In CSV Me plugin for WordPress versions up to and including 2.0 a high severity vulnerability CVE-2025-6086 was detected. This vulnerability allows authenticated attackers with Administrator-level access and above to upload arbitrary files due to insufficient file type validation, potentially leading to remote code execution. Currently, there is no fixed version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6086.
Read more CMS
In Target Video Easy Publish plugin for WordPress versions up to and including 3.8.5 a medium severity vulnerability CVE-2025-5237 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the ‘width’ parameter due to insufficient input sanitization and output escaping. To address this issue, users should update Target Video Easy Publish plugin to versions 3.8.6 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-5237.
Read more CMS
In tarteaucitron.io plugin for WordPress versions before 1.9.5 a medium severity vulnerability CVE-2025-4955 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting (XSS) attacks by exploiting unsanitized query parameters from YouTube oEmbed URLs. To address this issue, users should upgrade tarteaucitron.io plugin to versions 1.9.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-4955.
Read more CMS
In Portainer Community Edition versions prior to STS 2.31.0 and LTS 2.27.7 a medium severity vulnerability CVE-2025-49593 was detected. This vulnerability allows HTTP headers – including registry authentication credentials or Portainer session tokens – to be leaked if a Portainer administrator registers a malicious container registry or if an existing registry is compromised. To address this issue, users should upgrade Portainer CE or BE version 2.31.0 or later for STS, or version 2.27.7 or later for LTS. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-49593.
Read more Developer Tools
In Grafana versions before 11.6.2 a low severity vulnerability CVE-2025-1088 was detected. This vulnerability allows excessively long dashboard titles or panel names to cause Chromium-based browsers to become unresponsive due to improper input validation. To address this issue, users should upgrade Grafana to versions 11.6.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-1088.
Read more Data Analytics
In Ivory Search plugin for WordPress versions before 5.5.10 a low severity vulnerability CVE-2025-5209 was detected. This vulnerability allows high privilege users, such as administrators, to perform Cross-Site Scripting (XSS) attacks due to insufficient sanitization and escaping of certain settings, even when the unfiltered_html capability is disallowed. To address this issue, users should upgrade Ivory Search plugin to versions 5.5.10 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-5209.
Read more CMS