Overview A medium-severity denial-of-service (DoS) vulnerability has been identified in Wireshark, specifically within the MEGACO dissector. This vulnerability, tracked as CVE-2025-13946, affects Wireshark versions 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11. An attacker could exploit this flaw by crafting malicious network traffic that triggers an infinite loop within the MEGACO dissector, leading to resource exhaustion and a denial of service condition. Technical Details The vulnerability resides in the MEGACO protocol dissector within Wireshark. Improper handling of specific MEGACO packets can cause the dissector to enter an infinite loop during packet analysis. This loop consumes excessive CPU resources, effectively rendering Wireshark…

Overview CVE-2025-13945 describes a medium severity vulnerability affecting Wireshark versions 4.6.0 and 4.6.1. This vulnerability resides in the HTTP3 dissector and can lead to a denial-of-service (DoS) condition if Wireshark processes a specially crafted packet. This article provides a detailed analysis of the vulnerability, its potential impact, and recommended mitigation strategies. Technical Details The vulnerability stems from a flaw in how the HTTP3 dissector handles malformed or unexpected data. Specifically, a crafted packet exploiting this flaw can cause Wireshark to crash, rendering it unable to analyze network traffic. The exact nature of the flaw is within the dissection logic of…

Overview A critical Remote Code Execution (RCE) vulnerability, identified as CVE-2025-13486, has been discovered in the Advanced Custom Fields: Extended plugin for WordPress. This vulnerability affects versions 0.9.0.5 through 0.9.1.1, allowing unauthenticated attackers to execute arbitrary code on the server. Immediate action is required to mitigate this risk. Technical Details The vulnerability resides in the prepare_form() function of the ACF Extended plugin. The function improperly handles user input, passing it directly to call_user_func_array(). This allows an attacker to inject malicious code through crafted requests, leading to Remote Code Execution. The lack of proper input sanitization and validation is the root…

Overview CVE-2025-12954 identifies a vulnerability in the Timetable and Event Schedule by MotoPress WordPress plugin. Specifically, versions prior to 2.4.16 fail to properly verify user access permissions during event duplication. This flaw allows users with limited roles, such as Contributor, to duplicate events they shouldn’t have access to, effectively leading to arbitrary event disclosure. This poses a significant risk as sensitive event details could be exposed to unauthorized individuals, potentially impacting privacy and security of scheduled events. Technical Details The vulnerability stems from a lack of access control checks within the event duplication functionality of the plugin. When a user…

Overview CVE-2025-13495 identifies a critical SQL Injection vulnerability present in the FluentCart plugin for WordPress. This flaw affects all versions of the plugin up to and including version 1.3.1. An authenticated attacker with Administrator-level privileges or higher can exploit this vulnerability to inject malicious SQL queries, potentially leading to sensitive data extraction from the WordPress database. Technical Details The vulnerability resides in the handling of the groupKey parameter within the RevenueReportService.php file. Insufficient input sanitization and a lack of proper SQL query preparation allows malicious users to append arbitrary SQL code to existing database queries. The vulnerable code is located…

Overview CVE-2025-12585 identifies a sensitive information exposure vulnerability within the MxChat – AI Chatbot for WordPress plugin. This vulnerability affects all versions of the plugin up to and including 2.5.5. An unauthenticated attacker can exploit this flaw by leveraging predictable upload filenames to extract session values. These extracted session values can then be used to gain unauthorized access to user conversation data. Technical Details The vulnerability stems from the way the MxChat plugin handles file uploads. The plugin utilizes predictable filenames when storing user-generated content, such as attachments within chat conversations. These filenames inadvertently expose session-related information. An attacker can…

Overview CVE-2025-10304 is a medium severity vulnerability affecting the Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin for WordPress. This vulnerability allows unauthenticated attackers to delete backup progress files, potentially causing backups to fail while they are in progress. This affects all versions up to and including 2.3.8. Technical Details The vulnerability stems from a missing capability check on the process_status_unlink() function within the plugin. This means that any user, even those not logged in, can trigger this function. By sending a crafted request to the server, an unauthenticated attacker can initiate the deletion of backup progress…

Overview A critical security vulnerability has been identified in the Modula Image Gallery plugin for WordPress, tracked as CVE-2025-13646. This vulnerability allows authenticated attackers with Author-level access or higher to upload arbitrary files to the affected WordPress server. Due to missing file type validation in a specific function, this could potentially lead to remote code execution (RCE) through race conditions, posing a significant risk to websites using the plugin. Technical Details The vulnerability resides in the ajax_unzip_file function within the Modula Image Gallery plugin, specifically in versions 2.13.1 and 2.13.2. The lack of proper file type validation during the upload…

Overview A high-severity security vulnerability, identified as CVE-2025-13645, has been discovered in the Modula Image Gallery plugin for WordPress. This flaw allows authenticated attackers with Author-level access or higher to delete arbitrary files on the server. Successful exploitation of this vulnerability can lead to Remote Code Execution (RCE) if critical files, such as wp-config.php, are deleted. This vulnerability affects versions 2.13.1 and 2.13.2 of the Modula Image Gallery plugin. It is crucial to update to a patched version immediately. Technical Details The vulnerability exists within the ajax_unzip_file function, where insufficient file path validation allows for the deletion of files outside…

Overview This article details a Stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2025-13448 affecting the CSSIgniter Shortcodes plugin for WordPress. The vulnerability allows authenticated attackers with Contributor-level access or higher to inject malicious JavaScript code into pages, which will execute whenever other users visit the affected pages. Technical Details The vulnerability resides within the ‘element’ attribute of a shortcode provided by the CSSIgniter Shortcodes plugin. Specifically, versions up to and including 2.4.1 are susceptible. The plugin fails to adequately sanitize user-supplied input passed through the ‘element’ attribute. This allows an attacker to inject arbitrary HTML and JavaScript code that is…