Business and Enterprise Solutions

In the Premium Age Verification / Restriction for WordPress plugin, all versions up to and including 3.0.2 a critical severity vulnerability CVE-2025-7401 was detected. This vulnerability allows unauthenticated attackers to read from or write to arbitrary files on the server due to insufficiently protected remote support functionality in remote_tunnel.php. This may lead to exposure of sensitive information or remote code execution. Currently the is no fix for this vulnerability. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7401.

In the Broken Link Notifier plugin for WordPress, all versions up to and including 1.3.0 a high severity vulnerability CVE-2025-6851 was detected. This vulnerability allows unauthenticated attackers to perform Server-Side Request Forgery via the ajax_blinks() function, which ultimately calls the check_url_status_code() function. Currently, there is no fix for this vulnerability. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6851.

In the Broken Link Notifier plugin for WordPress, all versions up to and including 1.3.0 a high severity vulnerability CVE-2025-6838 was detected. This vulnerability allows attackers to inject malicious input into exported CSV files via broken links. To fix this issue, users should upgrade the plugin to version 1.3.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6838.

In the WPBookit plugin for WordPress, all versions up to and including 1.0.4 a critical severity vulnerability CVE-2025-6058 was detected. This vulnerability allows unauthenticated attackers to upload arbitrary files to the affected site’s server, potentially leading to remote code execution. To fix this issue, users should upgrade the plugin to version 1.0.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6058.

In the PayMaster for WooCommerce plugin for WordPress, all versions up to and including 0.4.31 a high severity vulnerability CVE-2025-6729 was detected. This vulnerability allows attackers to send unauthorized requests from the server to internal or external systems, potentially accessing or modifying sensitive information. Currently there is not fix for this vulnerability. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6729.

In the JKDEVKIT plugin for WordPress all versions up to and including 1.9.4 a critical severity vulnerability CVE-2025-2932 was detected. This vulnerability allows authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the server due to insufficient file path validation in the ‘font_upload_handler’ function. Currently there is not fix for this vulnerability. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2932.

In Umbraco versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1 a medium severity vulnerability CVE-2025-49147 was detected. This vulnerability allows unauthenticated attackers to access limited information about the configured password requirements via an anonymous endpoint, which could aid brute-force attacks. To address this issue, users should upgrade Umbraco to versions 10.8.11 or 13.9.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-49147.

In Poll, Survey & Quiz Maker Plugin by Opinion Stage for WordPress versions up to and including 19.9.0 a medium severity vulnerability CVE-2025-3880 was detected. This vulnerability allows authenticated users with Contributor access and above to change plugin settings, including the account email or connection status, due to insufficient permission checks. To address this issue, users should upgrade Poll, Survey & Quiz Maker Plugin to versions 19.10.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-3880.

In the Pixabay Images plugin for WordPress versions up to and including 3.4 a high severity vulnerability CVE-2025-4413 was detected. This vulnerability allows authenticated attackers with Author-level access and above to upload arbitrary files to the affected site’s server due to missing file type validation, which may lead to remote code execution. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-4413.