Business and Enterprise Solutions

In Sneeit Framework plugin for WordPress versions up to and including 8.3 a critical severity vulnerability CVE-2025-6389 was detected. This vulnerability allows unauthenticated attackers to achieve Remote Code Execution through the sneeit_articles_pagination_callback() function, which processes untrusted user input and passes it to call_user_func(). Successful exploitation enables attackers to execute arbitrary code on the server, potentially leading to backdoor injection or creation of new administrative accounts. To address this issue, users should upgrade the plugin to version 8.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6389.

In StreamTube Core plugin for WordPress versions up to and including 4.78 a critical severity vulnerability CVE-2025-13615 was detected. This vulnerability allows unauthenticated attackers to bypass authorization and change user passwords, potentially leading to takeover of administrator accounts. The vulnerability exists because the plugin provides user-controlled access to objects without proper authorization checks. Note that this exploit requires the ‘registration password fields’ to be enabled in theme options. To address this issue, users should upgrade the plugin to a fixed version once available. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13615.

In Houzez theme for WordPress versions up to and including 4.1.6 a medium severity vulnerability CVE-2025-9191 was detected. This vulnerability allows authenticated attackers with Subscriber-level access and above to perform PHP Object Injection via deserialization of untrusted input in saved-search-item.php. While no known POP chain is present in the theme itself, the vulnerability can lead to arbitrary file deletion, sensitive data retrieval, or code execution if another plugin or theme containing a POP chain is installed on the site. To address this issue, users should upgrade the theme to version 4.1.7 or larer. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9191.

In Houzez theme for WordPress versions up to and including 4.1.6 a medium severity vulnerability CVE-2025-9163 was detected. This vulnerability allows unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) by uploading malicious SVG files due to insufficient input sanitization and output escaping in the houzez_property_img_upload() and houzez_property_attachment_upload() functions. Exploitation can lead to arbitrary script execution whenever a user accesses the injected SVG file. To address this issue, users should upgrade the theme to version 4.1.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9163.

In Ads Pro Plugin – Multi-Purpose WordPress Advertising Manager plugin versions up to and including 4.95 a high severity vulnerability CVE-2025-7402 was detected. This vulnerability allows unauthenticated attackers to perform time-based SQL Injection via the ‘site_id’ parameter due to insufficient escaping and lack of proper preparation in the SQL query. Successful exploitation can lead to extraction of sensitive information from the database. To address this issue, users should upgrade the plugin to version 4.96 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7402.

In SKT PayPal for WooCommerce plugin for WordPress versions up to and including 1.4 a high severity vulnerability CVE-2025-7820 was detected. This vulnerability allows unauthenticated attackers to bypass payment processing by exploiting the plugin’s enforcement of client-side controls instead of server-side controls. As a result, attackers can make confirmed purchases without actually paying. To address this issue, users should upgrade to a fixed version once available. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7820.

In the Webform Multiple File Upload module for Drupal 7.x a high severity vulnerability CVE-2025-12848 was detected. This vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in a victim’s browser by uploading a file with a malicious filename when file type validation is disabled on a Webform Multifile field. The issue originates from a third-party library used by the module. To address this issue, users should update the module to version 7.x-1.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12848.

In YouTube Subscribe plugin versions up to and including 3.0.0 a medium severity vulnerability CVE-2025-12025 was detected. This vulnerability allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts via admin settings, which execute when users access the affected pages. This issue affects only multi-site installations or sites where unfiltered_html has been disabled. To address this issue, users should upgrade the plugin to version 3.0.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12025.

In Wishlist for WooCommerce plugin versions up to and including 1.0.9 a medium severity vulnerability CVE-2025-12040 was detected. This vulnerability allows unauthenticated attackers to modify other users’ wishlists due to missing validation on a user-controlled key in several functions within class-th-wishlist-frontend.php. To address this issue, users should upgrade the plugin to version 1.1.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12040.