Mykiot Kiotviet Sync
4 CVEs affecting Mykiot Kiotviet Sync. Latest disclosed: 2025-11-05. Critical: 1, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12674 | Critical | 9.8 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the create_media() function in all versio… |
CVE-2025-12677 | Medium | 5.3 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the register_api_route()… |
CVE-2025-12676 | Medium | 5.3 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to authorizarion bypass in all versions up to, and including, 1.8.5. This is due to the plugin using a har… |
CVE-2025-12675 | Medium | 4.3 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveConfig() function in all… |