Overview CVE-2025-12826 is a medium-severity vulnerability affecting the Custom Post Type UI (CPT UI) plugin for WordPress. This vulnerability allows authenticated attackers, even those with minimal (subscriber-level) privileges, to add, edit, or delete custom post types under specific conditions. This is due to a lack of proper authorization checks within a key function of the plugin. Published: 2025-12-04T07:16:14.920 Technical Details The vulnerability resides in the cptui_process_post_type function within the Custom Post Type UI plugin. Versions up to and including 1.18.0 fail to adequately verify if a user possesses the necessary capability to perform actions such as creating, modifying, or deleting…

Overview CVE-2025-12782 details an authorization bypass vulnerability found in the Beaver Builder – WordPress Page Builder plugin. This vulnerability affects all versions up to and including 2.9.4. It allows authenticated attackers with Contributor-level access or higher to disable the Beaver Builder layout on arbitrary posts and pages. This can lead to significant content integrity issues and disruption of the intended layout. Technical Details The vulnerability resides within the disable() function of the Beaver Builder plugin. The plugin fails to properly verify a user’s authorization before allowing them to disable the Beaver Builder layout on a specific post or page. This…

Overview A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Clik Stats WordPress plugin. This vulnerability, tracked as CVE-2025-13513, affects all versions of the plugin up to and including version 0.8. Unauthenticated attackers can exploit this flaw to inject arbitrary web scripts into pages viewed by users if they can successfully trick a user into performing an action such as clicking on a malicious link. Technical Details The vulnerability stems from insufficient input sanitization and output escaping of the $_SERVER['PHP_SELF'] parameter within the plugin’s code. Specifically, the vulnerable code resides in the ck_admin.php file. An attacker can craft…

Overview CVE-2025-11727 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability discovered in the “Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration – Powered by Codisto” plugin for WordPress. This vulnerability affects all versions up to and including 1.3.65. It allows unauthenticated attackers to inject malicious JavaScript code into pages, which is then executed whenever a user accesses those pages. This can lead to account compromise, data theft, and other malicious activities. Technical Details The vulnerability resides in the sync() function of the Codisto plugin. The root cause is insufficient input sanitization and output escaping of user-supplied data before it…

Overview CVE-2025-11379 is a medium-severity vulnerability affecting the WebP Express plugin for WordPress, versions 0.25.9 and earlier. This vulnerability allows unauthenticated attackers to potentially extract sensitive configuration data due to improper randomization of the configuration file name, particularly when the plugin is used with NGINX web servers. This flaw exposes configuration details that could be leveraged for further malicious activities. Technical Details The core issue lies in the WebP Express plugin’s failure to adequately randomize the name of its configuration file. In NGINX environments, this predictable file name makes it possible for an attacker to directly access the file via…

Overview This article provides a comprehensive overview of CVE-2025-62173, a critical authenticated SQL injection vulnerability affecting the Endpoint Module’s REST API in FreePBX. This vulnerability, reported on 2025-12-04, could allow an authenticated attacker to execute arbitrary SQL commands, potentially leading to data breaches, system compromise, and other severe consequences. While the CVSS score is currently marked as N/A, the inherent risk of SQL injection warrants immediate attention and mitigation. Technical Details CVE-2025-62173 stems from insufficient input sanitization within the Endpoint Module’s REST API. Specifically, certain parameters passed to the API are not properly validated before being incorporated into SQL queries.…

Overview CVE-2025-66404 identifies a security vulnerability within the exec_in_pod tool of MCP Server Kubernetes, a system designed to manage Kubernetes clusters. Versions prior to 2.9.8 are susceptible to command injection attacks. This vulnerability arises from insufficient input validation when handling user-provided commands in string format. Specifically, the tool directly passes these strings to shell interpretation (sh -c) without proper sanitization, enabling the execution of arbitrary commands. Technical Details The exec_in_pod tool allows users to execute commands within Kubernetes pods. The vulnerability lies in how the tool processes commands provided in string format. When a user provides a command as a…

Overview CVE-2025-66293 is a high-severity vulnerability affecting libpng, a widely used library for handling PNG image files. This vulnerability, specifically an out-of-bounds read, resides within the simplified API of libpng and can be triggered when processing certain valid PNG images. Successful exploitation could lead to information disclosure or denial-of-service. Technical Details The vulnerability stems from an out-of-bounds read in libpng’s simplified API when processing valid palette PNG images with partial transparency and gamma correction. Specifically, the issue occurs when reading beyond the `png_sRGB_base[512]` array, potentially reading up to 1012 bytes beyond the allocated memory. The vulnerability is triggered due to…

Overview This article provides a detailed analysis of CVE-2025-65868, a critical XML External Entity (XXE) injection vulnerability discovered in eyoucms version 1.7.1. This vulnerability allows remote attackers to potentially cause a denial-of-service (DoS) condition by exploiting the CMS’s XML parsing capabilities. Understanding the technical details, potential impact, and available mitigation strategies is crucial for securing eyoucms installations. Technical Details CVE-2025-65868 stems from insufficient input validation when processing XML data submitted through POST requests in eyoucms v1.7.1. An attacker can craft a malicious XML payload containing an external entity declaration that references a local or remote resource. When the CMS parses…

Overview CVE-2025-64055 describes a critical security vulnerability affecting Fanvil x210 V2 VoIP phones running firmware version 2.12.20. This vulnerability allows unauthenticated attackers on the same local network to bypass authentication mechanisms and gain access to sensitive administrative functions of the device. This includes, but is not limited to, file uploads, firmware updates, and device reboot. Technical Details The vulnerability resides in the authentication process of the Fanvil x210 V2. A crafted request, exploiting a flaw in how the device handles authentication tokens or session management, can circumvent the normal login procedures. Attackers can leverage this to access administrative interfaces without…