Vulnerabilities

TI-2025-12826 CVE-2025-14037 · GHSA-f926-gc7c-947h

Invelity Products Feeds <= 1.2.6 - Cross-Site Request Forgery to Arbitrary File Deletion

LOW 34

The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6.

CVSS 3.1HIGH 8.1 Network High privileges User interaction EPSS 0.0018 Published 2026-03-21 No fix listed CWE-352

TI-2025-42335 CVE-2025-68876 · GHSA-h9cp-8vj7-rfrc

WordPress Invelity SPS connect plugin <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INVELITY Invelity SPS connect invelity-sps-connect allows Reflected XSS.This issue affects Invelity SPS connect: from…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00178 Published 2025-12-29 No fix listed CWE-79

TI-2025-36486 CVE-2025-58833 · GHSA-9gj5-r4fm-hqhv

WordPress Invelity MyGLS connect Plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability

LOW 37

Cross-Site Request Forgery (CSRF) vulnerability in INVELITY Invelity MyGLS connect invelity-mygls-connect allows Object Injection.This issue affects Invelity MyGLS connect: from n/a through <= 1.1.1.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0017 Published 2025-09-05 No fix listed CWE-352

Vulnerabilities

Filters

Invelity Products Feeds <= 1.2.6 - Cross-Site Request Forgery to Arbitrary File Deletion

WordPress Invelity SPS connect plugin <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerability

WordPress Invelity MyGLS connect Plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability