High severity · published Jan 2, 2026
CVE-2025-15438
PluXml Media Management medias.php __destruct deserialization
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing a manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and announced that "[w]e fix this issue in the next version 5.8.23". A patch for it is ready.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
PluXml · Pluxml
5.8.0; 5.8.1; 5.8.2; 5.8.3; 5.8.4; 5.8.5; +17 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15438
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15438
Exploit
https://note-hxlab.wetolink.com/share/9SJUnaDcJuqz
Permissions Required
https://vuldb.com/?ctiid.339383
Third Party Advisory
https://vuldb.com/?id.339383
Third Party Advisory
https://vuldb.com/?submit.713989
More from PluXml
9.8
CVE-2026-24352
Session Fixation in PluXml CMS
9.8
CVE-2024-48138
A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute arbitrary code via…
9.8
CVE-2020-18185
class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment
8.8
CVE-2024-22636
PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature
8.8
CVE-2022-25018
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages