Our news and updates

In WooCommerce Support Ticket System plugin for WordPress, versions 17.8 and prior a medium severity vulnerability CVE-2024-13775 was detected. This allows attackers with Subscriber-level access or higher to delete posts and access user data. To address this issue, users should upgrade WooCommerce Support Ticket System plugin to version 17.9 or later. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-13775.

In Mattermost versions 9.11.0 <= 9.11.7, 10.1.0 <= 10.1.3, 10.2.0 <= 10.2.2, 10.3.0 <= 10.3.2, and 10.4.0 <= 10.4.1 a medium severity vulnerability CVE-2025-24526 was detected. This allows users to export archived channel contents without proper access. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-24526.

In Metabase Enterprise Edition versions 1.47.0 and prior to 1.50.36, 1.51.14, 1.52.11, and 1.53.2 a medium severity vulnerability CVE-2025-27141 was detected. This allows users with impersonation permissions to access cached query results, even if they lack permission to view the data. To address this issue, users should upgrade to versions 1.50.36, 1.51.14, 1.52.11 or 1.53.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27141.

In Moodle versions prior to 4.5.2, 4.4.6, 4.3.10, and 4.1.16 a high severity vulnerability CVE-2025-26525 was detected. This vulnerability allows attackers to exploit insufficient sanitization in the TeX notation filter when pdfTeX is available, leading to arbitrary file read risks on Moodle installations using TeX Live. To address this issue, users should upgrade Moodle to versions 4.5.2, 4.4.6, 4.3.10 or 4.1.16. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-26525.

In Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress versions 2.3.5 and prior a medium severity vulnerability CVE-2024-13798 was detected. This vulnerability allows unauthenticated attackers to create new orders for products and mark them as paid without completing a payment due to insufficient verification on form fields. To address this issue, users should upgrade Post Grid and Gutenberg Blocks – ComboBlocks plugin to version 2.3.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-13798.

In Rife Elementor Extensions & Templates plugin for WordPress versions 1.2.5 and prior a medium severity vulnerability CVE-2024-13564 was detected. This vulnerability allows authenticated attackers with contributor-level access and above to exploit Stored Cross-Site Scripting (XSS) via the Writing Effect Headline shortcode, enabling them to inject arbitrary web scripts that execute when users access an affected page due to insufficient input sanitization and output escaping. To address this issue, users should upgrade Rife Elementor Extensions & Templates plugin to version 2.38.9. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-13564.

In IP2Location Country Blocker plugin for WordPress versions 2.38.8 and prior a medium severity vulnerability CVE-2025-1361 was detected. This vulnerability allows unauthenticated attackers to access and view the plugin’s settings due to missing capability checks on the admin_init() function. To address this issue, users should upgrade IP2Location Country Blocker plugin to version 2.38.9. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-1361.

In WP-Appbox plugin for WordPress versions 4.5. and prior a medium severity vulnerability CVE-2025-1489 was detected. This vulnerability allows authenticated attackers with contributor-level access and above to exploit Stored Cross-Site Scripting (XSS) via the appbox shortcode due to insufficient input sanitization and output escaping. To address this issue, users should upgrade WP-Appbox plugin to version 4.5.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-1489.

In Event Tickets and Registration plugin for WordPress versions 5.19.1.1 and prior a medium severity vulnerability CVE-2025-1402 was detected. This vulnerability allows authenticated attackers with contributor-level access and above to delete arbitrary attendee tickets due to a missing capability check on the ‘ajax_ticket_delete’ function. To address this issue, users should upgrade Event Tickets and Registration plugin to version 5.19.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-1402.