Business and Enterprise Solutions

In Tripetto plugin for WordPress versions up to and including 8.0.9 a medium severity vulnerability CVE-2025-1530 was detected. This vulnerability allows attackers to perform Cross-Site Request Forgery (CSRF) due to missing nonce validation. This makes it possible for unauthenticated attackers to delete arbitrary results by tricking a site administrator into performing an action such as clicking on a link. To address this issue, users should upgrade Tripetto plugin to versions 8.0.10 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-1530.

In Test Email Plugin for WordPress versions 1.1.8 and prior a high severity vulnerability CVE-2025-2325 was detected. This vulnerability allows unauthenticated attackers to exploit stored XSS via email logs due to insufficient sanitization and escaping, injecting arbitrary scripts that execute when users access the compromised page. To address this issue, users should upgrade WP Test Email plugin to versions 1.1.9 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2325.

In Zoorum Comments plugin for WordPress versions up to and including 0.9 a medium severity vulnerability CVE-2025-2163 was detected. This vulnerability allows unauthenticated attackers to exploit CSRF due to missing or incorrect nonce validation in the zoorum_set_options() function, enabling them to update settings and inject malicious scripts by tricking a site administrator into clicking a link. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2163.

In WP01 plugin for WordPress versions up to and including 2.6.2 a medium severity vulnerability CVE-2025-2267 was detected. This vulnerability allows authenticated attackers with Subscriber-level access and above to download arbitrary files from the server due to a missing capability check and insufficient restrictions on the make_archive() function. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2267.

In SoundRise Music plugin for WordPress versions up to and including 1.6.11 a high vulnerability CVE-2025-2103 was detected. This vulnerability allows authenticated attackers with subscriber-level access and above to modify WordPress site options due to a missing capability check in the theironMusic_ajax() function, enabling them to change the default registration role to administrator and gain administrative access. To address this issue, users should upgrade SoundRise Music plugin to versions 1.7.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2103.

In the Omnipress plugin for WordPress versions 1.5.4 and prior a medium severity vulnerability CVE-2024-13407 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to extract data from password-protected, private, or draft posts via the megamenu block. To address this issue, users should upgrade Omnipress plugin to the versions 1.5.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-13407.

In AnalyticsWP plugin for WordPress versions 2.0.0 and prior a high severity vulnerability CVE-2024-13321 was detected. This vulnerability allows unauthenticated attackers to perform SQL injection via the ‘custom_sql’ parameter due to insufficient authorization checks in the handle_get_stats() function, enabling them to append additional SQL queries and extract sensitive information from the database. To address this issue, users should upgrade AnalyticsWP plugin to versions 2.1.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-13321.

In Joomla versions 4.0.0 up to and including 4.4.11, 5.1.0 up to and including 5.2.4 a high severity vulnerability CVE-2025-22213 was detected in the Media Manager. This vulnerability allows users with “edit” privileges to change file extensions to arbitrary values, including .php and other potentially executable extensions, which could lead to unauthorized code execution. To address this issue, users should upgrade Joomla to versions 4.4.12 or 5.2.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-22213.