Our news and updates

In the Branda plugin for WordPress versions up to and including 3.4.24 a critical severity vulnerability CVE-2025-14998 was detected. This vulnerability allows unauthenticated attackers to take over user accounts, including administrator accounts, by exploiting improper validation of a user’s identity during password update operations. To address this issue, users should upgrade Branda plugin to version 3.4.29 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-14998.

In the Ninja Forms plugin for WordPress versions before 3.13.3 a high severity vulnerability CVE-2025-14072 was detected. This vulnerability allows unauthenticated attackers to generate valid access tokens through the REST API and use them to read sensitive form submissions. To address this issue, users should upgrade Ninja Forms to version 3.13.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-14072.

In the Comments plugin for WordPress versions before 7.6.40 a high severity vulnerability CVE-2025-13820 was detected. This vulnerability allows attackers to bypass authentication and log in as arbitrary users by exploiting improper identity validation when using the disqus.com provider, provided the attacker knows the victim’s email address and the user does not yet have a Disqus account. To address this issue, users should upgrade Comments plugin to version 7.6.40 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13820.

In the ShopBuilder plugin for WordPress versions before 3.2.2 a high severity vulnerability CVE-2025-13456 was detected. This vulnerability allows attackers to perform reflected cross-site scripting (XSS) by injecting malicious input that is not properly sanitized or escaped before being rendered in a page, potentially targeting high-privileged users such as administrators. To address this issue, users should upgrade ShopBuilder plugin to version 3.2.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13456.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a medium severity vulnerability CVE-2025-66488 was detected. This vulnerability affects installations using Amazon S3 for uploads and allows scripts to be executed in the context of the S3 or CDN domain due to improper handling of uploaded HTML or XML files. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-66488.

In the Drupal Form Builder module versions from 7.x-1.0 through 7.x-1.22 a medium severity vulnerability CVE-2026-0749 was detected. This vulnerability allows attackers to inject and execute arbitrary scripts in a victim’s browser due to improper neutralization of user-supplied input during web page generation. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-0749.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a medium severity vulnerability CVE-2025-68659 was detected. This vulnerability allows attackers to trigger an application-level denial of service by sending oversized JSON payloads to the username change endpoint (PUT /u//preferences/username), causing server delays and resource exhaustion that degrade performance for other users and services. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68659.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a high severity vulnerability CVE-2025-68479 was detected. This vulnerability allows attackers to take over subscriptions due to missing ownership checks in certain subscription-related endpoints. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68479.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a medium severity vulnerability CVE-2025-67723 was detected. This vulnerability allows stored Cross-Site Scripting (XSS) attacks via the Discourse Math plugin when using the KaTeX renderer, despite content security policy mitigations. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-67723.