Vulnerabilities

TI-2025-39126 CVE-2025-62978 · GHSA-8rmj-2xg2-c6p9

WordPress KiotViet Sync plugin <= 1.8.5 - Broken Access Control vulnerability

LOW 19

Missing Authorization vulnerability in Kiotviet KiotViet Sync kiotvietsync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiotViet Sync: from n/a through <= 1.8.5.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00188 Published 2025-10-27 No fix listed CWE-862

TI-2025-26123 CVE-2025-39381 · GHSA-m5jp-j4jf-fwmp

WordPress KiotViet Sync plugin <= 1.8.4 - CSRF to Stored XSS vulnerability

LOW 30

Cross-Site Request Forgery (CSRF) vulnerability in Kiotviet KiotViet Sync allows Stored XSS.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00152 Published 2025-04-24 No fix listed CWE-352

TI-2025-23638 CVE-2025-32573 · GHSA-rgfv-cmfv-jcmm

WordPress KiotViet Sync Plugin <= 1.8.3 - SQL Injection vulnerability

LOW 37

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kiotviet KiotViet Sync allows SQL Injection.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00433 Published 2025-04-17 No fix listed CWE-89

Vulnerabilities

Filters

WordPress KiotViet Sync plugin <= 1.8.5 - Broken Access Control vulnerability

WordPress KiotViet Sync plugin <= 1.8.4 - CSRF to Stored XSS vulnerability

WordPress KiotViet Sync Plugin <= 1.8.3 - SQL Injection vulnerability