Our news and updates

In Umbraco CMS versions 13.0.0 through 13.9.2, 15.0.0 through 15.4.1 and 16.0.0 through 16.1.0 a medium severity vulnerability CVE-2025-54425 was detected. This vulnerability allows unauthorized users to access cached API responses from the Content Delivery API without a valid API key, due to improper handling of header-based caching. To address this issue, users should update Umbraco CMS to versions 13.9.3, 15.4.4 or 16.1.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-54425.

In Smart Slider 3 plugin for WordPress versions up to and including 3.5.1.28 a high severity vulnerability CVE-2025-6348 was detected. This vulnerability allows authenticated attackers with Administrator-level access and above to perform time-based SQL Injection via the ‘sliderid’ parameter, potentially enabling them to extract sensitive information from the database. To address this issue, users should upgrade Smart Slider 3 plugin to versions 3.5.1.29 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6348.

In AI Engine plugin for WordPress versions 2.9.3 and 2.9.4 a high severity vulnerability CVE-2025-7847 was detected. This vulnerability allows authenticated attackers with Subscriber-level access and above to upload arbitrary files via the `rest_simpleFileUpload()` function due to missing file type validation, potentially leading to remote code execution when the REST API is enabled. To address this issue, users should upgrade AI Engine plugin to versions 2.9.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7847.

In Appzend theme for WordPress versions up to and including 1.2.6 a medium severity vulnerability CVE-2025-5587 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the ‘progressbarLayout’ parameter due to insufficient input sanitization and output escaping. These scripts execute when a user accesses an affected page. To address this issue, users should upgrade Appzend theme to versions 1.2.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-5587.

In Fan Page plugin for WordPress versions up to and including 1.0.1 a medium severity vulnerability CVE-2025-6681 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the ‘width’ parameter due to insufficient input sanitization and output escaping. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6681.

In Elementor Website Builder – More Than Just a Page Builder plugin for WordPress versions up to and including 3.30.2 a medium severity vulnerability CVE-2025-4566 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the `data-text` DOM element attribute in the Text Path widget due to insufficient input sanitization and output escaping. To address this issue, users should upgrade Elementor Website Builder – More Than Just a Page Builder plugin to versions 3.30.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-4566.

In SQLite versions from 3.39.2 to before 3.41.2 a medium severity vulnerability CVE-2025-7458 was detected. This vulnerability allows attackers to crash the system or read sensitive data from memory by running a specially crafted SELECT query with many items in the ORDER BY part. To address this issue, users should upgrade SQLite to versions 3.41.2 or later. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-7458.

In Discourse versions before 3.4.7 and from 3.5.0.beta1 to before 3.5.0.beta.8 a high severity vulnerability CVE-2025-53102 was detected. This vulnerability allows attackers to reuse a 2FA security key challenge after login, which increases the risk of unauthorized access. To address this issue, users should upgrade Discourse to versions 3.4.7, 3.5.0.beta.8 or later. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-53102.

In YouTube Embed plugin for WordPress versions up to and including 10.3 a medium severity vulnerability CVE-2025-6692 was detected. This vulnerability lets logged-in users with Contributor access or higher add malicious code to pages. The code runs when someone opens the page. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-6692.