Our news and updates

In GitLab CE/EE versions 13.1 through 18.4.5, 18.5 through 18.5.3, and 18.6 through 18.6.1 a medium severity vulnerability CVE-2025-11984 was detected. This vulnerability allows authenticated attackers to bypass WebAuthn two-factor authentication by manipulating the session state under specific conditions. To address this issue, users should upgrade GitLab CE/EE to versions 18.4.6, 18.5.4 or 18.6.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-11984.

In GitLab EE versions 13.2 through 18.4.5, 18.5 through 18.5.3, and 18.6 through 18.6.1 a medium severity vulnerability CVE-2025-11247 was detected. This vulnerability allows authenticated users to disclose sensitive information from private projects by executing specifically crafted GraphQL queries. To address this issue, users should upgrade GitLab EE to versions 18.4.6, 18.5.4 or 18.6.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-11247.

In GitLab CE/EE versions 17.1 through 18.4.5, 18.5 through 18.5.3, and 18.6 through 18.6.1 a high severity vulnerability CVE-2025-8405 was detected. This vulnerability allows authenticated users to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays. To address this issue, users should upgrade GitLab CE/EE to versions 18.4.6, 18.5.4 or 18.6.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8405.

In GitLab CE/EE versions 11.10 through 18.4.5, 18.5 through 18.5.3, and 18.6 through 18.6.1 a high severity vulnerability CVE-2025-4097 was detected. This vulnerability allows authenticated users to trigger a denial-of-service condition by uploading specially crafted images. To address this issue, users should upgrade GitLab CE/EE to versions 18.4.6, 18.5.4 or 8.6.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-4097.

In Timetable and Event Schedule by MotoPress plugin for WordPress versions before 2.4.16 a low severity vulnerability CVE-2025-12954 was identified. This vulnerability arises because the plugin does not verify that a user has access to a specific event when duplicating events, allowing users with as low privileges as Contributor to duplicate and thereby access arbitrary event data. To address this issue, users should upgrade the plugin to version 2.4.16 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12954.

In Custom Post Type UI plugin for WordPress versions up to and including 1.18.0 a medium severity vulnerability CVE-2025-12826 was identified. This vulnerability occurs because the plugin fails to verify that a user has the required capability in the cptui_process_post_type function, allowing authenticated users with low privileges (e.g. Subscriber) to add, edit, or delete custom post types. To address this issue, users should upgrade the plugin to version 1.18.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12826.

In Booking Calendar plugin for WordPress versions up to and including 10.14.6 a medium severity vulnerability CVE-2025-12804 was identified. This vulnerability occurs due to insufficient input sanitization and output escaping on user supplied attributes in the ‘bookingcalendar’ shortcode, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. To address this issue, users should upgrade the plugin to version 10.14.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12804.

In Widgets for Google Reviews plugin for WordPress versions up to and including 13.2.4 a high severity vulnerability CVE-2025-12510 was identified. This vulnerability occurs due to insufficient input sanitization and output escaping on Google Reviews data imported by the plugin. It allows unauthenticated attackers to inject arbitrary web scripts that will execute in the admin panel (and potentially on the frontend) whenever a user accesses imported reviews, granted they can add a malicious review to a Google Place connected to the vulnerable site. To address this issue, users should upgrade the plugin to version 13.2.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12510.

In ContentStudio plugin for WordPress versions up to and including 1.3.7 a medium severity vulnerability CVE-2025-13144 was identified. This vulnerability occurs due to missing or insufficient nonce validation on the add_cstu_settings function, allowing unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. To address this issue, users should upgrade the plugin to version 1.4.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13144.