Infrastructure and Network

In the Postalicious plugin for WordPress versions up to and including 3.0.1 a medium severity vulnerability CVE-2026-1266 was detected. This vulnerability allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts via admin settings, which are stored and executed when users access affected pages, due to insufficient input sanitization and output escaping. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1266.

In the Administrative Shortcodes plugin for WordPress versions up to, and including, 0.3.4 a high severity vulnerability CVE-2026-1257 was detected. This vulnerability allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary files on the server via the slug attribute of the get_template shortcode, due to insufficient path validation of user-supplied input passed to the get_template_part() function. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1257.

In the LeadBI plugin for WordPress versions up to and including 1.7 a medium severity vulnerability CVE-2026-1189 was detected. This vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the form_id parameter of the leadbi_form shortcode, due to insufficient input sanitization and output escaping of user-supplied attributes. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1189.

In Traefik versions prior to 2.11.35 and 3.6.7 a medium severity vulnerability CVE-2026-22045 was detected. This vulnerability allows unauthenticated attackers to cause a denial of service by opening multiple ACME TLS-ALPN connections and stalling the handshake, indefinitely tying up goroutines and file descriptors when automatic certificate generation is enabled. To address this issue, users should upgrade Traefik to version 2.11.35 or 3.6.7. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-22045.

In the WP Duplicate Page plugin for WordPress versions up to and including 1.8 a medium severity vulnerability CVE-2025-14001 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to duplicate arbitrary posts, pages, and WooCommerce HPOS orders due to missing capability checks in the duplicateBulkHandle and duplicateBulkHandleHPOS functions, even when their role is explicitly excluded in the plugin’s Allowed User Roles settings. To address this issue, users should upgrade the WP Duplicate Page plugin to version 1.8.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-14001.

In OpenVPN versions 2.5.0 through 2.7_rc2 a low severity vulnerability CVE-2025-13751 was identified. This vulnerability allows a local authenticated user on Windows to connect to the Interactive Service Agent and trigger an error causing a local denial of service. To address this issue, users should upgrade OpenVPN to versions 2.6.17, 2.7_rc3, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13751.

In OpenVPN versions 2.6.0 through 2.7_rc1 a medium severity vulnerability CVE-2025-13086 was identified. This vulnerability stems from improper validation of source IP addresses, allowing an attacker to initiate a session from an IP address different from the one that originally established the connection. This vulnerability can result in session hijacking and denial of service for the legitimate originating client. To address this issue, users should upgrade OpenVPN to versions 2.6.16, 2.7_rc2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13086.

In OpenVPN versions 2.7_alpha1 through 2.7_rc1 a critical severity vulnerability CVE-2025-12106 was identified. This vulnerability is caused by insufficient argument validation when parsing IP addresses, allowing an attacker to trigger a heap buffer over-read during processing. Successful exploitation could lead to application crashes or undefined behavior under specific conditions. To address this issue, users should upgrade OpenVPN to version 2.7.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12106.

In Wazuh versions 3.7.0 through 4.11.x a medium severity vulnerability CVE-2025-64169 was detected. This vulnerability allows a compromised agent to crash the `analysisd` process on the Wazuh manager due to a NULL pointer dereference in the `fim_alert()` function when `oldsum->md5` is not properly checked. To address this issue, users should upgrade Wazuh to versions 4.12.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-64169.