CVE-2025-57567

CRITICAL

PluXml CMS - Authenticated Remote Code Execution via Theme Editor File Overwrite

Title source: llm
STIX 2.1

Description

A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory (/themes/defaut/css/minify.php). An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel, enabling execution of system commands.

References (2)

Core 2

Scores

CVSS v3 9.1
EPSS 0.0089
EPSS Percentile 54.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-284 CWE-94
Status published
Published Oct 17, 2025
Tracked Since Feb 18, 2026