CVE-2025-13820

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jan 1, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-138215.7Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allow CVE-2025-138225.3MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allow CVE-2025-138237.1A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers when the controllers received multiple malformed packe CVE-2025-138248.7A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red CVE-2025-138268.2Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is cause CVE-2025-138278.8Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ImpactIf t CVE-2025-138289.0SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in upda CVE-2025-138298.6Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any CVE-2025-13834.3The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2. CVE-2025-138356.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arco CVE-2025-138367.5When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows CVE-2025-138375.5When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and D