CVE-2025-49029

WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.Kazi Custom Login And Signup Widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through 1.0.

Affected

bitto.kazi · Custom Login And Signup Widget

CVSS v3.1 PATCHSTACK

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

2.36% chance of exploitation in the next 30 days, 84th percentile

Nuclei

high

Published

2025-07-01

Updated

2026-04-28

Proof-of-concept exploits (1)

• Nxploited/CVE-2025-490292★ · 2025-07-01

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49029.yaml

References

• CVE Record
• NVD entry