CVE-2025-60119

MediumCVSS 5.3

Published: 26/09/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

22th percentile - higher than 22% of all known CVEs

Summary

The CoSchedule plugin (versions up to and including 3.3.11) exposes sensitive system information to an unauthorized control sphere. This allows retrieval of embedded sensitive data.

Risk Assessment

An unauthorized user may gain access to sensitive system information. This could lead to further attacks or breach of data confidentiality.

Recommendation

Update the CoSchedule plugin to a version later than 3.3.11. Review what data is exposed and restrict access to it.

Other vulnerabilities in CoSchedule

CVE-2025-49913Medium
The CoSchedule plugin by CoSchedule (coschedule-by-todaymade) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects CoSchedule versions up to and including 3.4.0.

Original NVD description (English source)

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Retrieve Embedded Sensitive Data.This issue affects CoSchedule: from n/a through <= 3.3.11.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS