Our news and updates

In GiveWP – Donation Plugin and Fundraising Platform plugin versions up to and including 4.13.0 a high severity vulnerability CVE-2025-13206 was detected. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts via the name parameter due to insufficient input sanitization and output escaping, provided that avatars are enabled in the WordPress installation. These scripts will execute whenever a user views an affected page. To address this issue, users should upgrade the plugin to version 4.13.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13206.

In Mattermost versions 10.11.x through 10.11.3 and 10.5.x through 10.5.11 a low severity vulnerability CVE-2025-55074 was detected. This vulnerability causes Mattermost to fail to enforce access permissions on the Agents plugin, allowing other users to determine when users had read channels via channel member objects. Fixed versions include 11.0.0, 10.11.4, and 10.5.12. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-55074.

In RTMKit Addons for Elementor plugin versions up to and including 1.6.1 a medium severity vulnerability CVE-2025-8609 was detected. This vulnerability allows authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting via the plugin’s Accordion Block attributes due to insufficient sanitization and escaping of user-supplied input, causing injected scripts to run when a user views an affected page. To address this issue, users should upgrade the plugin to version 1.6.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8609.

In Gutenify – Visual Site Builder Blocks & Site Templates plugin versions up to and including 1.5.9 a medium severity vulnerability CVE-2025-8605 was detected. This vulnerability allows authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting by abusing insufficient input sanitization and output escaping on block attributes, enabling malicious scripts to execute whenever a user accesses an affected page. To address this issue, users should upgrade the plugin to version 1.6.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8605.

In AI Engine plugin versions up to and including 3.1.8 a medium severity vulnerability CVE-2025-8084 was detected. This vulnerability allows authenticated attackers with Editor-level access and above to perform Server-Side Request Forgery via the rest_helpers_create_images function, enabling them to make web requests to arbitrary locations from the web application. On Cloud instances, this can lead to metadata retrieval and unauthorized querying or modification of internal services. To address this issue, users should upgrade the plugin to version 3.1.9 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8084.

In Simple User Import Export plugin versions up to and including 1.1.7 a medium severity vulnerability CVE-2025-13133 was detected. This vulnerability allows authenticated attackers with Administrator-level access and above to perform CSV Injection via the ‘Import/export users’ function by embedding untrusted input into exported CSV files, which may lead to code execution when the files are opened on a local system with a vulnerable configuration. To address this issue, users should upgrade the plugin to version 1.1.8 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13133.

In Mattermost versions prior to 11 a medium severity vulnerability CVE-2025-11776 was identified. This vulnerability allows guest users to bypass access restrictions on the archived channel search API and discover archived public channels via the /api/v4/teams/{team_id}/channels/search_archived endpoint. To fix this vulnerability, users should upgrade Mattermost to version 11 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-11776.

Mattermost versions 10.11.x through 10.11.3, 10.5.x through 10.5.11, and 10.12.x through 10.12.0 contain a medium severity vulnerability CVE-2025-11794. This vulnerability allows system administrators to access password hashes and MFA secrets due to improper sanitization of user data in the POST /api/v4/users/{user_id}/email/verify/member endpoint. To address this issue, users should upgrade Mattermost to version 10.11.4, 10.5.12, or 10.12.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-11794.

GitLab CE/EE versions 16.7 through 18.3.5, 18.4 through 18.4.3, and 18.5 through 18.5.1 contain a medium severity vulnerability CVE-2025-2615. This vulnerability could allow a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections. To address this issue, users should upgrade GitLab to version 18.3.6, 18.4.4, 18.5.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2615.