Our news and updates

In Strong Testimonials plugin for WordPress versions up to and including 3.2.11 a medium severity vulnerability CVE-2025-7367 was detected. This vulnerability allows authenticated attackers with Author-level access and above to inject arbitrary web scripts via Testimonial Custom Fields due to insufficient input sanitization and output escaping. To address this issue, users should update Strong Testimonials plugin to versions 3.2.12 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7367.

In PHP versions 8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23 and 8.4.* before 8.4.10 a medium severity vulnerability CVE-2025-6491 was detected. This vulnerability allows attackers to cause a null pointer dereference by parsing XML data with an overly large (>2GB) XML namespace prefix in SOAP extensions, potentially leading to crashes and impacting server availability. To address this issue, users should upgrade PHP to versions 8.1.33, 8.2.29, 8.3.23 or 8.4.10. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6491.

In the Premium Age Verification / Restriction for WordPress plugin, all versions up to and including 3.0.2 a critical severity vulnerability CVE-2025-7401 was detected. This vulnerability allows unauthenticated attackers to read from or write to arbitrary files on the server due to insufficiently protected remote support functionality in remote_tunnel.php. This may lead to exposure of sensitive information or remote code execution. Currently the is no fix for this vulnerability. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7401.

In Keycloak in versions prior to 26.3.0 a high severity vulnerability CVE-2025-7365 was detected. This vulnerability allows an authenticated attacker to exploit the account merging process during an identity provider login. By modifying their email to match that of a victim, the attacker triggers a verification email sent to the victim without revealing their own address. To address this issue users must upgrade to version 26.3.0. For more details, visit https://www.cvedetails.com/cve/CVE-2025-7365/.

In the Broken Link Notifier plugin for WordPress, all versions up to and including 1.3.0 a high severity vulnerability CVE-2025-6851 was detected. This vulnerability allows unauthenticated attackers to perform Server-Side Request Forgery via the ajax_blinks() function, which ultimately calls the check_url_status_code() function. Currently, there is no fix for this vulnerability. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6851.

In the Broken Link Notifier plugin for WordPress, all versions up to and including 1.3.0 a high severity vulnerability CVE-2025-6838 was detected. This vulnerability allows attackers to inject malicious input into exported CSV files via broken links. To fix this issue, users should upgrade the plugin to version 1.3.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6838.

In the WPBookit plugin for WordPress, all versions up to and including 1.0.4 a critical severity vulnerability CVE-2025-6058 was detected. This vulnerability allows unauthenticated attackers to upload arbitrary files to the affected site’s server, potentially leading to remote code execution. To fix this issue, users should upgrade the plugin to version 1.0.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6058.

In Ansible versions up to 4.50.3 a medium severity vulnerability CVE-2025-53862 was detected. This vulnerability allows attackers to access three API endpoints that return verbose responses, potentially exposing sensitive information. To fix this issue, users should upgrade Ansible to version 4.52.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-53862.

In Ansible version 2.x a low severity vulnerability CVE‑2025‑53861 was detected. This vulnerability allows attackers to intercept session data or hijack user sessions by exploiting insecure cookies transmitted over unencrypted connections. To fix this issue, users should upgrade Ansible to version 4.52.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-53861.