CyberAlerts

CVE-2025-26763

WordPress Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider Plugin <= 3.94.0 - PHP Object Injection vulnerability

Description: Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection. This issue affects Responsive Slider by MetaSlider: from n/a through 3.94.0.

CVSS: CRITICAL (9.8)

EPSS Score: 0.04%

Source: CVE

February 22nd, 2025 (4 months ago)

CVE-2025-26760

WordPress Calculator Builder plugin <= 1.6.2 - Local File Inclusion vulnerability

Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Calculator Builder allows PHP Local File Inclusion. This issue affects Calculator Builder: from n/a through 1.6.2.

CVSS: HIGH (7.5)

EPSS Score: 0.08%

Source: CVE

February 22nd, 2025 (4 months ago)

CVE-2025-26757

WordPress FULL – Cliente plugin <= 3.1.26 - Local File Inclusion vulnerability

Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FULL SERVICES FULL Customer allows PHP Local File Inclusion. This issue affects FULL Customer: from n/a through 3.1.26.

CVSS: HIGH (7.5)

EPSS Score: 0.11%

Source: CVE

February 22nd, 2025 (4 months ago)

CVE-2025-26756

WordPress Magic the Gathering Card Tooltips plugin <= 3.5.0 - Cross Site Scripting (XSS) vulnerability

Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grimdonkey Magic the Gathering Card Tooltips allows Stored XSS. This issue affects Magic the Gathering Card Tooltips: from n/a through 3.5.0.

CVSS: HIGH (7.1)

EPSS Score: 0.03%

Source: CVE

February 22nd, 2025 (4 months ago)

CVE-2025-26750

WordPress Vitepos Plugin <= 3.1.3 - Broken Access Control vulnerability

Description: Missing Authorization vulnerability in appsbd Vitepos allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Vitepos: from n/a through 3.1.3.

CVSS: MEDIUM (6.5)

EPSS Score: 0.02%

Source: CVE

February 22nd, 2025 (4 months ago)

CVE-2025-0957

Vulnerability: SMTP for Amazon SES <= 1.7.1 - Unauthenticated Stored Cross-Site Scripting via Email Logs

Description: The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS: HIGH (7.2)

EPSS Score: 0.12%

Source: CVE

February 22nd, 2025 (4 months ago)

CVE-2025-0953

SMTP for Sendinblue – YaySMTP <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via Email Logs

Description: The SMTP for Sendinblue – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS: HIGH (7.2)

EPSS Score: 0.1%

Source: CVE

February 22nd, 2025 (4 months ago)

CVE-2025-0918

SMTP for SendGrid – YaySMTP <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via Email Logs

Description: The SMTP for SendGrid – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS: HIGH (7.2)

EPSS Score: 0.1%

Source: CVE

February 22nd, 2025 (4 months ago)

CVE-2024-13869

Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file

Description: The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_files' function in all versions up to, and including, 0.9.112. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.

CVSS: HIGH (7.2)

EPSS Score: 4.75%

Source: CVE

February 22nd, 2025 (4 months ago)

CVE-2025-1361

IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function

Description: The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing capability checks on the admin_init() function. This makes it possible for unauthenticated attackers to view the plugin's settings.

CVSS: HIGH (7.5)

EPSS Score: 0.05%

Source: CVE

February 22nd, 2025 (4 months ago)

Threat and Vulnerability Intelligence Database

Example Searches: