Business and Enterprise Solutions

In WP Easy Contact plugin for WordPress versions up to and including 4.0.1 a medium severity vulnerability CVE-2025-8315 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the ‘noaccess_msg’ parameter due to insufficient input sanitization and output escaping. To address this issue, users should upgrade WP Easy Contact plugin to versions 4.0.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8315.

In Campus Directory plugin for WordPress versions up to and including 1.9.1 a medium severity vulnerability CVE-2025-8313 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the ‘noaccess_msg’ parameter due to insufficient input sanitization and output escaping. To address this issue, users should upgrade Campus Directory plugin to versions 1.9.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8313.

In Employee Directory plugin for WordPress versions up to and including 4.5. a medium severity vulnerability CVE-2025-8295 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the ‘noaccess_msg’ parameter due to insufficient input sanitization and output escaping. To address this issue, users should upgrade Employee Directory plugin to versions 4.5.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8295.

In Liferay Portal versions 7.4.3.61 through 7.4.3.132, and Liferay DXP versions 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13, and 7.4 update 61 through update 92 a low severity vulnerability CVE-2025-4599 was detected. This vulnerability allows remote unauthenticated attackers to inject JavaScript into the fragment portlet URL via the fragment preview functionality, leading to postMessage-based Cross-Site Scripting (XSS). To address this issue, users should upgrade Liferay Portal to master branch and Liferay DXP to versions 2024.Q1.14, 2024.Q4.6 or 2025.Q1.0 For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-4599.

In Service Finder SMS System plugin for WordPress versions up to and including 2.0.0 a critical severity vulnerability CVE-2025-5954 was detected. This vulnerability allows unauthenticated attackers to escalate privileges and register as administrator users due to the plugin not restricting user role selection during registration via the aonesms_fn_savedata_after_signup() function. To address this issue, users should upgrade Service Finder SMS System plugin to versions 3.0.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-5954.

In Service Finder Bookings plugin for WordPress versions up to and including 6.0 a critical severity vulnerability CVE-2025-5947 was detected. This vulnerability allows unauthenticated attackers to escalate privileges and log in as any user, including administrators, due to improper validation of user cookie values in the service_finder_switch_back() function. To address this issue, users should upgrade Service Finder Bookings plugin to versions 6.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-5947.

In SureForms plugin for WordPress versions prior to 1.7.2 a medium severity vulnerability CVE-2025-5921 was detected. This vulnerability allows both authenticated and unauthenticated attackers to execute reflected Cross-Site Scripting (XSS) attacks due to insufficient sanitization and escaping of user-supplied input. To address this issue, users should upgrade SureForms plugin to versions 1.7.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-5921.

In Umbraco CMS versions 13.0.0 through 13.9.2, 15.0.0 through 15.4.1 and 16.0.0 through 16.1.0 a medium severity vulnerability CVE-2025-54425 was detected. This vulnerability allows unauthorized users to access cached API responses from the Content Delivery API without a valid API key, due to improper handling of header-based caching. To address this issue, users should update Umbraco CMS to versions 13.9.3, 15.4.4 or 16.1.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-54425.

In Smart Slider 3 plugin for WordPress versions up to and including 3.5.1.28 a high severity vulnerability CVE-2025-6348 was detected. This vulnerability allows authenticated attackers with Administrator-level access and above to perform time-based SQL Injection via the ‘sliderid’ parameter, potentially enabling them to extract sensitive information from the database. To address this issue, users should upgrade Smart Slider 3 plugin to versions 3.5.1.29 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6348.