CVE-2025-14037

Name of the Vulnerable Software and Affected Versions Invelity Product Feeds plugin for WordPress versions up to and including 1.2.6

Description The Invelity Product Feeds plugin for WordPress is susceptible to arbitrary file deletion through a path traversal issue. This occurs because of inadequate validation and sanitization within the createManageFeedPage function. Authenticated administrators could be tricked into clicking malicious links containing path traversal sequences, allowing attackers to delete arbitrary files on the server.

Recommendations Update the Invelity Product Feeds plugin to a version later than 1.2.6.