CVE News Feed

• CVE-2025-14298 - FiboSearch – Ajax Search for WooCommerce ripting via thegem_te_search Shortcode

  CVE ID :CVE-2025-14298
  Published : Dec. 20, 2025, 9:15 a.m. | 1 hour, 43 minutes ago
  Description :The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `thegem_te_search` shortcode in all versions up to, and including, 1.32.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires TheGem theme (premium) to be installed with Header Builder mode enabled, and the FiboSearch "Replace search bars" option enabled for TheGem integration.
  Severity: 5.4 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-12492 - Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

  CVE ID :CVE-2025-12492
  Published : Dec. 20, 2025, 9:15 a.m. | 1 hour, 43 minutes ago
  Description :The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.0 via the ajax_get_members function. This is due to the use of a predictable low-entropy token (5 hex characters derived from md5 of post ID) to identify member directories and insufficient authorization checks on the unauthenticated AJAX endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, display names, user roles (including administrator accounts), profile URLs, and user IDs by enumerating predictable directory_id values or brute-forcing the small 16^5 token space.
  Severity: 5.3 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-13619 - Flex Store Users e Escalation

  CVE ID :CVE-2025-13619
  Published : Dec. 20, 2025, 7:15 a.m. | 3 hours, 43 minutes ago
  Description :The Flex Store Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.0. This is due to the 'fsUserHandle::signup' and the 'fsSellerRole::add_role_seller' functions not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can be exploited with the 'fs_type' parameter if the Flex Store Seller plugin is also activated.
  Severity: 9.8 | CRITICAL
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-12820 - Pure WC Variation Swatches

  CVE ID :CVE-2025-12820
  Published : Dec. 20, 2025, 6:15 a.m. | 4 hours, 43 minutes ago
  Description :The Pure WC Variation Swatches WordPress plugin through 1.1.7 does not have an authorization check when updating its settings, which could allow any authenticated users to update them.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-14735 - Amazon affiliate lite Plugin d Cross-Site Scripting

  CVE ID :CVE-2025-14735
  Published : Dec. 20, 2025, 4:16 a.m. | 6 hours, 43 minutes ago
  Description :The "Amazon affiliate lite Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
  Severity: 4.4 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-14734 - Amazon affiliate lite Plugin Settings Update

  CVE ID :CVE-2025-14734
  Published : Dec. 20, 2025, 4:16 a.m. | 6 hours, 43 minutes ago
  Description :The Amazon affiliate lite Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'ADAL_settings_page' function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
  Severity: 5.4 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-14721 - Responsive and Swipe slider s-Site Scripting via Shortcode

  CVE ID :CVE-2025-14721
  Published : Dec. 20, 2025, 4:16 a.m. | 6 hours, 43 minutes ago
  Description :The Responsive and Swipe slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rsSlider shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
  Severity: 5.5 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-14633 - F70 Lead Document Download icated Arbitrary Media File Download

  CVE ID :CVE-2025-14633
  Published : Dec. 20, 2025, 4:16 a.m. | 6 hours, 43 minutes ago
  Description :The F70 Lead Document Download plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'file_download' function in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to download any file from the WordPress media library by guessing or enumerating WordPress attachment IDs.
  Severity: 5.3 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-14591 - PII Leak Due to Change in EOR Handling

  CVE ID :CVE-2025-14591
  Published : Dec. 20, 2025, 4:16 a.m. | 6 hours, 43 minutes ago
  Description :After a recent bug fix to correctly handle CR+LF (Windows and DOS) End-of-Record (EOR) characters in delimited files, an issue was identified: using an incorrect EOR configuration can cause inaccurate parsing and leave personally identifiable information (PII) unmasked.
  Severity: 5.3 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-14168 - WP DB Booster rgery to Database Cleanup

  CVE ID :CVE-2025-14168
  Published : Dec. 20, 2025, 4:16 a.m. | 6 hours, 43 minutes ago
  Description :The WP DB Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing nonce validation on the cleanup_all AJAX action. This makes it possible for unauthenticated attackers to delete database records including post drafts, revisions, comments, and metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
  Severity: 4.3 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-14164 - Quran Gateway ery to Settings Update

  CVE ID :CVE-2025-14164
  Published : Dec. 20, 2025, 4:16 a.m. | 6 hours, 43 minutes ago
  Description :The Quran Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce validation in the quran_gateway_options function. This makes it possible for unauthenticated attackers to modify the plugin's display settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
  Severity: 4.3 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-13624 - Overstock Affiliate Links $_SERVER['PHP_SELF']

  CVE ID :CVE-2025-13624
  Published : Dec. 20, 2025, 4:16 a.m. | 6 hours, 43 minutes ago
  Description :The Overstock Affiliate Links plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
  Severity: 6.1 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-13365 - WP Hallo Welt gery to Stored Cross-Site Scripting

  CVE ID :CVE-2025-13365
  Published : Dec. 20, 2025, 4:16 a.m. | 6 hours, 43 minutes ago
  Description :The WP Hallo Welt plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'hallo_welt_seite' function. This makes it possible for unauthenticated attackers to update plugin settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Due to the insufficient input sanitization and output escaping, this can lead to Stored Cross-Site Scripting.
  Severity: 6.1 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-13329 - File Uploader for WooCommerce via add-image-data

  CVE ID :CVE-2025-13329
  Published : Dec. 20, 2025, 4:16 a.m. | 6 hours, 43 minutes ago
  Description :The File Uploader for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the callback function for the 'add-image-data' REST API endpoint in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to upload arbitrary files to the Uploadcare service and subsequently download them on the affected site's server which may make remote code execution possible.
  Severity: 9.8 | CRITICAL
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-12898 - Pretty Google Calendar henticated Google API Key Exposure

  CVE ID :CVE-2025-12898
  Published : Dec. 20, 2025, 4:16 a.m. | 6 hours, 43 minutes ago
  Description :The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcal_ajax_handler() function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to retrieve the Google API key set in the plugin's settings.
  Severity: 5.3 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-12581 - Attachments Handler ing

  CVE ID :CVE-2025-12581
  Published : Dec. 20, 2025, 4:16 a.m. | 6 hours, 43 minutes ago
  Description :The Attachments Handler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
  Severity: 6.1 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-8065 - Buffer Overflow in ONVIF XML Parser on Tapo C200

  CVE ID :CVE-2025-8065
  Published : Dec. 20, 2025, 1:16 a.m. | 9 hours, 43 minutes ago
  Description :A buffer overflow vulnerability exists in the ONVIF XML parser of Tapo C200 V3. An unauthenticated attacker on the same local network segment can send specially crafted SOAP XML requests, causing memory overflow and device crash, resulting in denial-of-service (DoS).
  Severity: 7.1 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-14300 - Unauthenticated Access to connectAP API Endpoint on Tapo C200

  CVE ID :CVE-2025-14300
  Published : Dec. 20, 2025, 1:16 a.m. | 9 hours, 43 minutes ago
  Description :The HTTPS service on Tapo C200 V3 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).
  Severity: 8.7 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-14299 - Improper Content-Length Validation in HTTPS Requests on Tapo C200

  CVE ID :CVE-2025-14299
  Published : Dec. 20, 2025, 1:16 a.m. | 9 hours, 43 minutes ago
  Description :The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).
  Severity: 7.1 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-68613 - n8n Vulnerable to Remote Code Execution via Expression Injection

  CVE ID :CVE-2025-68613
  Published : Dec. 19, 2025, 11:15 p.m. | 11 hours, 43 minutes ago
  Description :n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.
  Severity: 9.9 | CRITICAL
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...