Web Applications & E-Commerce
Canva Ortto WordPress Plugin 1.0.25 Fixes Three Flaws
Ortto WordPress plugin 1.0.25 fixes configuration overwrite, private product-data disclosure, and XSS. Update, inspect settings, and retain evidence.
CERT/CC Warns of Eleven Vulnerabilities in Thelia 2.6.0 and 2.6.1
CERT/CC VU#162329 documents eleven flaws in Thelia 2.6.0 and 2.6.1 without a patch. Restrict exposure, harden uploads, and retain evidence.
CISA Adds Strapi Sensitive-Data Exposure to KEV
Strapi issued CISA KEV: CVE-2023-22894 for Strapi. Match affected deployments, apply supported fixes, validate operations, and retain evidence.
CISA Adds WordPress Core Remote File Inclusion to KEV
CISA lists an exploited WordPress template-resolution flaw that can include local PHP files under specific theme and server conditions. Update the affected core branch, preserve suspicious files and logs, and conduct forensic triage.
WEBCON BPS Updates Fix Vacation-Data Authorization Bypass
WEBCON BPS can expose other employees' vacation schedules through an authenticated API authorization flaw. Install the branch-appropriate fix and validate cross-team access with synthetic accounts; a login should not authorize every employee's schedule.
Solspace Freeform 5.10.14 Blocks Twig Template Injection
Solspace Freeform 5.10.14 fixes limited Twig injection through public form input in certain response templates. Update through the Craft CMS workflow and test affected forms; the advisory does not demonstrate code execution or secret access.
WPGraphQL 2.22.2 Restores Post Capability Enforcement
WPGraphQL's updatePost mutation can let Contributors publish their own drafts or alter their published posts without required capabilities. Update to 2.22.2 and review post history; successful installation does not prove earlier changes were authorized.
REDAXO 5.21.2 Fixes CSRF and Stored XSS Flaws
REDAXO 5.21.2 fixes stored script injection in media-management paths and missing CSRF protection on addon updates. Back up the site, check addon compatibility, and review backend permissions; the flaws have different access and interaction requirements.
Plone Portlets Updates Fix Critical TALES Injection
Plone Classic portlet configuration can permit authenticated server-side code execution, including through ordinary users' dashboards. Apply the branch-specific package fix and review stored assignments; restricting new portlet creation alone does not neutralize existing malicious content.
Global IT Weoll Update Fixes SSRF Token Disclosure
Weoll releases before 3.2.45.44 have an SSRF issue identified with JWT disclosure. Apply the supported update and review outbound requests, while retaining the public evidence limit: the exact endpoint and token flow are undocumented.