CVE-2025-13660

MediumCVSS 5.3/10Last modified Oct 7, 2026

Description

The Guest Support plugin for WordPress is vulnerable to User Email Disclosure in versions up to, and including, 1.2.3. This is due to the plugin exposing a public AJAX endpoint that allows anyone to search for and retrieve user email addresses without any authentication or capability checks. This makes it possible for unauthenticated attackers to enumerate user accounts and extract email addresses via the guest_support_handler=ajax endpoint with the request=get_users parameter.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Dec 12, 2025
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-136618.0Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outs CVE-2025-136627.8Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 CVE-2025-136636.7Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus target installation d CVE-2025-136646.7A potential security vulnerability in Quartus® Prime Standard Edition Design Software may allow escalation of privilege.CVE-2025-136656.7The System Console Utility for Windows is vulnerable to a DLL planting vulnerability CVE-2025-136665.3The Helloprint plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.2. This is due to the plugi CVE-2025-136676.4The WP Recipe Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Skill Level' input field in all versions up CVE-2025-136686.7A potential security vulnerability in Quartus® Prime Pro Edition Design Software may allow escalation of privilege.CVE-2025-136696.7Uncontrolled Search Path Element vulnerability in Altera High Level Synthesis Compiler on Windows allows Search Order Hijacking.This issue a CVE-2025-13675.3A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been classified as critical. This affects the function sprint CVE-2025-136706.7The High Level Synthesis Compiler i++ command for Windows is vulnerable to a DLL planting vulnerability CVE-2025-136716.5Cross-Site Request Forgery (CSRF) vulnerability in OpenText™ Web Site Management Server allows Cross Site Request Forgery. The vulnerability