Skip to content
OpenAdvisories

Vendor

akirk

3 known vulnerabilities.

Products

Friends 3
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2025-7504

    Friends 3.5.1 - Authenticated (Subscriber+) PHP Object Injection

    The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deserialization of untrusted input of the query_vars parameter This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a …

    akirk Friends Web / CMS