Invelity vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Invelity products: 2 record(s), with severity, exploitation and fixes.

Invelity Product Feeds 1 Invelity SPS connect 1

Exploited only (KEV) →

CVE-2025-14037 High · 8.1 CWE-352 Mar 21, 2026

Invelity Products Feeds <= 1.2.6 - Cross-Site Request Forgery to Arbitrary File Deletion

The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This is due to missing validation and sanitization in the 'createManageFeedPage' function. This makes it possible for authenticated administrator-level attackers to delete arbitrary files on the server via specially crafted requests that include path traversal sequences, granted they can trick an admin into clicking a malicious link.

CVE-2025-68876 High · 7.1 CWE-79 Dec 29, 2025

WordPress Invelity SPS connect plugin <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INVELITY Invelity SPS connect invelity-sps-connect allows Reflected XSS.This issue affects Invelity SPS connect: from n/a through <= 1.0.8.