CVE-2025-1725

CVE-2025-1725 concerns the WordPress Bit File Manager plugin, vulnerable to a Stored Cross-Site Scripting (XSS) via SVG uploads in all versions up to and including 6.7. The root cause is insufficient input sanitization and output escaping during SVG file handling. Exploitation requires authentica...

CVE-2025-0366

The Jupiter X Core plugin for WordPress is vulnerable to Local File Inclusion to Remote Code Execution in all versions up to, and including, 4.8.7 via the getsvg function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary...