Executive Summary:
A critical vulnerability has been identified in the HaruTheme WooCommerce Designer Pro plugin, which could allow an unauthenticated attacker to take complete control of the affected web server. The flaw permits the upload of malicious files, such as a web shell, giving an attacker the ability to execute arbitrary code, steal sensitive data, and disrupt services. Due to the ease of exploitation and the maximum potential impact, this vulnerability is rated with the highest possible severity.

Vulnerability Details

CVE-ID: CVE-2025-60219

Affected Software: HaruTheme WooCommerce Designer Pro

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is an Unrestricted Upload of File with Dangerous Type. The application fails to properly validate the types of files being uploaded through its interface. An unauthenticated attacker can exploit this by crafting a request to upload a file with a dangerous extension (e.g., .php, .phtml) containing malicious code. Once the file, known as a web shell, is on the server, the attacker can access it via a direct URL to execute arbitrary commands with the permissions of the web server process, leading to a full system compromise.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 10.0, representing the highest possible risk. Successful exploitation would grant an attacker complete control over the web server. The potential consequences include theft of sensitive data such as customer personal information and payment details, intellectual property loss, website defacement, and the use of the compromised server to launch further attacks against other systems. This can lead to severe financial loss, regulatory fines, and significant reputational damage.

Remediation Plan

Immediate Action: Immediately update the HaruTheme WooCommerce Designer Pro plugin to the latest version provided by the vendor to patch this vulnerability. After patching, it is crucial to review server access logs and file systems for any signs of compromise or suspicious files that may have been uploaded prior to the update.

Proactive Monitoring: Monitor web server logs for unusual POST requests to file upload endpoints, especially those containing files with executable extensions (e.g., .php, .aspx, .jsp). Implement file integrity monitoring on web directories to detect the creation of unauthorized files. Watch for unexpected outbound network traffic from the web server, which could indicate a web shell communicating with a command-and-control server.

Compensating Controls: If patching cannot be performed immediately, consider the following controls:

• Implement a Web Application Firewall (WAF) with rules to inspect file uploads and block malicious file types and exploit attempts.
• If the upload functionality in the plugin is not business-critical, disable it entirely.
• Harden the web server by configuring upload directories with no-execute permissions to prevent uploaded scripts from running.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Sep 26, 2025, there are no known public exploits for this vulnerability. However, given its critical severity (CVSS 10.0) and the simplicity of the vulnerability class, it is highly probable that threat actors will develop and deploy exploits rapidly. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the critical severity of this vulnerability, immediate action is required. Organizations using the affected HaruTheme WooCommerce Designer Pro plugin must prioritize applying the security update without delay. Due to the high likelihood of exploitation, it is strongly recommended to assume the system is compromised if it was exposed to the internet before patching and to initiate incident response procedures to hunt for evidence of a web shell or other malicious activity.

---METADATA---
VENDOR: BoldThemes
PRODUCT: Addison
AFFECTED_VERSIONS: n/a through <= 1.4.2
CONFIDENCE: high
MISSING: patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
The BoldThemes Addison theme for WordPress contains an insecure deserialization vulnerability that allows unauthenticated remote object injection.

Executive Summary:
A critical deserialization vulnerability in the BoldThemes Addison theme allows unauthenticated attackers to execute arbitrary code via object injection.

Vulnerability Details

CVE-ID: CVE-2025-60216

Affected Software: BoldThemes Addison

Affected Versions: n/a through <= 1.4.2

Vulnerability: This flaw stems from the insecure handling of serialized data, which permits unauthenticated attackers to supply malicious objects that the application will deserialize, leading to remote code execution.

Business Impact

The 9.8 CVSS score reflects the extreme risk this vulnerability poses to business continuity and data security. An attacker exploiting this flaw could gain full control of the WordPress instance, potentially leading to unauthorized data access, service disruption, or the compromise of administrative credentials.

Remediation Plan

Immediate Action: Update the BoldThemes Addison theme to the latest patched version available from the vendor.

Proactive Monitoring: Monitor server logs for signs of unauthorized execution or unexpected file modifications that typically follow an object injection attack.

Compensating Controls: Implement WAF rules specifically designed to detect and block serialized objects within HTTP requests to mitigate the risk until updates are applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Oct 22, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the critical nature of this vulnerability, immediate action is required. Organizations using the Addison theme must prioritize the update to the latest version to eliminate the risk of remote code execution.

Executive Summary:
A critical vulnerability, identified as CVE-2025-60214, has been discovered in the BoldThemes Goldenblatt software. This flaw allows an unauthenticated remote attacker to execute arbitrary code on the server, potentially leading to a full system compromise. Successful exploitation could result in data theft, service disruption, or the deployment of malware such as ransomware.

Vulnerability Details

CVE-ID: CVE-2025-60214

Affected Software: BoldThemes Goldenblatt

Affected Versions: All versions up to and including 1.2.1

Vulnerability: The software is vulnerable to Deserialization of Untrusted Data. The application fails to properly sanitize user-supplied data before it is deserialized, which can lead to Object Injection. An unauthenticated remote attacker can craft a malicious serialized object and send it to the application, which, upon deserialization, can trigger a chain of code execution (known as a "gadget chain") already present in the application's libraries, resulting in arbitrary code execution with the permissions of the web server process.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, indicating a high risk to the organization. A successful attack could lead to a complete compromise of the affected server, allowing an attacker to steal sensitive corporate or customer data, install persistent backdoors, deploy ransomware, or use the compromised system as a pivot point to attack other internal network resources. The potential for reputational damage, financial loss, and operational disruption is significant.

Remediation Plan

Immediate Action: Immediately update the BoldThemes Goldenblatt software to the latest version available from the vendor, which addresses this vulnerability. After patching, monitor server logs for any signs of attempted or successful exploitation that may have occurred prior to the update. Review access logs for unusual or suspicious requests, particularly those with large, encoded payloads.

Proactive Monitoring: Implement enhanced monitoring on affected systems. Look for anomalous activity in web server and application logs, such as unexpected error messages related to serialization or requests containing long, complex strings. Monitor for unexpected processes being spawned by the web server or unusual outbound network connections from the server.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block deserialization attack patterns. Restrict network access to the application, allowing connections only from trusted IP addresses. Egress filtering can also help prevent a compromised server from establishing outbound connections to an attacker's command-and-control infrastructure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Oct 22, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the critical CVSS score of 9.8 and the unauthenticated remote code execution nature of the flaw, it is highly probable that threat actors will develop and release exploit code in the near future.

Analyst Recommendation

Given the critical severity (CVSS 9.8) of this vulnerability, we strongly recommend that organizations prioritize the immediate patching of all affected BoldThemes Goldenblatt instances. This vulnerability represents a direct and severe threat of system compromise. While this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its characteristics make it a prime candidate for future inclusion. Organizations must act urgently to apply the vendor-provided updates or implement the recommended compensating controls to mitigate this risk.

Executive Summary:
A critical vulnerability has been discovered in Whitebox-Studio Scape, identified as CVE-2025-60213, with a CVSS score of 9.8. This flaw allows an unauthenticated remote attacker to execute arbitrary code on the affected system by sending a specially crafted data payload. Successful exploitation could lead to a complete compromise of the server, enabling data theft, service disruption, and further network intrusion.

Vulnerability Details

CVE-ID: CVE-2025-60213

Affected Software: Whitebox-Studio Scape

Affected Versions: All versions up to and including 1.5.13

Vulnerability: The vulnerability is a Deserialization of Untrusted Data flaw. The Scape application improperly handles user-supplied serialized data, failing to validate it before processing. An unauthenticated remote attacker can exploit this by sending a malicious serialized object to the application endpoint, which, when deserialized, triggers an object injection that leads to arbitrary code execution with the permissions of the application service account.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. A successful exploit could have a severe impact on the business, allowing an attacker to take full control of the affected server. Potential consequences include the theft of sensitive company or customer data, deployment of ransomware, disruption of critical business operations dependent on the application, and using the compromised system as a pivot point to attack other internal network resources. The risk of data breaches, financial loss, and significant reputational damage is extremely high.

Remediation Plan

Immediate Action: Update Whitebox-Studio Scape to the latest version available from the vendor (a version later than 1.5.13). After patching, monitor for any signs of post-exploitation activity and review historical access logs for indicators of compromise that may have occurred prior to remediation.

Proactive Monitoring: Implement enhanced monitoring on affected systems. Security teams should look for unusual process execution originating from the Scape application, unexpected outbound network connections from the server, and application logs showing deserialization errors or warnings. Monitor for suspicious file modifications or the creation of unknown files in the application's directories.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Restrict network access to the Scape application, allowing connections only from trusted IP addresses.
• Deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block malicious serialized object payloads.
• Implement strict egress filtering to prevent the server from making outbound connections to unauthorized external hosts.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of October 22, 2025, this vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and there are no known public exploits available. However, vulnerabilities involving deserialization are well understood and often lead to reliable exploit development. Given the critical CVSS score, organizations should assume that threat actors are actively working to develop an exploit.

Analyst Recommendation

Due to the critical severity and the high probability of future exploitation leading to remote code execution, it is imperative that organizations prioritize patching this vulnerability immediately. All instances of Whitebox-Studio Scape version 1.5.13 and earlier should be updated without delay. If patching cannot be performed immediately, apply the recommended compensating controls and actively monitor systems for any signs of compromise.

Executive Summary:
A critical vulnerability has been identified in the wpeverest Everest Forms plugin for WordPress, specifically related to the Frontend Listing add-on. This flaw, rated 9.8 out of 10, allows an unauthenticated attacker to inject malicious code and potentially gain complete control over the affected website. Successful exploitation could lead to data theft, website defacement, or the server being used for further malicious activities.

Vulnerability Details

CVE-ID: CVE-2025-60210

Affected Software: wpeverest Everest Forms and its add-on, Everest Forms - Frontend Listing

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Deserialization of Untrusted Data, which leads to PHP Object Injection. The application improperly handles user-supplied data when processing form listings. An unauthenticated remote attacker can send a specially crafted serialized PHP object to the application. When the application deserializes this malicious data, the object is created in memory, and its code can be executed, resulting in arbitrary code execution on the web server with the privileges of the web service account.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. A successful exploit could lead to a full compromise of the web server hosting the WordPress site. The potential business impacts are severe and include theft of sensitive data (such as customer information, user credentials, and payment details), complete website defacement, disruption of business operations, and significant reputational damage. The compromised server could also be leveraged to attack other internal systems or to distribute malware, creating further legal and financial liabilities for the organization.

Remediation Plan

Immediate Action: Immediately update the wpeverest Everest Forms plugin and all associated add-ons to the latest version provided by the vendor to patch this vulnerability. After applying the update, it is critical to review web server and application access logs for any suspicious activity or exploitation attempts that may have occurred prior to patching.

Proactive Monitoring: Implement monitoring to detect potential exploitation attempts. Security teams should look for unusual POST requests in web server logs, particularly those containing long, base64-encoded, or complex strings indicative of serialized PHP objects. Monitor the file system for the creation of unexpected files (e.g., PHP webshells) in web-accessible directories, and watch for anomalous system behavior such as unexpected outbound network connections or high CPU utilization from the web server process.

Compensating Controls: If immediate patching is not feasible, consider the following controls to mitigate risk:

• Web Application Firewall (WAF): Deploy or update a WAF with rules specifically designed to detect and block PHP object injection and deserialization attacks.
• Disable Plugin: If the functionality is not business-critical, temporarily disable the "Everest Forms" and "Everest Forms - Frontend Listing" plugins until patching can be completed.
• Access Control: Restrict access to the website and any form submission endpoints to trusted IP ranges, if applicable.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of October 22, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, given the critical CVSS score of 9.8 and the low complexity of exploitation, it is highly probable that a functional exploit will be developed by security researchers and threat actors in the near future. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, but organizations should monitor its status closely.

Analyst Recommendation

Due to the critical severity (CVSS 9.8) of this vulnerability, which allows for unauthenticated remote code execution, we recommend immediate and urgent action. All instances of the wpeverest Everest Forms plugin and its add-ons must be updated to a patched version without delay. Although this vulnerability is not yet on the CISA KEV list, its potential impact warrants treating it with the highest priority. If patching cannot be performed immediately, the plugin should be disabled to prevent compromise of the web server.

Executive Summary:
A high-severity vulnerability, identified as CVE-2025-60209, has been discovered in the CRM Perks Connector for Gravity Forms and Google Sheets WordPress plugin. This flaw allows an unauthenticated attacker to inject malicious code and potentially take full control of the affected website. Organizations using this plugin are at significant risk of data breaches, website defacement, and further network compromise.

Vulnerability Details

CVE-ID: CVE-2025-60209

Affected Software: Google Multiple Products (Specifically, the "CRM Perks Connector for Gravity Forms and Google Sheets" WordPress plugin, which integrates with Google Sheets)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Deserialization of Untrusted Data flaw within the WordPress plugin. An unauthenticated attacker can send a specially crafted serialized PHP object to an endpoint handled by the plugin. The application insecurely deserializes this data without proper validation, which can instantiate a malicious object in memory. By leveraging existing code within the WordPress environment (known as a "POP chain"), an attacker can trigger a chain of events leading to arbitrary code execution, file manipulation, or other unauthorized actions on the web server.

Business Impact

This is a high-severity vulnerability with a CVSS score of 8.2, posing a significant risk to the business. Successful exploitation could lead to a complete compromise of the web server hosting the affected WordPress site. The potential consequences include theft of sensitive data from the website's database (such as customer information or form submissions), service disruption, website defacement, and the use of the compromised server as a launch point for further attacks against the internal network, leading to severe financial and reputational damage.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor immediately. All systems running the "CRM Perks Connector for Gravity Forms and Google Sheets" plugin should be identified and patched as a top priority. Following the update, administrators should monitor for any signs of exploitation attempts by reviewing web server and application access logs.

Proactive Monitoring: Security teams should monitor web server access logs for unusual POST requests, particularly those containing long, encoded strings which may indicate a serialized object. Monitor PHP and application error logs for deserialization-related errors. File Integrity Monitoring (FIM) should be used to detect unauthorized changes to plugin files, and network traffic should be monitored for any suspicious outbound connections from the web server.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block PHP object injection attempts. As a temporary measure, consider disabling the affected plugin until it can be safely updated. Restricting access to pages utilizing the plugin to trusted IP addresses can also reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of October 22, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, deserialization vulnerabilities are well-understood, and the technical details provided in an advisory are often sufficient for skilled attackers to develop a functional exploit.

Analyst Recommendation

Given the high CVSS score of 8.2 and the potential for unauthenticated remote code execution, this vulnerability represents a critical risk. Although it is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its severity makes it a likely target for future exploitation. We strongly recommend that all organizations using the affected plugin prioritize applying the vendor-supplied patch immediately to prevent potential system compromise.

Executive Summary:
A high-severity vulnerability has been identified in the WooCommerce Store Toolkit plugin, which allows an attacker to access and potentially execute sensitive files on the web server. Successful exploitation could lead to the exposure of confidential data, such as database credentials, or a complete compromise of the affected website. Organizations are urged to apply the vendor-provided security patch immediately to mitigate this risk.

Vulnerability Details

CVE-ID: CVE-2025-60204

Affected Software: Josh Kohlbach WooCommerce Store Toolkit

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Local File Inclusion (LFI) flaw. It exists because the application uses user-supplied input to construct a file path for a PHP include or require statement without proper validation. An attacker can exploit this by manipulating the input with directory traversal sequences (e.g., ../) to force the application to include and execute arbitrary PHP files already on the server or to read the contents of sensitive system files, such as wp-config.php or /etc/passwd.

Business Impact

This vulnerability is rated as high severity with a CVSS score of 7.5. Exploitation could have a significant business impact, including the theft of sensitive data like customer information and database credentials, leading to a major data breach. An attacker could also leverage this flaw to gain further access, deface the website, or execute malicious code, potentially resulting in a full server compromise. The consequences include financial loss, reputational damage, and potential regulatory penalties.

Remediation Plan

Immediate Action: Apply the security updates provided by the vendor, Josh Kohlbach, immediately. This is the most effective way to eliminate the vulnerability. After patching, review web server access logs and system logs for any signs of exploitation that may have occurred prior to remediation.

Proactive Monitoring: Security teams should monitor web server logs for suspicious requests containing directory traversal patterns (../), null bytes (%00), and attempts to access common sensitive files (e.g., wp-config.php, /etc/shadow, .env). Monitor for unexpected file modifications on the server or the creation of new, unauthorized files in web-accessible directories.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block LFI and directory traversal attacks. Additionally, harden server file permissions to ensure the web server process has read/write access only to the directories it absolutely requires, limiting the impact of a potential breach.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date, November 6, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, LFI vulnerabilities are a well-understood and commonly targeted class of flaw, and proof-of-concept exploits are often developed quickly by security researchers and threat actors.

Analyst Recommendation

Given the high severity (CVSS 7.5) and the potential for complete system compromise, organizations must treat this vulnerability with high priority. The recommended course of action is to apply the vendor-supplied patch across all affected systems without delay. Although this CVE is not currently on the CISA KEV list, the ease of exploitation for LFI vulnerabilities warrants immediate attention to prevent future compromise. Security teams should confirm the patch has been successfully deployed and continue to monitor for any related indicators of attack.

Executive Summary:
A high-severity vulnerability has been identified in multiple products from the Josh Kohlbach Store, specifically affecting the woocommerce-exporter plugin. This flaw allows an attacker to access sensitive files on the web server, potentially leading to the theft of confidential data such as database credentials, customer information, and system configuration files. Immediate application of vendor-supplied security updates is required to mitigate the risk of server compromise and data breach.

Vulnerability Details

CVE-ID: CVE-2025-60203

Affected Software: Josh Kohlbach Store Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Local File Inclusion (LFI) flaw within the woocommerce-exporter plugin. It stems from an improper control of filenames used in PHP's include or require statements. An unauthenticated remote attacker can manipulate an input parameter to trick the application into including and executing arbitrary files from the local server's file system. By supplying specially crafted file paths, such as those using directory traversal sequences (../), an attacker could read sensitive files like wp-config.php (containing database credentials), /etc/passwd, or other application and system files.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Successful exploitation could lead to significant business consequences, including the exposure of sensitive corporate and customer data, intellectual property theft, and a complete compromise of the web application. The theft of database credentials could grant an attacker full access to the underlying database, resulting in a major data breach. Such an incident could cause severe reputational damage, financial loss, and potential regulatory fines.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor across all affected systems immediately. After patching, it is crucial to review web server access logs and application logs for any signs of past or ongoing exploitation attempts.

Proactive Monitoring: Security teams should actively monitor web server logs for requests containing common LFI patterns, such as directory traversal characters (../, ..%2f), and attempts to access sensitive system files (e.g., wp-config.php, /etc/passwd). Implement file integrity monitoring to detect unauthorized changes to critical application files.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules designed to detect and block LFI and directory traversal attack patterns. Additionally, harden the server's PHP configuration by ensuring allow_url_fopen and allow_url_include are disabled and by using the open_basedir directive to restrict the file paths PHP can access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 6, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the nature of LFI vulnerabilities, proof-of-concept exploits are often developed quickly by security researchers and threat actors.

Analyst Recommendation
Given the high severity (CVSS 7.5) and the potential for complete data compromise, we strongly recommend that organizations prioritize the immediate deployment of the vendor-provided patches. Although this CVE is not currently listed on the CISA KEV list, its impact makes it a highly attractive target for attackers. Organizations should treat this as a critical vulnerability and proceed with the remediation plan without delay to prevent potential compromise.

Executive Summary:
A high-severity vulnerability has been identified in the InHype WordPress Theme, which could allow an attacker to read sensitive files on the web server. This flaw, known as Local File Inclusion, can be exploited remotely without authentication, potentially exposing confidential data such as database credentials, system files, and application source code. Successful exploitation could lead to a full server compromise, data breach, and significant operational disruption.

Vulnerability Details

CVE-ID: CVE-2025-60199

Affected Software: dedalx InHype - Blog & Magazine WordPress Theme

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Local File Inclusion (LFI) flaw. It exists because the theme's code improperly handles user-supplied input when including files using PHP's include() or require() functions. An unauthenticated attacker can manipulate a URL parameter to inject directory traversal sequences (e.g., ../../..) and force the application to include and display the contents of arbitrary files from the server's local file system. This could allow the attacker to access sensitive information, such as the wp-config.php file containing database credentials, or system files like /etc/passwd.

Business Impact

This is a high-severity vulnerability with a CVSS score of 8.2. Exploitation could have a severe impact on the business, leading to a significant data breach through the exposure of sensitive files and credentials. An attacker could leverage this access to gain further control over the web server, deface the website, install malware, or use the compromised server to launch attacks against other systems. The potential consequences include reputational damage, loss of customer trust, regulatory penalties for data exposure, and significant costs associated with incident response and system recovery.

Remediation Plan

Immediate Action: The primary remediation is to update the 'InHype - Blog & Magazine WordPress Theme' to the latest version provided by the vendor, which contains a patch for this vulnerability. If the theme is not essential or no longer in use, it should be deactivated and completely removed from the WordPress installation to eliminate the attack surface.

Proactive Monitoring: Monitor web server access logs for suspicious requests containing directory traversal patterns (e.g., ../, %2e%2e/) or attempts to access common sensitive files (wp-config.php, /etc/passwd, .env) within URL parameters. Monitor for any unusual file modifications or outbound network connections from the web server, which could indicate a successful compromise.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block LFI and directory traversal attacks. Additionally, ensure PHP is hardened by disabling allow_url_include in the php.ini configuration and that the web server process runs with the principle of least privilege, restricting its ability to read files outside of the web root directory.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 6, 2025, there are no known public exploits or reports of this vulnerability being actively exploited in the wild. However, LFI is a well-understood vulnerability class, and security researchers or threat actors could develop a functional exploit with minimal effort. Organizations should operate under the assumption that an exploit could become available at any time.

Analyst Recommendation

Given the high severity (CVSS 8.2) of this vulnerability and the potential for complete server compromise, immediate action is required. It is strongly recommended that all organizations using the 'InHype - Blog & Magazine WordPress Theme' apply the vendor-supplied patch or remove the theme without delay. Although this CVE is not currently on the CISA KEV catalog, its high potential for impact warrants urgent prioritization in your patch management cycle to prevent data exposure and system compromise.

Executive Summary:
A high-severity vulnerability has been identified in the Saxon WordPress theme, which allows for Local File Inclusion (LFI). An unauthenticated attacker could exploit this flaw to read sensitive files from the underlying server, such as configuration files containing database credentials. Successful exploitation could lead to a significant data breach and potential full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-60198

Affected Software: dedalx Saxon - Viral Content Blog & Magazine Marketing WordPress Theme

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability, classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), exists within the Saxon WordPress theme. The application fails to properly sanitize user-supplied input that is used as a path in a PHP include or require statement. An unauthenticated remote attacker can manipulate this input to include arbitrary local files on the server. By crafting a malicious request containing path traversal sequences (e.g., ../), an attacker can force the application to read and display the contents of sensitive files, such as wp-config.php or /etc/passwd, within the web server's response.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.2. Exploitation could have a severe impact on the business, leading to a major data breach. If an attacker successfully reads the wp-config.php file, they will gain access to database credentials, which could be used to access, modify, or exfiltrate all data stored in the website's database. This exposure of sensitive customer data or proprietary information can result in significant financial loss, regulatory fines, and irreparable damage to the organization's reputation and customer trust.

Remediation Plan

Immediate Action:

• Identify all WordPress instances using the "Saxon" theme and immediately update it to the latest version provided by the vendor (dedalx).
• If the Saxon theme is installed but not active or no longer needed on any WordPress site, it should be completely removed to eliminate the attack surface.

Proactive Monitoring:

• Review web server access logs for requests containing path traversal characters (e.g., ../, ..\/) or requests attempting to access common sensitive files (e.g., wp-config.php, /etc/passwd, .env).
• Implement File Integrity Monitoring (FIM) on critical server files to detect any unauthorized access or changes.
• Monitor for unusual outbound network traffic from the web server, which could indicate a post-exploitation data exfiltration attempt.

Compensating Controls:

• Deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block Local File Inclusion and path traversal attack patterns.
• Harden the underlying server's PHP configuration by using the open_basedir directive to restrict the file paths that PHP is allowed to access.
• Ensure the web server process runs under a low-privileged user account to limit the scope of files an attacker can read if the vulnerability is exploited.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 6, 2025, there is no known public proof-of-concept exploit code, and there are no reports of this vulnerability being actively exploited in the wild. However, LFI vulnerabilities in popular WordPress components are highly sought after by threat actors and are often quickly weaponized once technical details become public.

Analyst Recommendation

Given the high CVSS score of 8.2 and the potential for complete database compromise, this vulnerability poses a significant risk to the organization. It is strongly recommended that all system administrators immediately identify assets running the vulnerable Saxon WordPress theme and apply the necessary updates without delay. Although this CVE is not currently listed on the CISA KEV catalog, its severity and the ubiquity of WordPress warrant immediate attention. Prioritize patching on production and internet-facing systems, and consider removing the theme entirely if it is not essential to business operations.

Executive Summary:
A high-severity vulnerability has been discovered in multiple products from the vendor Improper. This flaw, identified as CVE-2025-60197, could allow an unauthenticated remote attacker to read sensitive files on the server, potentially exposing confidential data like system credentials, configuration files, and user information. Immediate application of vendor-provided security updates is necessary to mitigate the risk of data compromise and further system intrusion.

Vulnerability Details

CVE-ID: CVE-2025-60197

Affected Software: Improper Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Local File Inclusion (LFI) flaw resulting from the improper sanitization of user-supplied input used in PHP include or require statements. An unauthenticated remote attacker can manipulate a file path parameter in a request to the affected application. By using directory traversal sequences (e.g., ../), the attacker can trick the application into including and displaying the contents of arbitrary files from the server's local file system that are readable by the web server process.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.2. Successful exploitation could lead to significant data breaches by exposing sensitive information stored on the server, including application source code, database credentials, API keys, and system configuration files like /etc/passwd. The theft of such information could result in regulatory penalties, financial loss, reputational damage, and could serve as a foothold for attackers to escalate privileges and conduct more severe attacks against the organization's internal network.

Remediation Plan

Immediate Action: Apply vendor security updates immediately. System administrators should prioritize the deployment of the patches released by the vendor across all affected systems to eliminate the vulnerability. After patching, review web server access logs for any evidence of exploitation attempts that may have occurred prior to remediation.

Proactive Monitoring: Security teams should actively monitor web server logs for HTTP requests containing directory traversal patterns (e.g., ../, %2e%2e/) in URL parameters. Implement alerts for unusual file access attempts by the web server's user account. Network monitoring should be in place to detect any anomalous outbound traffic from affected servers, which could indicate data exfiltration.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block LFI and directory traversal attack patterns.
• Enforce the principle of least privilege by hardening file system permissions to ensure the web server process can only access files within the web root directory.
• If possible, disable dangerous PHP functions and ensure secure configurations are in place.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 6, 2025, this vulnerability has been recently disclosed. There are no known public proof-of-concept exploits or reports of this vulnerability being actively exploited in the wild. However, LFI vulnerabilities are well-understood and relatively easy to exploit, so it is highly probable that threat actors will develop exploits in the near future.

Analyst Recommendation

Given the High severity (CVSS 8.2) of this vulnerability and its potential to cause a significant data breach, we recommend immediate and decisive action. Organizations must prioritize the application of the vendor-supplied security patches to all affected systems. Although this vulnerability is not currently on the CISA Known Exploited Vulnerabilities (KEV) catalog, its critical nature warrants treatment as a high-priority threat. Proactive monitoring and the implementation of compensating controls should be pursued to provide a defense-in-depth security posture.

---METADATA---
VENDOR: Vito Peleg
PRODUCT: Atarim (atarim-visual-collaboration)
AFFECTED_VERSIONS: n/a through <= 4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An incorrect privilege assignment vulnerability in the Atarim visual collaboration plugin allows unauthorized users to escalate their privileges.

Executive Summary:
The Vito Peleg Atarim plugin is affected by a critical privilege escalation vulnerability that allows unauthorized users to gain elevated administrative access.

Vulnerability Details

CVE-ID: CVE-2025-60195

Affected Software: Vito Peleg Atarim

Affected Versions: n/a through <= 4.2

Vulnerability: The plugin incorrectly handles user privilege assignments, which can be leveraged by authenticated users to escalate their access level. This flaw compromises the integrity of the WordPress user management system.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe threat to organizational security. An attacker who successfully escalates their privileges can modify system settings, access sensitive user data, or gain total administrative control over the platform, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the Atarim visual collaboration plugin to the latest available version to address the privilege assignment logic.

Proactive Monitoring: Audit user account changes and administrative logs for unauthorized privilege modifications or suspicious activity by standard user accounts.

Compensating Controls: Implement strict role-based access control (RBAC) and limit administrative privileges to only those users who strictly require them until the patch is applied.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Nov 6, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS score, immediate patching is required to prevent unauthorized privilege escalation. Security teams should ensure that all instances of the Atarim plugin are updated to a version that includes the necessary security fixes.

Executive Summary:
A high-severity vulnerability has been identified in the Premmerce Product Search for WooCommerce plugin. This flaw, known as a Local File Inclusion, could allow an unauthenticated attacker to read sensitive files from the underlying web server, such as configuration files containing database credentials. Successful exploitation could lead to a significant data breach and further system compromise.

Vulnerability Details

CVE-ID: CVE-2025-60194

Affected Software: Premmerce Product Search for WooCommerce

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Local File Inclusion (LFI) flaw resulting from an improper control of filenames used in PHP's include or require statements. An attacker can exploit this by crafting a special request that manipulates an input parameter to specify a file path on the server. This forces the application to include and potentially execute or display the contents of arbitrary local files, such as wp-config.php (containing database credentials) or system files like /etc/passwd.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation could have a severe business impact, primarily affecting data confidentiality and system integrity. An attacker could exfiltrate sensitive information, including database credentials, API keys, and other application secrets stored on the server. This could lead to a full database compromise, unauthorized access to customer data, reputational damage, regulatory fines, and provide a foothold for attackers to escalate their privileges and move laterally across the network.

Remediation Plan

Immediate Action: Identify all websites using the vulnerable "Premmerce Product Search for WooCommerce" plugin and apply the security updates provided by the vendor immediately. After patching, review web server access logs for any signs of exploitation that may have occurred prior to the update.

Proactive Monitoring: Security teams should actively monitor web server logs for suspicious requests targeting the vulnerable plugin. Look for log entries containing path traversal sequences (e.g., ../, ..\/) or attempts to access common sensitive files like wp-config.php, .env, or /etc/passwd. Monitor for unusual PHP errors in logs, which could indicate failed inclusion attempts.

Compensating Controls: If immediate patching is not feasible, consider implementing a Web Application Firewall (WAF) with rules designed to detect and block LFI and path traversal attack patterns. As a temporary measure, disabling the vulnerable plugin can also remove the immediate attack vector until a patch can be applied. Restricting the web server's file permissions can also limit the impact by preventing it from accessing sensitive files outside of its root directory.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 6, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, vulnerabilities of this type in popular WordPress/WooCommerce plugins are frequently targeted by threat actors shortly after disclosure. Organizations should assume that exploit code will become available and act accordingly.

Analyst Recommendation
Given the high severity (CVSS 7.5) and the potential for sensitive data exposure, it is critical that organizations prioritize the remediation of this vulnerability. We strongly recommend immediately applying the vendor-supplied security patch to all instances of the affected plugin. Although this vulnerability is not currently listed on the CISA KEV catalog, its impact is significant, and proactive patching is the most effective defense against potential future exploitation.

Executive Summary:
A high-severity vulnerability has been identified in multiple Premmerce products, specifically the Premmerce Wholesale Pricing for WooCommerce plugin. This flaw allows an attacker to trick the application into accessing and displaying the contents of sensitive files on the server. Successful exploitation could lead to the exposure of confidential data, such as configuration details and user credentials, potentially enabling further unauthorized access to the system.

Vulnerability Details

CVE-ID: CVE-2025-60192

Affected Software: Premmerce Premmerce Wholesale Pricing for WooCommerce

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Local File Inclusion (LFI) flaw resulting from an improper control of a filename used in a PHP include() or require() statement. The application fails to properly sanitize user-supplied input that is used to construct a file path. An unauthenticated remote attacker can exploit this by manipulating input parameters with directory traversal sequences (e.g., ../) to navigate the server's file system and include arbitrary files. This could allow the attacker to read sensitive files like wp-config.php (containing database credentials), /etc/passwd, or other system and application files, leading to significant information disclosure.

Business Impact

This vulnerability is rated as high severity with a CVSS score of 7.5. Exploitation could have a significant negative impact on the business by leading to the compromise of sensitive data, including customer information, intellectual property, and system credentials. This data breach could result in direct financial loss, severe reputational damage, and potential regulatory penalties for non-compliance with data protection standards. If the attacker can leverage this LFI to achieve code execution, they could gain complete control over the web server, disrupting business operations and enabling further attacks against the internal network.

Remediation Plan

Immediate Action: Organizations must apply the security updates provided by the vendor to all affected systems immediately. Before deployment to production, patches should be tested in a staging environment to ensure compatibility and stability. Following the update, it is crucial to monitor for any signs of exploitation attempts and to conduct a thorough review of historical access logs for indicators of compromise.

Proactive Monitoring: Security teams should actively monitor web server access logs for requests containing directory traversal patterns (e.g., ../, ..%2f, ..\) in URL parameters associated with the affected plugin. Monitor for unusual read attempts on sensitive system files by the web server process. Implementing file integrity monitoring can help detect unauthorized changes to critical application files.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block LFI and directory traversal attacks. Additionally, harden the web server's file permissions to restrict the web server user's access to only necessary files and directories, limiting the impact of a potential breach. Ensure PHP configurations are hardened, for example, by disabling allow_url_include.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 6, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, LFI vulnerabilities are well-understood and relatively easy to exploit. It is highly probable that proof-of-concept (PoC) exploit code will be developed and released by security researchers or threat actors in the near future.

Analyst Recommendation

Given the high CVSS score of 7.5 and the potential for sensitive data exposure and server compromise, this vulnerability presents a significant risk. We strongly recommend that organizations identify all instances of the affected Premmerce software and prioritize the immediate application of vendor-supplied security patches. Although this CVE is not currently listed on the CISA KEV catalog, its severity warrants urgent attention. Proactive monitoring for exploitation attempts should be implemented concurrently to detect and respond to any malicious activity targeting this flaw.

Executive Summary:
A high-severity vulnerability has been identified in multiple Premmerce products, specifically affecting the Premmerce Wishlist for WooCommerce plugin. This flaw, a Local File Inclusion, could allow an unauthenticated attacker to read sensitive files from the underlying server, such as configuration files containing database credentials. Successful exploitation could lead to a significant data breach and further compromise of the web application and server.

Vulnerability Details

CVE-ID: CVE-2025-60191

Affected Software: Premmerce Premmerce Multiple Products, including Premmerce Wishlist for WooCommerce.

Affected Versions: See vendor advisory for specific affected versions.

Vulnerability: The vulnerability is a Local File Inclusion (LFI) resulting from an improper control of a filename used in a PHP include or require statement. An attacker can exploit this by sending a specially crafted request to the web server that includes path traversal sequences (e.g., ../) or absolute file paths. The vulnerable application code fails to properly sanitize this input, causing it to include and potentially display the contents of arbitrary files from the server's local file system that are readable by the web server process, such as wp-config.php or /etc/passwd.

Business Impact

This is a high-severity vulnerability with a CVSS score of 7.5. Exploitation can lead to the disclosure of highly sensitive information, including database credentials, application source code, and system configuration files. This information leak can serve as a stepping stone for more severe attacks, such as complete database compromise, administrative account takeover, or full system control. The potential business impact includes significant data breaches, reputational damage, loss of customer trust, and potential regulatory fines.

Remediation Plan

Immediate Action: Apply the security updates provided by Premmerce to all affected products immediately. Patches can typically be applied through the WordPress administration dashboard. After patching, it is critical to review web server access logs for any signs of exploitation attempts that may have occurred prior to the update.

Proactive Monitoring: Security teams should actively monitor web server access logs for requests targeting the vulnerable plugin's endpoints. Look for suspicious patterns in request parameters, such as directory traversal characters (../, ..\/), absolute file paths (e.g., /etc/passwd), or PHP wrappers like php://filter. Implement alerts within a Security Information and Event Management (SIEM) or a Web Application Firewall (WAF) to detect and block these malicious patterns.

Compensating Controls: If immediate patching is not feasible, consider the following compensating controls:

• Deploy a WAF with rulesets specifically designed to detect and block LFI and path traversal attacks.
• Temporarily disable the vulnerable Premmerce plugin until a patch can be applied and tested.
• Harden the web server's file permissions to ensure the web server process has read access only to the files it absolutely requires.
• Review and harden the PHP configuration (e.g., open_basedir) to restrict the locations from which PHP can access files.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 6, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, LFI vulnerabilities in popular WordPress plugins are frequently and rapidly weaponized by threat actors once a proof-of-concept becomes available. Organizations should assume that exploitation is imminent.

Analyst Recommendation

Given the high severity (CVSS 7.5) of this vulnerability and its potential for exposing critical server data, we strongly recommend that organizations apply the vendor-supplied patches as an immediate priority. Although this CVE is not currently listed on the CISA KEV (Known Exploited Vulnerabilities) catalog, its impact on widely-used WooCommerce environments makes it a significant risk. A proactive patching and monitoring stance is essential to prevent a potential compromise.

Executive Summary:
A high-severity vulnerability has been identified in the Hinnerk Altenburg Immocaster WordPress plugin, which could allow an unauthenticated attacker to read sensitive files from the underlying server. Successful exploitation could lead to the exposure of confidential data, such as website configuration details and database credentials, potentially enabling further system compromise. Organizations using the affected plugin are urged to apply the recommended updates immediately to mitigate this risk.

Vulnerability Details

CVE-ID: CVE-2025-60190

Affected Software: Hinnerk Altenburg Immocaster WordPress Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Local File Inclusion (LFI) flaw within the Immocaster plugin. It arises from the improper sanitization of user-supplied input that is used to construct a file path for a PHP include or require statement. An attacker can exploit this by crafting a malicious request that manipulates the input to traverse the file system and specify an arbitrary file on the server. The server would then process and potentially display the contents of the requested file, such as wp-config.php (containing database credentials) or system files like /etc/passwd.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.1. Exploitation can lead to significant business impact, including the breach of sensitive data and intellectual property. An attacker could leverage the exposed information, particularly database credentials, to gain unauthorized access to the website's database, steal customer information, or deface the website. Such an incident could result in severe reputational damage, loss of customer trust, and potential regulatory fines for data breaches.

Remediation Plan

Immediate Action: The primary remediation is to update the affected "Immocaster" WordPress plugin to the latest patched version provided by the vendor. If the plugin is not critical to business operations, a secondary option is to disable and remove it entirely from the WordPress installation to eliminate the attack surface.

Proactive Monitoring: Monitor web server access logs for suspicious requests targeting the Immocaster plugin. Look for patterns indicative of LFI attacks, such as directory traversal sequences (../, ..\/) and requests for common sensitive files (wp-config.php, /etc/passwd, .env) within URL parameters. Use a file integrity monitoring (FIM) system to alert on unauthorized access to or changes in critical configuration files.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block LFI and directory traversal attack patterns. Additionally, ensure PHP is configured securely by hardening the php.ini file (e.g., disabling allow_url_include) and enforce strict file system permissions to limit the files the web server process is authorized to read.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 6, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, Local File Inclusion vulnerabilities in popular CMS plugins are highly sought after by threat actors and are often quickly weaponized. Automated scanning for this flaw is expected to begin once a proof-of-concept exploit is made public.

Analyst Recommendation

Given the high severity score (CVSS 8.1) and the critical nature of the data that can be exposed, we strongly recommend that organizations identify all instances of the Immocaster WordPress plugin and apply the vendor-supplied patch immediately. While this vulnerability is not currently on the CISA KEV list, its potential for data exfiltration presents a significant risk. Prioritize this patch to prevent potential data breaches and subsequent system compromise.

---METADATA---
VENDOR: CRM Perks
PRODUCT: WP Gravity Forms Salesforce
AFFECTED_VERSIONS: n/a through 1.5.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The CRM Perks WP Gravity Forms Salesforce plugin is susceptible to deserialization of untrusted data, which can lead to arbitrary object injection.

Executive Summary:
A critical object injection vulnerability in the WP Gravity Forms Salesforce plugin enables remote code execution or unauthorized system access via deserialization of untrusted data.

Vulnerability Details

CVE-ID: CVE-2025-60180

Affected Software: CRM Perks WP Gravity Forms Salesforce

Affected Versions: n/a through 1.5.1

Vulnerability: The plugin fails to safely handle deserialization of user-supplied data. This allows an attacker to inject malicious objects into the application, which can be leveraged for further exploitation.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to the integrity and availability of the WordPress site. Successful exploitation could lead to full system compromise, allowing attackers to execute arbitrary code and gain access to sensitive Salesforce integration data.

Remediation Plan

Immediate Action: Update the WP Gravity Forms Salesforce plugin to the most recent version provided by CRM Perks to resolve the deserialization flaw.

Proactive Monitoring: Monitor server logs for unusual serialized data patterns or anomalous traffic originating from the plugin's endpoints.

Compensating Controls: Utilize a WAF to inspect incoming traffic for known deserialization attack payloads, providing a temporary layer of protection.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Dec 18, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of object injection vulnerabilities, organizations must treat this update with the highest urgency. Ensure the plugin is patched immediately to prevent remote exploitation of the WordPress environment.

---METADATA---
VENDOR: CRM Perks
PRODUCT: WP Gravity Forms HubSpot
AFFECTED_VERSIONS: n/a through 1.2.6
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The CRM Perks WP Gravity Forms HubSpot plugin contains a deserialization vulnerability that permits the injection of malicious objects.

Executive Summary:
A critical object injection flaw in the WP Gravity Forms HubSpot plugin creates a high risk of remote code execution and unauthorized data access due to unsafe deserialization.

Vulnerability Details

CVE-ID: CVE-2025-60178

Affected Software: CRM Perks WP Gravity Forms HubSpot

Affected Versions: n/a through 1.2.6

Vulnerability: The vulnerability involves the unsafe deserialization of untrusted input within the plugin. An attacker can use this flaw to inject arbitrary objects, potentially leading to critical impacts on the host system.

Business Impact

The CVSS score of 9.8 reflects the high severity of this vulnerability, which could result in complete compromise of the WordPress site. Impacted businesses face significant risks, including unauthorized access to HubSpot CRM data and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update the WP Gravity Forms HubSpot plugin to the latest version released by CRM Perks to mitigate the object injection risk.

Proactive Monitoring: Audit application logs for suspicious activity and monitor for unexpected changes in system configuration or database entries.

Compensating Controls: Implement a WAF to filter malicious payloads and block unauthorized access attempts specifically targeting the plugin's data processing functions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Dec 18, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate remediation is required to secure the application against this critical vulnerability. Administrators should verify that the patch is applied and perform a security review of the environment following the update.

Executive Summary:
A critical vulnerability has been identified in the WP Gravity Forms Constant Contact Plugin for WordPress, which could allow an unauthenticated attacker to take complete control of an affected website. The flaw, a result of deserializing untrusted data, can be exploited to execute arbitrary code, leading to potential data theft, website defacement, or further network compromise. Immediate patching is required to mitigate this high-risk threat.

Vulnerability Details

CVE-ID: CVE-2025-60174

Affected Software: CRM Perks WP Gravity Forms Constant Contact Plugin (gf-constant-contact)

Affected Versions: All versions up to and including 1.1.2

Vulnerability: The vulnerability is an Insecure Deserialization flaw. The plugin improperly handles serialized data submitted by a user. An attacker can craft a malicious serialized object and send it to the application; when the plugin deserializes this data, it can trigger a "property-oriented programming" (POP) chain, leading to the execution of arbitrary code on the underlying web server with the privileges of the web service account. This type of attack typically does not require authentication.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Successful exploitation could lead to a complete compromise of the web server hosting the WordPress site. The potential consequences include theft of sensitive data submitted through forms (such as PII and customer information), unauthorized modification or deletion of website content, and using the compromised server as a launch point for further attacks against the internal network. This poses a severe risk to data confidentiality, integrity, and availability, potentially resulting in significant financial loss, reputational damage, and regulatory penalties.

Remediation Plan

Immediate Action: Immediately update the WP Gravity Forms Constant Contact Plugin to the latest version available (a version greater than 1.1.2). After patching, monitor for any signs of exploitation attempts by reviewing web server access logs and application logs for unusual requests or errors.

Proactive Monitoring: Security teams should monitor for POST requests containing serialized PHP objects (e.g., patterns like O:4:"...) in web server access logs. Monitor for unexpected process execution by the web server's user account (e.g., www-data, apache) and any unusual outbound network connections from the web server, which could indicate a successful compromise.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block PHP object injection and deserialization attacks. Restrict access to the plugin's functionality if possible, and ensure the web server process is running with the lowest possible privileges to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of December 18, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the critical severity and the common nature of deserialization vulnerabilities, it is highly probable that proof-of-concept exploits will be developed and released by security researchers or malicious actors in the near future.

Analyst Recommendation

Given the critical CVSS score of 9.8, this vulnerability represents a significant and immediate threat to the organization. We strongly recommend that all WordPress sites using the affected plugin be patched immediately, without delay. Although this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its severity dictates that it should be treated with the highest priority, as it is a prime target for opportunistic and targeted attacks. Organizations should assume active exploitation is imminent and act accordingly.

Executive Summary:
A critical Cross-Site Request Forgery (CSRF) vulnerability has been identified in the AR For WordPress plugin. This flaw allows an unauthenticated attacker to trick an administrator into unknowingly uploading a malicious file, known as a web shell, which can lead to a complete compromise of the web server, data theft, and further network intrusion.

Vulnerability Details

CVE-ID: CVE-2025-60156

Affected Software: AR For WordPress

Affected Versions: All versions through 7.98

Vulnerability: The vulnerability exists because the AR For WordPress plugin fails to implement adequate CSRF protection on its file upload functionality. An attacker can craft a malicious webpage or link that, when visited by an authenticated administrator, forces the administrator's browser to send a hidden request to the vulnerable WordPress site. Because the request is sent from the administrator's authenticated session, the plugin accepts the request and uploads a file provided by the attacker, typically a web shell. This allows the attacker to gain Remote Code Execution (RCE) capabilities on the server, granting them full control over the website and its underlying system.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.6. Successful exploitation would grant an attacker complete control over the affected web server. This could lead to severe business consequences, including the theft of sensitive company and customer data, website defacement, service disruption, and significant reputational damage. The compromised server could also be used as a pivot point to launch further attacks against the internal network or be leveraged in wider malicious campaigns, such as hosting malware or participating in botnets, creating legal and financial liabilities for the organization.

Remediation Plan

Immediate Action: Immediately update the "AR For WordPress" plugin to the latest version available from the vendor (a version higher than 7.98). After patching, thoroughly review web server logs for any signs of compromise, such as unexpected file uploads or suspicious POST requests to plugin endpoints.

Proactive Monitoring: Implement continuous monitoring of web server access and error logs, specifically looking for unusual file upload requests (e.g., .php, .jsp, .aspx files) directed at the plugin's directories. Utilize a File Integrity Monitoring (FIM) solution to alert on the creation of any unauthorized files within the web root. Monitor for unusual outbound network traffic from the web server, which could indicate a web shell communicating with an attacker's command-and-control server.

Compensating Controls: If immediate patching is not feasible, consider the following controls:

• Disable the "AR For WordPress" plugin until it can be safely updated.
• Implement a Web Application Firewall (WAF) with rules designed to detect and block CSRF attacks and malicious file uploads.
• Restrict administrative access to the WordPress dashboard to trusted IP addresses only.
• Enforce the principle of least privilege by ensuring the web server process has minimal write permissions on the file system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 26, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, given the critical CVSS score of 9.6 and the straightforward nature of the attack, it is highly probable that threat actors will develop and deploy exploits in the near future. The source data contains a discrepancy between the product name ("AR For WordPress" in the description) and the general "Multiple Products" field; this analysis focuses on the specific plugin identified.

Analyst Recommendation

This is a critical vulnerability that enables a full server compromise. Organizations using the "AR For WordPress" plugin on versions 7.98 and below must treat this as a high-priority incident. We strongly recommend applying the vendor-supplied patch immediately to all affected systems. Although this vulnerability is not currently listed on the CISA KEV catalog, its severity warrants urgent action. If patching is delayed, immediately implement the compensating controls listed above, starting with disabling the plugin, to reduce the risk of exploitation.

Executive Summary:
A high-severity vulnerability has been identified in multiple wpshuffle Subscribe products, which could allow an attacker to access sensitive files on the server. This flaw, known as Local File Inclusion, could be exploited to read confidential data, such as configuration files containing database credentials, or to execute malicious code. Successful exploitation could lead to a full compromise of the affected web server, resulting in data breaches and operational disruption.

Vulnerability Details

CVE-ID: CVE-2025-60153

Affected Software: wpshuffle Subscribe Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is an Improper Control of a Filename for an Include/Require Statement in PHP, commonly known as Local File Inclusion (LFI). An attacker can manipulate an input parameter that the application uses to build a file path for a PHP include or require statement. By crafting a malicious input (e.g., using directory traversal sequences like ../../..), an attacker can force the application to include and execute arbitrary PHP files already present on the server or read the contents of any file readable by the web server process, such as /etc/passwd or wp-config.php.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation can lead to significant business consequences, including the unauthorized disclosure of sensitive information such as customer data, intellectual property, and system credentials. An attacker could leverage this access to gain full control of the web server, deface the website, install malware, or use the compromised server as a pivot point for further attacks into the corporate network. The potential outcomes include severe reputational damage, financial loss from remediation efforts, and possible regulatory penalties.

Remediation Plan

Immediate Action: Apply vendor-supplied security updates to all affected products immediately to patch the vulnerability. Following the update, closely monitor systems for any signs of exploitation attempts by reviewing web server and application access logs for suspicious requests.

Proactive Monitoring: Security teams should actively monitor web server logs for patterns indicative of LFI attacks. This includes searching for requests containing directory traversal sequences (../), references to sensitive system files (e.g., wp-config.php, /etc/passwd), and PHP wrappers like php://filter. Monitor for unexpected file modifications or the creation of new files in web-accessible directories.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block LFI attack patterns. Additionally, harden the server's PHP configuration by disabling allow_url_include and enforcing strict file permissions to limit the web server process's access to only necessary files and directories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 26, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, LFI vulnerabilities are well understood and relatively easy to exploit, so it is highly likely that threat actors will develop exploits in the near future. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the high severity (CVSS 7.5) of this vulnerability and the potential for complete server compromise, it is strongly recommended that the organization prioritizes the immediate application of vendor-supplied security patches across all affected systems. Although this CVE is not yet on the CISA KEV list, its critical nature warrants urgent attention. Organizations should treat this as a critical threat and act swiftly to mitigate the risk of a potential data breach or system compromise.

Executive Summary:
A high-severity vulnerability has been identified in multiple wpshuffle Subscribe products, which could allow an unauthenticated attacker to read sensitive files on the web server. Successful exploitation could lead to the exposure of confidential data, such as system configurations and user credentials, providing a foothold for further attacks. Organizations are urged to apply the vendor-supplied security patches immediately to mitigate this risk.

Vulnerability Details

CVE-ID: CVE-2025-60150

Affected Software: wpshuffle Subscribe Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Local File Inclusion (LFI) flaw, categorized as an Improper Control of Filename for an Include/Require Statement. The application fails to properly sanitize user-supplied input that is used to construct a file path. An attacker can manipulate this input to include and display the contents of arbitrary files from the server's local file system, such as /etc/passwd or application configuration files containing database credentials.

Business Impact

This is a high-severity vulnerability with a CVSS score of 7.5. Exploitation can lead to significant business impact, including the unauthorized disclosure of sensitive information, such as intellectual property, customer data, and system credentials. This data breach could result in regulatory fines, reputational damage, and a loss of customer trust. Furthermore, the information obtained through this vulnerability could be used by an attacker to facilitate lateral movement and escalate their privileges within the corporate network.

Remediation Plan

Immediate Action: Apply vendor security updates immediately across all affected instances of wpshuffle Subscribe products. After patching, it is crucial to monitor for any ongoing or past exploitation attempts by thoroughly reviewing web server and application access logs for indicators of compromise.

Proactive Monitoring: Security teams should actively monitor for signs of LFI attacks. In web server logs, look for suspicious requests containing directory traversal sequences (../), absolute file paths (e.g., /etc/passwd), and PHP filter wrappers (php://filter). Monitor for unexpected file access patterns or outbound network connections from the affected servers.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules designed to detect and block LFI and directory traversal attack patterns. Additionally, harden the server's file system permissions to restrict the web server process from accessing sensitive files and directories outside of the web root.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 26, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, Local File Inclusion is a well-understood vulnerability class, and proof-of-concept exploits are often developed quickly by security researchers and threat actors following public disclosure.

Analyst Recommendation

Due to the high severity (CVSS 7.5) and the critical nature of Local File Inclusion vulnerabilities, which can lead to sensitive data exposure and further system compromise, immediate action is required. It is strongly recommended that organizations prioritize identifying all affected "wpshuffle Subscribe" products within their environment and apply the vendor-provided security updates without delay. While this vulnerability is not currently listed on the CISA KEV catalog, its high-impact potential warrants immediate attention to prevent potential exploitation.

Executive Summary:
A high-severity vulnerability has been identified in multiple PluginOps Testimonial products, allowing for Local File Inclusion (LFI). An unauthenticated attacker could exploit this flaw to read sensitive files on the web server, such as configuration files containing credentials or system user information. This exposure of confidential data can lead to further, more severe attacks against the organization's infrastructure.

Vulnerability Details

CVE-ID: CVE-2025-60126

Affected Software: PluginOps Testimonial Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists due to an improper control of filenames used in PHP's include or require statements within the Testimonial Slider plugin. An attacker can manipulate an input parameter, likely a URL parameter, to include directory traversal sequences (e.g., ../). This forces the application to read and display the contents of arbitrary files from the server's local filesystem, to which the web server process has access. Successful exploitation could allow an attacker to view sensitive files like wp-config.php, /etc/passwd, or other application source code and configuration files.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. Exploitation could lead to a significant data breach by exposing sensitive information, including database credentials, API keys, internal server paths, and other configuration details. This information could be leveraged by attackers to escalate privileges, gain unauthorized access to databases, or launch further attacks to achieve a full system compromise. The potential business impact includes reputational damage, financial loss from remediation efforts, and regulatory fines for non-compliance with data protection standards.

Remediation Plan

Immediate Action: Organizations must immediately apply the security patches released by the vendor to all affected systems. After patching, it is crucial to review web server and application access logs for any signs of past or ongoing exploitation attempts targeting this vulnerability.

Proactive Monitoring: Security teams should monitor web server access logs for requests containing directory traversal patterns (e.g., ../, ..%2f) in URL parameters associated with the affected plugin. Monitor for anomalous read access to sensitive system files (e.g., wp-config.php, /etc/passwd, /etc/shadow) by the web server process. Network monitoring should be in place to detect any unusual outbound data transfers that could indicate data exfiltration.

Compensating Controls: If immediate patching is not feasible, deploy a Web Application Firewall (WAF) with rules specifically designed to block Local File Inclusion and directory traversal attack patterns. Additionally, harden the server environment by enforcing strict file permissions to limit the web server's access to critical files and configure PHP's open_basedir directive to restrict the locations from which PHP can access files.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 26, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, LFI vulnerabilities are well-understood and relatively easy to exploit, so it is highly probable that threat actors will develop exploits in the near future. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the high CVSS score of 8.8 and the critical risk of data exposure, this vulnerability requires immediate attention. We strongly recommend all organizations using the affected PluginOps products to apply the vendor-supplied security updates as their highest priority. Although not yet listed in the CISA KEV catalog, the severity and simplicity of exploitation make it a prime target for opportunistic attackers. Proactive patching is the most effective defense against potential compromise.

Executive Summary:
A high-severity SQL Injection vulnerability has been identified in the Potenzaglobalsolutions PGS Core product. This flaw could allow a remote, unauthenticated attacker to manipulate the application's database, potentially leading to the theft of sensitive data, unauthorized modification of information, or a complete compromise of the underlying system.

Vulnerability Details

CVE-ID: CVE-2025-60118

Affected Software: Potenzaglobalsolutions PGS Core

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists due to the application's failure to properly sanitize user-supplied input before it is used in an SQL query. An attacker can exploit this by crafting a malicious input string containing special SQL commands. When the application processes this input, the malicious commands are executed by the database, allowing the attacker to bypass security controls and interact directly with the database to read, modify, or delete data, and in some cases, execute commands on the operating system.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.5. Successful exploitation could have severe consequences for the organization, including a significant data breach involving customer information, financial records, or intellectual property. The direct risks include loss of data confidentiality, integrity, and availability. Broader business impacts could involve reputational damage, loss of customer trust, operational disruptions, and potential regulatory fines for non-compliance with data protection standards.

Remediation Plan

Immediate Action: The primary remediation is to apply the security patches provided by Potenzaglobalsolutions immediately across all affected systems. Concurrently, review the database user permissions associated with the application and enforce the principle of least privilege to limit the impact of a potential compromise. It is also recommended to enable detailed database query logging to assist in detecting and investigating potential exploitation attempts.

Proactive Monitoring: Implement monitoring of application and database logs for signs of SQL injection attacks. Look for unusual or malformed SQL queries, such as those containing UNION, SELECT, --, or other SQL syntax in user input fields. A Web Application Firewall (WAF) can also be configured to monitor traffic for common SQL injection patterns and block malicious requests.

Compensating Controls: If immediate patching is not feasible, deploy a Web Application Firewall (WAF) with a strict ruleset designed to detect and block SQL injection attempts. Implementing stringent input validation on the web server or application layer can also serve as a temporary mitigation. Access to the vulnerable application should be restricted to trusted IP addresses and users wherever possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 26, 2025, there are no known public exploits or active attacks targeting this vulnerability. However, SQL injection is a well-understood vulnerability class, and threat actors frequently reverse-engineer patches to develop exploits shortly after a vulnerability is disclosed. The CISA KEV status is "No", indicating it is not currently known to be actively exploited in the wild.

Analyst Recommendation

Given the high CVSS score of 8.5 and the critical impact of a successful SQL injection attack, we strongly recommend that organizations prioritize the immediate application of vendor-supplied patches. If patching is delayed, the compensating controls outlined above, particularly the use of a WAF, should be implemented without delay. Although this vulnerability is not yet on the CISA KEV list, its severity makes it a highly attractive target for attackers, and organizations should act decisively to mitigate this risk.

Executive Summary:
A high-severity Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple javothemes Javo Core products. This flaw could allow a remote attacker to trick an authenticated user, such as an administrator, into performing actions they did not intend, ultimately leading to an authentication bypass and potential full system compromise. Organizations using the affected software are at significant risk of unauthorized access and data breaches.

Vulnerability Details

CVE-ID: CVE-2025-60111

Affected Software: javothemes Javo Core Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Cross-Site Request Forgery (CSRF). The application fails to implement or properly validate anti-CSRF tokens for sensitive state-changing requests. An attacker can exploit this by crafting a malicious webpage, link, or script and tricking a logged-in user with administrative privileges into accessing it. When the victim's browser makes a request to the vulnerable application, it automatically includes their session cookies, causing the application to process the attacker's forged request as a legitimate action from the authenticated user. This could be used to perform actions like creating a new administrative account or changing a password, effectively allowing the attacker to bypass authentication controls and gain privileged access.

Business Impact

This is a High severity vulnerability with a CVSS score of 8.8. Successful exploitation could lead to a complete compromise of the web application and its underlying server. The potential business impact includes unauthorized access to sensitive company or customer data, website defacement, installation of malicious backdoors for persistent access, and reputational damage. An attacker with administrative control could disrupt business operations, steal confidential information leading to regulatory penalties, or use the compromised system as a launch point for further attacks into the corporate network.

Remediation Plan

Immediate Action: Apply vendor-supplied security updates to all affected javothemes Javo Core products immediately to patch the vulnerability. After patching, it is crucial to monitor for any signs of exploitation and thoroughly review access logs for suspicious administrative activity that may have occurred before the patch was applied.

Proactive Monitoring: Security teams should monitor web server access logs for unusual or unexpected administrative actions, such as the creation of new user accounts from unknown IP addresses, password resets for privileged accounts, or plugin/theme modifications. Monitor for requests to administrative endpoints that have unusual referrers, which could indicate a cross-site attack.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules designed to detect and block CSRF attacks. Enforcing a strict SameSite cookie attribute can also help mitigate the risk by preventing the browser from sending session cookies with cross-site requests. Additionally, enforcing re-authentication for critical administrative functions can reduce the window of opportunity for an attacker.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 26, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the high severity and relative simplicity of exploiting CSRF flaws, it is highly probable that threat actors will reverse-engineer the vendor patch to develop a functional exploit.

Analyst Recommendation

Given the High severity (CVSS 8.8) of this vulnerability and its potential to allow a complete system compromise, immediate patching of all affected systems is the highest priority and should be treated as an emergency change. Although this vulnerability is not currently on the CISA KEV (Known Exploited Vulnerabilities) list, its significant impact warrants urgent attention. We strongly recommend that organizations apply the vendor patch immediately and then conduct a thorough review of all administrative accounts and system logs to identify any evidence of compromise prior to the patch deployment.

Executive Summary:
A critical vulnerability has been identified in the WP Gravity Forms Zoho CRM and Bigin plugin for WordPress, rated 9.8 out of 10. This flaw allows an unauthenticated attacker to inject malicious code and execute it on the server, potentially leading to a complete takeover of the affected website. Successful exploitation could result in data theft, website defacement, and further compromise of the underlying infrastructure.

Vulnerability Details

CVE-ID: CVE-2025-60091

Affected Software: WP Gravity Forms Zoho CRM and Bigin plugin by CRM Perks

Affected Versions: All versions up to and including 1.2.9

Vulnerability:
The vulnerability is an insecure deserialization of untrusted data, which leads to a PHP Object Injection. The plugin improperly handles user-supplied data when deserializing it, failing to validate the input before processing. An unauthenticated attacker can craft a malicious serialized PHP object (a "gadget chain") and send it to the vulnerable application endpoint. When the plugin deserializes this payload, it can trigger a series of method calls on existing classes within the application's scope, ultimately resulting in arbitrary code execution on the server with the privileges of the web server process.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, reflecting the high potential for severe business disruption. A successful exploit could grant an attacker complete control over the affected website, leading to the compromise of confidentiality, integrity, and availability. Potential consequences include theft of sensitive customer data from forms and the integrated CRM, unauthorized modification of the website, deployment of malware or ransomware, and using the compromised server as a pivot point to attack other systems on the network. Such an incident could lead to significant financial loss, reputational damage, and regulatory penalties.

Remediation Plan

Immediate Action:
Immediately update the WP Gravity Forms Zoho CRM and Bigin plugin to the latest version available (greater than 1.2.9) to patch the vulnerability. After patching, it is crucial to monitor for any signs of post-compromise activity by reviewing web server access logs, application logs, and system integrity for any unauthorized changes or suspicious connections.

Proactive Monitoring:
Implement enhanced monitoring to detect exploitation attempts. Look for unusual POST requests in web server logs, particularly those containing long, encoded strings (e.g., Base64) which may represent serialized PHP objects. Monitor application error logs for exceptions related to deserialization. System-level monitoring should alert on the creation of unexpected files in web-accessible directories, new outbound network connections from the web server, and unexpected process execution.

Compensating Controls:
If immediate patching is not feasible, implement the following compensating controls:

• Deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block PHP object injection and deserialization attacks.
• If the plugin's functionality is not essential, disable and uninstall it until a patch can be applied safely.
• Restrict network access to the website and any administrative interfaces to only trusted IP addresses.

Exploitation Status

Public Exploit Available: False

Analyst Notes:
As of the publication date, December 18, 2025, there is no known public proof-of-concept exploit code or active exploitation of this vulnerability in the wild. However, vulnerabilities of this type and severity are frequently targeted by threat actors. Due to the straightforward nature of many deserialization flaws, it is highly probable that a functional exploit will be developed and released publicly in the near future.

Analyst Recommendation

Given the critical CVSS score of 9.8 and the potential for complete system compromise, this vulnerability poses a severe and immediate risk to the organization. Although CVE-2025-60091 is not currently listed on the CISA KEV catalog, its high impact makes it a prime candidate for future inclusion and an attractive target for attackers. We strongly recommend that organizations identify all instances of the vulnerable plugin and apply the vendor-supplied patch immediately as a top priority.