Our news and updates

In the Advanced Custom Fields (ACF) plugin for WordPress versions up to and including 3.5.1 a low severity vulnerability CVE-2012-10025 was detected. This vulnerability allows unauthenticated attackers to achieve remote code execution by exploiting insufficient validation in core/actions/export.php, enabling remote file inclusion via the acf_abspath POST parameter when allow_url_include is enabled in the PHP configuration, potentially leading to full compromise of the host. To address this issue, users should upgrade the Advanced Custom Fields (ACF) plugin to versions 3.5.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2012-10025.

In the Asset-Manager plugin for WordPress versions up to and including 2.0 a critical severity vulnerability CVE-2012-10026 was detected. This vulnerability allows unauthenticated attackers to upload and execute arbitrary PHP scripts via the upload.php endpoint due to insufficient validation of uploaded files. The uploaded files are placed in a predictable temporary directory and can be triggered via direct HTTP requests, resulting in remote code execution under the web server’s context. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2012-10026.

In Ocean Social Sharing plugin for WordPress versions up to and including 2.2.1 a medium severity vulnerability CVE-2025-7500 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via social icon titles, due to insufficient input sanitization and output escaping. To address this issue, users should upgrade Ocean Social Sharing plugin to versions 2.2.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7500.

In the Zakra theme for WordPress versions up to and including 4.1.5 a medium severity vulnerability CVE-2025-8595 was detected. This vulnerability allows authenticated attackers with Subscriber-level access or higher to modify data by importing demo settings, due to a missing capability check in the welcome_notice_import_handler() function. To address this issue, users should upgrade Zakra theme to version 4.1.6 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8595.

In WP Easy Contact plugin for WordPress versions up to and including 4.0.1 a medium severity vulnerability CVE-2025-8315 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the ‘noaccess_msg’ parameter due to insufficient input sanitization and output escaping. To address this issue, users should upgrade WP Easy Contact plugin to versions 4.0.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8315.

In Campus Directory plugin for WordPress versions up to and including 1.9.1 a medium severity vulnerability CVE-2025-8313 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the ‘noaccess_msg’ parameter due to insufficient input sanitization and output escaping. To address this issue, users should upgrade Campus Directory plugin to versions 1.9.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8313.

In Employee Directory plugin for WordPress versions up to and including 4.5. a medium severity vulnerability CVE-2025-8295 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the ‘noaccess_msg’ parameter due to insufficient input sanitization and output escaping. To address this issue, users should upgrade Employee Directory plugin to versions 4.5.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8295.

In Vault Community Edition versions from 1.10.0 up to 1.20.1 and Vault Enterprise versions from 1.10.0 up to 1.20.1, 1.19.7, 1.18.12, 1.16.23, 1.15.16 a medium severity vulnerability CVE-2025-6013 was found in the LDAP auth method. When username_as_alias was set to true, Vault could fail to enforce MFA if a user had multiple CNs that were identical except for leading or trailing spaces. This could allow an MFA bypass under certain conditions. To address this issue, users should upgrade Vault Community Edition to version 1.20.2 and Vault Enterprise versions 1.20.2, 1.19.8, 1.18.13 and 1.16.24. For more information, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6013.

In Vault and Vault Enterprise versions prior to 1.20.1 (Community Edition), 1.19.7, 1.18.12 and 1.16.23 (Enterprise Edition) a medium severity vulnerability CVE-2025-6004 was detected. This vulnerability allows attackers to bypass the user lockout feature for Userpass and LDAP authentication methods. To address this issue, users should upgrade Vault Community Edition to versions 1.20.1 or Vault Enterprise to versions 1.20.1, 1.19.7, 1.18.12 or 1.16.23. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6004.