Business and Enterprise Solutions

In Liferay Portal versions 7.2.0 through 7.4.3.129 and Liferay DXP versions 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36 and 7.2 GA through fix pack 20 a medium severity vulnerability CVE-2025-3760 was detected. This vulnerability allows remote authenticated attackers to inject malicious JavaScript into a page using radio button type custom fields. To address this issue, users should upgrade Liferay Portal to versions 7.4.3.132 and Liferay DXP to versions 2024.Q1.13, 2024.Q3.10 or 2025.Q1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-3760.

In Embedder plugin for WordPress versions 1.3 to 1.3.5 a high severity vulnerability CVE-2025-3417 was detected. This vulnerability allows authenticated attackers with Subscriber-level access and above to modify data due to a missing capability check in the ajax_set_global_option() function, enabling them to change the default registration role to administrator and gain administrative access to the site. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-3417.

In ORDER POST plugin for WordPress versions 2.0.2 and prior a high severity vulnerability CVE-2025-2805 was detected. This vulnerability allows unauthenticated attackers to execute arbitrary shortcodes due to improper validation of values before running do_shortcode. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2805.

In Feedify plugin for WordPress versions prior to 2.4.6 a high severity vulnerability CVE-2024-13874 was detected. This vulnerability allows attackers to exploit a lack of sanitization and escaping of parameters, leading to Reflected Cross-Site Scripting (XSS) attacks that could target high-privilege users such as administrators. To address this issue, users should upgrade Feedify plugin to versions 2.4.6 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-13874.

In Umbraco versions 14.3.3 and prior, 15.3.0 and prior a medium severity vulnerability CVE-2025-32017 was detected. This vulnerability allows authenticated users of the Umbraco backoffice to exploit a path traversal flaw in the management API, enabling them to upload files to incorrect locations. To address this issue, users should upgrade Umbraco to versions 14.3.4 or 15.3.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-32017.

In Drupal versions prior to 1.10.0 a low severity vulnerability CVE-2025-31694 was detected. This vulnerability allows attackers to bypass security measures within the Two-factor Authentication (TFA) module through forceful browsing, potentially granting unauthorized access to sensitive user data and administrative functionalities. To address this issue, users should upgrade Drupal TFA module to versions 1.10.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-31694.

In Drupal versions 8.0.0 to 10.3.12, 10.4.0 to 10.4.2, 11.0.0 to 11.0.11 and 11.1.0 to 11.1.2 a high severity vulnerability CVE-2025-31674 was detected. This vulnerability allows attackers to perform object injection by improperly modifying dynamically-determined object attributes, which can lead to unauthorized access and manipulation of sensitive data. To address this issue, users should upgrade Drupal Core to versions 10.3.13, 10.4.3, 11.0.12, 11.1.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-31674.

In Drupal versions 8.0.0 to 10.3.13, 10.4.0 to 10.4.4, 11.0.0 to 11.0.12 and 11.1.0 to 11.1.4 a low severity vulnerability CVE-2025-31675 was detected. This vulnerability allows attackers to execute arbitrary JavaScript in the context of the user’s browser through improper neutralization of input during web page generation. This can lead to session hijacking, data theft, or website defacement. To address this issue, users should upgrade Drupal Core to versions 10.3.14, 10.4.5, 11.0.13, 11.1.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-31675.

In Drupal versions prior to 1.0.1 a low severity vulnerability CVE-2025-31696 was detected. This vulnerability allows attackers to inject malicious scripts into web pages through improper neutralization of input during web page generation, potentially leading to unauthorized actions, data theft, or session hijacking. To address this issue, users must upgrade to version 1.0.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-31696.