CVE-2025-10163 identifies a time-based SQL Injection vulnerability in the List category posts plugin for WordPress, affecting all versions up to and including 0.91.0. The issue is located in the ‘starting_with’ parameter of the catlist shortcode, where user input is not properly escaped or prepared before being included in SQL queries. This allows authenticated attackers with Contributor-level privileges or higher to append malicious SQL commands to existing queries, enabling extraction of sensitive data from the database. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required.

Successful exploitation allows authenticated users with Contributor-level access or above to perform time-based SQL Injection attacks, potentially extracting sensitive information from the WordPress database. The vulnerability does not impact availability or integrity but compromises confidentiality of data stored in the database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access where possible and monitor for suspicious activity related to the catlist shortcode usage. Avoid using the vulnerable plugin version or disable the plugin if feasible.