CVE-2025-7663

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

The Ovatheme Events Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /class-ovaem-ajax.php file in all versions up to, and including, 1.8.6. This makes it possible for unauthenticated attackers to delete ticket files, download tickets, and more.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Nov 8, 2025
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-76647.5The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() p CVE-2025-76658.1The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check o CVE-2025-76678.1The Restrict File Access plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This CVE-2025-76686.1The Linux Promotional Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. Thi CVE-2025-76696.1The Avishi WP PayPal Payment Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2 CVE-2025-76707.5The JS Archive List plugin for WordPress is vulnerable to time-based SQL Injection via the build_sql_where() function in all versions up to,CVE-2025-76724.3The improper default setting in JiranSoft CrossEditor4 on Windows, Linux, Unix (API modules) potentaily allows Stored XSS. This issue affect CVE-2025-76739.8A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0 CVE-2025-76747.1Improper Input Validation vulnerability in Roche Diagnostics navify Monitoring allows an attacker to manipulate input data, which may lead t CVE-2025-76757.8A maliciously crafted 3DM file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious a CVE-2025-76765.4DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attack CVE-2025-76775.9A denial-of-service (DoS) attack is possible if access to the local network is provided to unauthorized users. This is due to a buffer copy