Our news and updates

In Wp Social Login and Register Social Counter plugin for WordPress versions up to and including 3.1.3 a medium severity vulnerability CVE-2025-13620 was identified. This vulnerability is due to missing authorization on certain REST routes, which are registered with permission callbacks that always return true and lack proper capability or nonce validation. This allows unauthenticated attackers to clear or overwrite the social counter cache via crafted REST requests. To address this issue, users should upgrade the plugin to version 3.1.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13620.

In Cool Tag Cloud plugin for WordPress versions up to and including 2.29 a high severity vulnerability CVE-2025-13614 was identified. This vulnerability stems from insufficient input sanitization and output escaping in the plugin’s ‘cool_tag_cloud’ shortcode, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page. To address this issue, users should upgrade the plugin to version 2.30 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13614.

In Rich Shortcodes for Google Reviews plugin for WordPress versions up to and including 6.8 a high severity vulnerability CVE-2025-12499 was identified. This vulnerability occurs due to insufficient input sanitization and output escaping of Google Review contents, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses the injected page. Note that this vulnerability was partially patched in version 6.6.2. To address this issue, users should upgrade the plugin to version 6.8.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12499.

In Django versions 5.2 before 5.2.9, 5.1 before 5.1.15 and 4.2 before 4.2.27 a high severity vulnerability CVE-2025-64460 was detected. This vulnerability allows attackers to trigger a denial-of-service condition by submitting specially crafted XML input that causes excessive CPU and memory consumption during XML deserialization. To address this issue, users should upgrade Django to versions 5.2.9, 5.1.15 or 4.2.27. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-64460.

In Django versions 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27 a medium severity vulnerability CVE-2025-13372 was detected. This vulnerability allows attackers to perform SQL injection by abusing `FilteredRelation` column aliases through crafted dictionary expansions passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. To address this issue, users should upgrade Django to versions 5.2.9, 5.1.15 or 4.2.27. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13372.

In GitLab CE/EE versions 18.4 prior to 18.4.5, 18.5 prior to 18.5.3 and 18.6 prior to 18.6.1 a high severity vulnerability CVE-2024-9183 was detected. This vulnerability allows authenticated attackers, under specific conditions, to exploit a time-of-check time-of-use (TOCTOU) race condition to obtain credentials from higher-privileged users and perform unauthorized actions in their context. To address this issue, users should upgrade GitLab CE/EE to versions 18.4.5, 18.5.3 or 18.6.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-9183.

In Mattermost versions 10.11.x up to 10.11.4 and 10.5.x up to 10.5.12 a low severity vulnerability CVE-2025-13870 was detected. This vulnerability allows authenticated users to bypass permission checks when accessing board files or subscribing to blocks, enabling access to files and subscriptions from boards they should not have access to. To address this issue, users should upgrade Mattermost to versions 10.11.5 or 10.5.13. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13870.

In Mattermost versions 11.0.x up to 11.0.2, 10.12.x up to 10.12.1, 10.11.x up to 10.11.4 and 10.5.x up to 10.5.12 a medium severity vulnerability CVE-2025-12756 was detected. This vulnerability allows authenticated users with the editor role to bypass permission checks and delete comments created by other users in Boards. To address this issue, users should upgrade Mattermost to versions 11.0.3 or later, 10.12.2 or later, 10.11.5 or later, and 10.5.13 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12756.

In Quantic Social Image Hover plugin for WordPress versions up to and including 1.0.8 a medium severity vulnerability CVE-2025-13360 was identified. This vulnerability is due to missing nonce validation on the settings update functionality, which allows unauthenticated attackers to update the plugin’s settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action such as clicking on a link. To address this issue, users should upgrade the plugin to version 1.0.9 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13360.