NVD disclosure day
CVE-2025-12140
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An application's insecure 'redirectToUrl' mechanism, which improperly handles the 'redirectUrlParameter', allows unauthenticated attackers to execute arbitrary code by interpreting input as Java expressions. This critical vulnerability, accessible over the network, could lead to system compromise if the application is
CVE-2025-13675
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The Tiger theme for WordPress contains a privilege escalation vulnerability due to improper handling of user roles during registration. This flaw allows unauthenticated attackers to assign themselves administrator privileges, potentially leading to full control of a website.
CVE-2025-13540
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated attacker can exploit the Tiare Membership WordPress plugin to gain administrator access. This vulnerability, stemming from improper role validation during user registration, allows attackers to assign themselves the administrator role. This could lead to unauthorized control and content modification
CVE-2025-13539
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical authentication bypass vulnerability in the FindAll Membership WordPress plugin allows unauthenticated attackers to log in as administrators. This could lead to unauthorized access to administrative accounts and associated email. The plugin's improper handling of user verification data is the root cause. Rele
CVE-2025-13538
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical flaw in the FindAll Listing WordPress plugin, when paired with the FindAll Membership plugin and user registration enabled, permits unauthenticated attackers to escalate privileges to administrator access. This allows potential manipulation of site content and sensitive settings.