Business and Enterprise Solutions

In Widgets for Google Reviews plugin for WordPress versions up to and including 13.2.4 a high severity vulnerability CVE-2025-12510 was identified. This vulnerability occurs due to insufficient input sanitization and output escaping on Google Reviews data imported by the plugin. It allows unauthenticated attackers to inject arbitrary web scripts that will execute in the admin panel (and potentially on the frontend) whenever a user accesses imported reviews, granted they can add a malicious review to a Google Place connected to the vulnerable site. To address this issue, users should upgrade the plugin to version 13.2.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12510.

In Norby AI plugin for WordPress versions up to and including 1.0.3 a medium severity vulnerability CVE-2025-13362 was identified. This vulnerability is caused by missing nonce validation on the settings update functionality, allowing unauthenticated attackers to modify plugin settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action such as clicking on a link. To address this issue, users should upgrade the plugin to version 1.0.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13362.

In SSP Debug plugin for WordPress versions up to and including 1.0.0 a medium severity vulnerability CVE-2025-13494 was identified. This vulnerability occurs because the plugin stores PHP error logs in a predictable, publicly accessible location without any access controls, allowing unauthenticated attackers to retrieve sensitive debugging information such as URLs, client IP addresses, User-Agent strings, WordPress user IDs, and internal filesystem paths. To address this issue, users should upgrade the plugin to a fixed version once it becomes available. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13494.

In Wp Social Login and Register Social Counter plugin for WordPress versions up to and including 3.1.3 a medium severity vulnerability CVE-2025-13620 was identified. This vulnerability is due to missing authorization on certain REST routes, which are registered with permission callbacks that always return true and lack proper capability or nonce validation. This allows unauthenticated attackers to clear or overwrite the social counter cache via crafted REST requests. To address this issue, users should upgrade the plugin to version 3.1.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13620.

In Cool Tag Cloud plugin for WordPress versions up to and including 2.29 a high severity vulnerability CVE-2025-13614 was identified. This vulnerability stems from insufficient input sanitization and output escaping in the plugin’s ‘cool_tag_cloud’ shortcode, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page. To address this issue, users should upgrade the plugin to version 2.30 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13614.

In Rich Shortcodes for Google Reviews plugin for WordPress versions up to and including 6.8 a high severity vulnerability CVE-2025-12499 was identified. This vulnerability occurs due to insufficient input sanitization and output escaping of Google Review contents, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses the injected page. Note that this vulnerability was partially patched in version 6.6.2. To address this issue, users should upgrade the plugin to version 6.8.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12499.

In CRM Memberships plugin for WordPress versions up to and including 2.5 a critical severity vulnerability CVE-2025-13313 was identified. This vulnerability is caused by missing authorization and authentication checks on the ntzcrm_changepassword AJAX action, allowing unauthenticated attackers to reset arbitrary user passwords and gain unauthorized access to user accounts if they can obtain or enumerate a target user’s email address. Additionally, the plugin exposes the ntzcrm_get_users endpoint without authentication, enabling attackers to enumerate subscriber email addresses, which facilitates exploitation of the password reset vulnerability. To address this issue, users should upgrade the plugin to version 2.6 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13313.

In Quantic Social Image Hover plugin for WordPress versions up to and including 1.0.8 a medium severity vulnerability CVE-2025-13360 was identified. This vulnerability is due to missing nonce validation on the settings update functionality, which allows unauthenticated attackers to update the plugin’s settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action such as clicking on a link. To address this issue, users should upgrade the plugin to version 1.0.9 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13360.

In Easy Jump Links Menus plugin for WordPress versions up to and including 1.0.0 a medium severity vulnerability CVE-2025-13860 was identified. This vulnerability stems from insufficient input sanitization and output escaping of the h_tags parameter, allowing authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting (XSS). Successful exploitation enables injection of arbitrary web scripts that execute whenever a user accesses an infected page. To address this issue, users should upgrade the plugin to version 1.0.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13860.