NVD disclosure day
CVE-2025-6439
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in a WordPress plugin that could allow unauthenticated attackers to delete arbitrary files on the server. This could lead to data loss or site unavailability. Confirm if the affected plugin is in use.
CVE-2025-6553
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
The Ovatheme Events Manager WordPress plugin has a critical vulnerability allowing unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution. This issue is relevant to public-facing websites that use the plugin for event management and checkout processes.
CVE-2025-11533
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability exists in the WP Freeio WordPress plugin, allowing unauthenticated attackers to gain administrator access by exploiting the user registration process. This could lead to a full compromise of the website.