSchedule plugin (Patchstack).

The vulnerability is classified as an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). It received a CVSS v3.1 score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating that it is network accessible, requires low attack complexity, and needs no privileges or user interaction to exploit (Patchstack).

The vulnerability could allow malicious actors to view sensitive information that is normally not accessible to regular users. This exposed data could potentially be used to exploit other weaknesses in the system (Patchstack).

The vulnerability has been fixed in CoSchedule plugin version 3.4.0. Users are advised to update to version 3.4.0 or later to remove the vulnerability. Patchstack users have the option to enable auto-update for vulnerable plugins (Patchstack).