Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This is due to missing validation and sanitization in the 'createManageFeedPage' function. This makes it possible for authenticated administrator-level attackers to delete arbitrary files on the server via specially crafted requests that include path traversal sequences, granted they can trick an admin into clicking a malicious link.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE Alert: CVE-2025-14037 - invelity - Invelity Product Feeds - https://www.redpacketsecurity.com/cve-alert-cve-2025-14037-invelity-invelity-product-feeds/ #OSINT #ThreatIntel #CyberSecurity #cve-2025-14037 #invelity #invelity-product-feeds
Post summary
The tweet merely alerts to CVE‑2025‑14037 for Invelity Product Feeds, providing no further technical or exploitation details.
🟠 CVE-2025-14037 - High The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This is due to missing validation and ... https://www.thehackerwire.com/vulnerability/CVE-2025-14037/ https://t.co/CfriJvA78p
Post summary
The Invelity Product Feeds plugin for WordPress contains a path‑traversal flaw that allows arbitrary file deletion in all versions up to 1.2.6.
CVE-2025-14037 The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This is due t… https://www.cve.org/CVERecord?id=CVE-2025-14037
Post summary
The text discloses a path‑traversal flaw enabling arbitrary file deletion in the Invelity Product Feeds WordPress plugin, with no mention of PoC, exploit code, active attacks, or patch.