Our news and updates

In Fan Page plugin for WordPress versions up to and including 1.0.1 a medium severity vulnerability CVE-2025-6681 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the ‘width’ parameter due to insufficient input sanitization and output escaping. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6681.

In SQLite versions from 3.39.2 to before 3.41.2 a medium severity vulnerability CVE-2025-7458 was detected. This vulnerability allows attackers to crash the system or read sensitive data from memory by running a specially crafted SELECT query with many items in the ORDER BY part. To address this issue, users should upgrade SQLite to versions 3.41.2 or later. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-7458.

In Discourse versions before 3.4.7 and from 3.5.0.beta1 to before 3.5.0.beta.8 a high severity vulnerability CVE-2025-53102 was detected. This vulnerability allows attackers to reuse a 2FA security key challenge after login, which increases the risk of unauthorized access. To address this issue, users should upgrade Discourse to versions 3.4.7, 3.5.0.beta.8 or later. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-53102.

In YouTube Embed plugin for WordPress versions up to and including 10.3 a medium severity vulnerability CVE-2025-6692 was detected. This vulnerability lets logged-in users with Contributor access or higher add malicious code to pages. The code runs when someone opens the page. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-6692.

In Sky Addons for Elementor plugin for WordPress versions up to and including 3.1.4 a medium severity vulnerability CVE-2025-8216 was detected. This bug lets logged-in users with Contributor access or higher add dangerous code to pages using widgets. The code runs when someone opens the page. To address this issue, users should update Sky Addons for Elementor plugin to version 3.2.0 or later. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-8216.

In Magical Addons for Elementor plugin for WordPress versions up to and including 1.3.8 a medium severity vulnerability CVE-2025-8196 was detected. This bug lets logged-in users with Contributor access or higher add dangerous code using custom attributes. The code runs when someone opens the page. To address this issue, users should update Magical Addons for Elementor plugin to versions 1.3.9 or later. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-8196.

In the Station Pro plugin for WordPress versions up to and including 2.4.2 a medium severity vulnerability CVE-2025-7959 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the ‘width’ and ‘height’ parameters due to insufficient input sanitization and output escaping. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7959.

In the Sky Addons for Elementor plugin for WordPress versions up to and including 3.1.4 a medium severity vulnerability CVE-2025-8216 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via multiple widgets due to insufficient input sanitization and output escaping on user-supplied attributes. To address this issue, users should update the Sky Addons for Elementor plugin to versions 3.2.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8216.

In the Memory Usage plugin for WordPress versions up to and including 3.98 a medium severity vulnerability CVE-2025-8104 was detected. This vulnerability allows unauthenticated attackers to silently install one of several whitelisted plugins via a forged request, due to missing nonce validation in the wpmemory_install_plugin() function. To address this issue, users should update the Memory Usage plugin to versions 3.99 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8104.