8.6Hoch

CVE-2025-22663WordPress Paid Videochat Turnkey Site plugin <= 7.2.12 - Arbitrary File Deletion vulnerability

videowhisper Paid Videochat Turnkey Site Veröffentlicht: 2025-02-18 22:54 (vor 1 Jahr)

Beschreibung

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Path Traversal.This issue affects Paid Videochat Turnkey Site: from n/a through <= 7.2.12.

Schwachstellentyp (CWE): CWE-22

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
videowhisper	Paid Videochat Turnkey Site	≤ 7.2.12

Referenzen und Patches

https://patchstack.com/database/Wordpress/Plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turn… vdb-entry

CVSS-Score

8.6Hoch

Quelle: Patchstack · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Geändert
Vertraulichkeit: Keine
Integrität: Keine
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Alle Scores (2)

cna	CVSS 3.1	8.6Hoch
audit@patchstack.com	CVSS 3.1	8.6Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.55%

höher als 47 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: yes
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2025-01-07
Veröffentlicht2025-02-18 22:54
Bei IP-DB eingegangen2026-10-25 00:01
Zuletzt aktualisiert2026-06-17 11:49

Vergeben von (CNA): Patchstack
NVD-Status: Deferred

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — WordPress plugins & themes

7.1Hoch

CVE-2026-124969 vor 1 Stunde

Optimole <= 4.2.19 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via 'comment_content'/'comment_agent' Parameter during Attachment Rename

optimole Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the replace_urls_in_value function in all versions up to, and…

9.8Kritisch

CVE-2026-126173 vor 1 Stunde

AutomatorWP Pro Webhooks addon <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field

AutomatorWP AutomatorWP Webhooks

The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible …

7.1Hoch

CVE-2026-119517 vor 15 Stunden

WordPress Catna – Woo Name Your Price and Offers plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

VillaTheme Catna – Woo Name Your Price and Offers

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Catna – Woo Name Your Price and Offers catna-woo-name-your-price-and-offers allows Reflected XSS.This issue affects Catna – Woo Name Your Price an…

9.3Kritisch

CVE-2026-124415 vor 15 Stunden

WordPress Alex Reservations plugin <= 2.4.8 - SQL Injection vulnerability

Alejandro Alex Reservations

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.

5.3Mittel

CVE-2026-125432 vor 15 Stunden

WordPress reCAPTCHA for WooCommerce plugin <= 1.4.7 - Broken Authentication vulnerability

RelyWP reCAPTCHA for WooCommerce

Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7.

8.5Hoch

CVE-2026-124265 vor 15 Stunden

WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

Tribulant Software Newsletters

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows Blind SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.