# CVEs published 2025-01-16

299 CVEs were published on January 16, 2025: 21 critical, 137 high. Days are UTC.

- [CVE-2024-56144](https://cve.now/CVE-2024-56144.md): Stored XSS-LibreNMS-Display Name 2 in librenms (CVSS 4.6, librenms · librenms/librenms)
- [CVE-2025-23198](https://cve.now/CVE-2025-23198.md): Stored-XSS-LibreNMS-Display-Name in librenms (CVSS 4.6, librenms · librenms/librenms)
- [CVE-2025-23199](https://cve.now/CVE-2025-23199.md): Stored XSS-LibreNMS-Ports in librenms (CVSS 4.6, librenms · librenms/librenms)
- [CVE-2025-23200](https://cve.now/CVE-2025-23200.md): Stored XSS-LibreNMS-Misc Section in librenms (CVSS 4.6, librenms · librenms/librenms)
- [CVE-2025-23201](https://cve.now/CVE-2025-23201.md): Reflected Cross-site Scripting on error alert in librenms (CVSS 5.4, librenms · librenms/librenms)
- [CVE-2025-23907](https://cve.now/CVE-2025-23907.md): WordPress SOCIAL.NINJA plugin \<= 0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, closed SOCIAL.NINJA)
- [CVE-2025-23764](https://cve.now/CVE-2025-23764.md): WordPress Copy Move Posts plugin \<= 1.6 - Broken Access Control vulnerability (CVSS 5.3, ujjavaljani Copy Move Posts)
- [CVE-2025-23816](https://cve.now/CVE-2025-23816.md): WordPress Metaphor Widgets plugin \<= 2.4 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, metaphorcreations Metaphor Widgets)
- [CVE-2025-23815](https://cve.now/CVE-2025-23815.md): WordPress root Cookie plugin \<= 1.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, linickx root Cookie)
- [CVE-2025-23793](https://cve.now/CVE-2025-23793.md): WordPress Auto FTP plugin \<= 1.0.1 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, Ciprian Turcu Auto FTP)
- [CVE-2025-23761](https://cve.now/CVE-2025-23761.md): WordPress Woo Tuner plugin \<= 0.1.2 - Broken Access Control vulnerability (CVSS 5.4, Alex Volkov Woo Tuner)
- [CVE-2025-23760](https://cve.now/CVE-2025-23760.md): WordPress Chatter plugin \<= 1.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Alex Volkov Chatter)
- [CVE-2025-23957](https://cve.now/CVE-2025-23957.md): WordPress Sur.ly plugin \<= 3.0.3 - Broken Access Control vulnerability (CVSS 4.3, surdotly Sur.ly)
- [CVE-2025-23965](https://cve.now/CVE-2025-23965.md): WordPress Kopa Nictitate Toolkit plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, kopatheme Kopa Nictitate Toolkit)
- [CVE-2025-23961](https://cve.now/CVE-2025-23961.md): WordPress WordPress Graphs & Charts Plugin \<= 2.0.8 - Broken Access Control vulnerability (CVSS 5.4, wptasker WordPress Graphs & Charts)
- [CVE-2025-23955](https://cve.now/CVE-2025-23955.md): WordPress Xola plugin \<= 1.6 - Broken Access Control vulnerability (CVSS 4.3, Xola)
- [CVE-2025-23963](https://cve.now/CVE-2025-23963.md): WordPress Mark Posts plugin \<= 2.2.4 - Broken Access Control vulnerability (CVSS 5.4, flymke Mark Posts)
- [CVE-2025-23962](https://cve.now/CVE-2025-23962.md): WordPress Goldstar plugin \<= 2.1.1 - Broken Access Control vulnerability (CVSS 4.3, jjtrabucco Goldstar)
- [CVE-2025-23954](https://cve.now/CVE-2025-23954.md): WordPress Salvador – AI Image Generator plugin \<= 1.0.11 - Broken Access Control vulnerability (CVSS 4.3, awcode Salvador – AI Image Generator)
- [CVE-2025-23939](https://cve.now/CVE-2025-23939.md): WordPress Image Switcher plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, KHAN-IT Image Switcher)
- [CVE-2025-23950](https://cve.now/CVE-2025-23950.md): WordPress EZPlayer plugin \<= 1.0.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ezmarketing EZPlayer)
- [CVE-2025-23943](https://cve.now/CVE-2025-23943.md): WordPress PDF.js Shortcode plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, aruvi PDF.js Shortcode)
- [CVE-2025-23946](https://cve.now/CVE-2025-23946.md): WordPress Enhanced YouTube Shortcode plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Le-Pixel-Solitaire Enhanced YouTube Shortcode)
- [CVE-2025-23941](https://cve.now/CVE-2025-23941.md): WordPress MeinTurnierplan.de Widget Viewer plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MeinTurnierplan.de Widget Viewer)
- [CVE-2025-23951](https://cve.now/CVE-2025-23951.md): WordPress Gallery: Hybrid – Advanced Visual Gallery plugin \<= 1.4.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DIVENGINE Gallery: Hybrid – Advanced Visual Gallery)
- [CVE-2025-23947](https://cve.now/CVE-2025-23947.md): WordPress WP-Player plugin \<= 2.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, M.J WP-Player)
- [CVE-2025-23934](https://cve.now/CVE-2025-23934.md): WordPress Giveaways and Contests by PromoSimple plugin \<= 1.24 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sam Brodie Giveaways and Contests by PromoSimple)
- [CVE-2025-23940](https://cve.now/CVE-2025-23940.md): WordPress jupdf pdf viewer plugin \<= 0.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, horiyuki Image Switcher)
- [CVE-2025-23928](https://cve.now/CVE-2025-23928.md): WordPress Google Org Chart plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Aleksandar Arsovski Google Org Chart)
- [CVE-2025-23924](https://cve.now/CVE-2025-23924.md): WordPress WP Photo Sphere plugin \<= 3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jeremy WP Photo Sphere)
- [CVE-2025-23935](https://cve.now/CVE-2025-23935.md): WordPress Magic Google Maps plugin \<= 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Fengler Magic Google Maps)
- [CVE-2025-23933](https://cve.now/CVE-2025-23933.md): WordPress WpF Ultimate Carousel plugin \<= 1.0.11 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpfreeware WpF Ultimate Carousel)
- [CVE-2025-23930](https://cve.now/CVE-2025-23930.md): WordPress PayPal Marketing Solutions plugin \<= 1.2 - Broken Access Control vulnerability (CVSS 4.3, paypalmuse PayPal Marketing Solutions)
- [CVE-2025-23917](https://cve.now/CVE-2025-23917.md): WordPress Chamber Dashboard Business Directory Plugin \<= 3.3.8 - Broken Access Control vulnerability (CVSS 5.4, Chandrika Guntur, Morgan Kay Chamber Dashboard Business Dir…)
- [CVE-2025-23925](https://cve.now/CVE-2025-23925.md): WordPress Feedburner Optin Form plugin \<= 0.2.8 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, jp2112 Feedburner Optin Form)
- [CVE-2025-23936](https://cve.now/CVE-2025-23936.md): WordPress CC Circle Progress Bar plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Harun R. Rayhan(thecrazycoder) CC Circle Progress Bar)
- [CVE-2025-23927](https://cve.now/CVE-2025-23927.md): WordPress Incredible Font Awesome plugin \<= 1.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, massimo.serpilli Incredible Font Awesome)
- [CVE-2025-23929](https://cve.now/CVE-2025-23929.md): WordPress Email Capture & Lead Generation Plugin \<= 1.0.2 - Broken Access Control vulnerability (CVSS 4.3, wishfulthemes Email Capture & Lead Generation)
- [CVE-2025-23922](https://cve.now/CVE-2025-23922.md): WordPress iSpring Embedder plugin \<= 1.0 - CSRF to Arbitrary File Upload vulnerability (CVSS 10.0, Harsh iSpring Embedder)
- [CVE-2025-23915](https://cve.now/CVE-2025-23915.md): WordPress FAT Event Lite plugin \<= 1.1 - Authenticated Non-Arbitrary Local File Inclusion vulnerability (CVSS 7.5, roninwp FAT Event Lite)
- [CVE-2025-23926](https://cve.now/CVE-2025-23926.md): WordPress Ajax WP Query Search Filter plugin \<= 1.0.7 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, TC.K Ajax WP Query Search Filter)
- [CVE-2025-23916](https://cve.now/CVE-2025-23916.md): WordPress WP Meetup plugin \<= 2.3.0 - Settings Change vulnerability (CVSS 5.4, Nuanced Media WP Meetup)
- [CVE-2025-23919](https://cve.now/CVE-2025-23919.md): WordPress Slides & Presentations Plugin \<= 0.0.39 - Content Injection vulnerability (CVSS 5.4, Ella Van Durpe Slides & Presentations)
- [CVE-2025-23912](https://cve.now/CVE-2025-23912.md): WordPress WordPress Custom Sidebar Plugin \<= 2.3 - SQL Injection vulnerability (CVSS 8.5, Philipp Speck WordPress Custom Sidebar)
- [CVE-2025-23901](https://cve.now/CVE-2025-23901.md): WordPress GravatarLocalCache plugin \<= 1.1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, cybio GravatarLocalCache)
- [CVE-2025-23913](https://cve.now/CVE-2025-23913.md): WordPress Google Map Professional Plugin \<= 1.0 - SQL Injection vulnerability (CVSS 8.5, pankajpragma WordPress Google Map Professional)
- [CVE-2025-23911](https://cve.now/CVE-2025-23911.md): WordPress Solidres – Hotel booking plugin for WordPress Plugin \<= 0.9.4 - SQL Injection vulnerability (CVSS 8.5, Solidres – Hotel booking plugin)
- [CVE-2025-23909](https://cve.now/CVE-2025-23909.md): WordPress Compare Ninja plugin \<= 2.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Common Ninja Compare Ninja)
- [CVE-2025-23908](https://cve.now/CVE-2025-23908.md): WordPress Pastebin plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Rami Yushuvaev Pastebin)
- [CVE-2025-23900](https://cve.now/CVE-2025-23900.md): WordPress Genki Announcement plugin \<= 1.4.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, genkisan Genki Announcement)
- [CVE-2025-23902](https://cve.now/CVE-2025-23902.md): WordPress Error Notification plugin \<= 0.2.7 - CSRF to Stored XSS vulnerability (CVSS 7.1, Taras Dashkevych Error Notification)
- [CVE-2025-23899](https://cve.now/CVE-2025-23899.md): WordPress Bookalet plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Bookalet)
- [CVE-2025-23897](https://cve.now/CVE-2025-23897.md): WordPress Apply with LinkedIn buttons plugin \<= 2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ivobrett Apply with LinkedIn buttons)
- [CVE-2025-23898](https://cve.now/CVE-2025-23898.md): WordPress Apply with LinkedIn buttons plugin \<= 2.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, ivobrett Apply with LinkedIn buttons)
- [CVE-2025-23887](https://cve.now/CVE-2025-23887.md): WordPress Blog Summary plugin \<= 0.1.2 β - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, scottwallick Blog Summary)
- [CVE-2025-23891](https://cve.now/CVE-2025-23891.md): WordPress Yet Another Countdown Plugin plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Vincent Loy Yet Another Countdown)
- [CVE-2025-23884](https://cve.now/CVE-2025-23884.md): WordPress Annie plugin \<= 2.1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Chris Roberts Annie)
- [CVE-2025-23892](https://cve.now/CVE-2025-23892.md): WordPress Progress Tracker plugin \<= 0.9.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Alex Furr Progress Tracker)
- [CVE-2025-23896](https://cve.now/CVE-2025-23896.md): WordPress Mindmeister Shortcode plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, thom4 Mindmeister Shortcode)
- [CVE-2025-23890](https://cve.now/CVE-2025-23890.md): WordPress Easy Tweet Embed plugin \<= 1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tom Ewer Easy Tweet Embed)
- [CVE-2025-23895](https://cve.now/CVE-2025-23895.md): WordPress Add RSS plugin \<= 1.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Dan Cameron Add RSS)
- [CVE-2025-23876](https://cve.now/CVE-2025-23876.md): WordPress WP krpano plugin \<= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, No-Nonsense WP krpano)
- [CVE-2025-23893](https://cve.now/CVE-2025-23893.md): WordPress GMap Shortcode plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Manny Costales GMap Shortcode)
- [CVE-2025-23875](https://cve.now/CVE-2025-23875.md): WordPress Better Protected Pages plugin \<= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, madeglobal Better Protected Pages)
- [CVE-2025-23886](https://cve.now/CVE-2025-23886.md): WordPress Annie plugin \<= 2.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Chris Roberts Annie)
- [CVE-2025-23880](https://cve.now/CVE-2025-23880.md): WordPress amr personalise plugin \<= 2.10 - CSRF to Stored XSS vulnerability (CVSS 7.1, anmari amr personalise)
- [CVE-2025-23878](https://cve.now/CVE-2025-23878.md): WordPress Post-to-Post Links plugin \<= 4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Scott Reilly Post-to-Post Links)
- [CVE-2025-23873](https://cve.now/CVE-2025-23873.md): WordPress Category D3 Tree plugin \<= 1.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Anshi Solutions Category D3 Tree)
- [CVE-2025-23877](https://cve.now/CVE-2025-23877.md): WordPress Nite Shortcodes plugin \<= 1.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nitethemes Nite Shortcodes)
- [CVE-2025-23872](https://cve.now/CVE-2025-23872.md): WordPress PayForm plugin \<= 2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, PayForm)
- [CVE-2025-23864](https://cve.now/CVE-2025-23864.md): WordPress WCS QR Code Generator plugin \<= 1.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Luke America WCS QR Code Generator)
- [CVE-2025-23868](https://cve.now/CVE-2025-23868.md): WordPress Chess Tempo Viewer plugin \<= 0.9.5 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, mliebelt Chess Tempo Viewer)
- [CVE-2025-23871](https://cve.now/CVE-2025-23871.md): WordPress LSD Google Maps Embedder plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Bas Matthee LSD Google Maps Embedder)
- [CVE-2025-23865](https://cve.now/CVE-2025-23865.md): WordPress Winning Portfolio plugin \<= 1.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, pressfore Winning Portfolio)
- [CVE-2025-23863](https://cve.now/CVE-2025-23863.md): WordPress Rollover Tab plugin \<= 1.3.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sabaoh Rollover Tab)
- [CVE-2025-23870](https://cve.now/CVE-2025-23870.md): WordPress Copyright Safeguard Footer Notice plugin \<= 3.0 - CSRF to Stored Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, wygk Copyright Safeguard Footer Notice)
- [CVE-2025-23854](https://cve.now/CVE-2025-23854.md): WordPress Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com plugin \<= 3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, yesstreamingdev Shoutcast and Icecast HTML5 Web Radio Playe…)
- [CVE-2025-23869](https://cve.now/CVE-2025-23869.md): WordPress CJ Custom Content plugin \<= 2.0 - CSRF to Cross-Site Scripting vulnerability (CVSS 7.1, shibulijack CJ Custom Content)
- [CVE-2025-23859](https://cve.now/CVE-2025-23859.md): WordPress Daily Proverb plugin \<= 2.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, jd7777 Daily Proverb)
- [CVE-2025-23860](https://cve.now/CVE-2025-23860.md): WordPress Charity-thermometer plugin \<= 1.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, crea8xion Charity-thermometer)
- [CVE-2025-23862](https://cve.now/CVE-2025-23862.md): WordPress Contact Form 7 Anti Spambot plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 5.3, SzMake Contact Form 7 Anti Spambot)
- [CVE-2025-23861](https://cve.now/CVE-2025-23861.md): WordPress Debt Calculator plugin \<= 1.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Zack Katz Debt Calculator)
- [CVE-2025-23856](https://cve.now/CVE-2025-23856.md): WordPress Simple Vertical Timeline plugin \<= 0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Odyno Simple Vertical Timeline)
- [CVE-2025-23848](https://cve.now/CVE-2025-23848.md): WordPress Hotspots Analytics plugin \<= 4.0.12 - CSRF to Stored XSS vulnerability (CVSS 7.1, dpowney Hotspots Analytics)
- [CVE-2025-23842](https://cve.now/CVE-2025-23842.md): WordPress WordPress Gallery Plugin plugin \<= 1.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, Nilesh Shiragave WordPress Gallery Plugin)
- [CVE-2025-23830](https://cve.now/CVE-2025-23830.md): WordPress JB Horizontal Scroller News Ticker plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, jobair JB Horizontal Scroller News Ticker)
- [CVE-2025-23841](https://cve.now/CVE-2025-23841.md): WordPress Top Flash Embed plugin \<= 0.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, foo123 Top Flash Embed)
- [CVE-2025-23844](https://cve.now/CVE-2025-23844.md): WordPress Custom Widget Classes plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Jamsheer K Custom Widget Classes)
- [CVE-2025-23831](https://cve.now/CVE-2025-23831.md): WordPress QR Code Generator plugin \<= 1.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, mobstac QR Code Generator)
- [CVE-2025-23828](https://cve.now/CVE-2025-23828.md): WordPress WordPress Data Guard \[Website Security\] plugin \<= 8 - CSRF to Stored XSS vulnerability (CVSS 7.1, sindhi WordPress Data Guard)
- [CVE-2025-23826](https://cve.now/CVE-2025-23826.md): WordPress Stop Comment Spam plugin \<= 0.5.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, pedjas Stop Comment Spam)
- [CVE-2025-23824](https://cve.now/CVE-2025-23824.md): WordPress FontAwesome.io ShortCodes plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Alexander Weleczka FontAwesome.io ShortCodes)
- [CVE-2025-23833](https://cve.now/CVE-2025-23833.md): WordPress Links/Problem Reporter plugin \<= 2.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RaminMT Links/Problem Reporter)
- [CVE-2025-23823](https://cve.now/CVE-2025-23823.md): WordPress CNZZ&51LA for WordPress plugin \<= 1.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, jprintf CNZZ&51LA for WordPress)
- [CVE-2025-23825](https://cve.now/CVE-2025-23825.md): WordPress Easy Shortcode Buttons plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, osuthorpe Easy Shortcode Buttons)
- [CVE-2025-23821](https://cve.now/CVE-2025-23821.md): WordPress WP Cookies Alert plugin \<= 1.1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, aleapp WP Cookies Alert)
- [CVE-2025-23832](https://cve.now/CVE-2025-23832.md): WordPress Admin Cleanup plugin \<= 1.0.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Matt Gibbs Admin Cleanup)
- [CVE-2025-23820](https://cve.now/CVE-2025-23820.md): WordPress Content Security Policy Pro plugin \<= 1.3.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, thapa.laxman Content Security Policy Pro)
- [CVE-2025-23827](https://cve.now/CVE-2025-23827.md): WordPress Strx Magic Floating Sidebar Maker plugin \<= 1.4.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, straps Strx Magic Floating Sidebar Maker)
- [CVE-2025-23818](https://cve.now/CVE-2025-23818.md): WordPress More Link Modifier plugin \<= 1.0.3 - CSRF to Cross-Site Scripting vulnerability (CVSS 7.1, pyko More Link Modifier)
- [CVE-2025-23807](https://cve.now/CVE-2025-23807.md): WordPress Spiderpowa Embed PDF plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, jim2212001 Spiderpowa Embed PDF)
- [CVE-2025-23822](https://cve.now/CVE-2025-23822.md): WordPress Category Custom Fields plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, alicornea Category Custom Fields)
- [CVE-2025-23808](https://cve.now/CVE-2025-23808.md): WordPress Custom List Table Example Plugin \<=1.4.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dutch van Andel Custom List Table Example)
- [CVE-2025-23805](https://cve.now/CVE-2025-23805.md): WordPress SEOReseller Partner plugin \<= 1.3.15 - CSRF to Stored XSS vulnerability (CVSS 7.1, itamarg SEOReseller Partner)
- [CVE-2025-23817](https://cve.now/CVE-2025-23817.md): WordPress MHR-Custom-Anti-Copy plugin \<= 2.0 - CSRF to Stored Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, mahadirz MHR-Custom-Anti-Copy)
- [CVE-2025-23810](https://cve.now/CVE-2025-23810.md): WordPress Len Slider Plugin \<= 2.0.11 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Igor Sazonov Len Slider)
- [CVE-2025-23801](https://cve.now/CVE-2025-23801.md): WordPress Style Admin Plugin \<= 1.4.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, FuzzGuard Style Admin)
- [CVE-2025-23804](https://cve.now/CVE-2025-23804.md): WordPress WP Service Payment Form With Authorize.net Plugin \<= 2.6.0 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Shiv Prakash Tiwari WP Service Payment Form With Authorize.…)
- [CVE-2025-23797](https://cve.now/CVE-2025-23797.md): WordPress WP Options Editor plugin \<= 1.1 - CSRF to Privilege Escalation vulnerability (CVSS 9.8, Mike Selander WP Options Editor)
- [CVE-2025-23795](https://cve.now/CVE-2025-23795.md): WordPress Easy FAQs plugin \<= 3.2.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ghuger Easy FAQs)
- [CVE-2025-23800](https://cve.now/CVE-2025-23800.md): WordPress OrangeBox plugin \<= 3.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, nova706 OrangeBox)
- [CVE-2025-23802](https://cve.now/CVE-2025-23802.md): WordPress WP-Revive Adserver Plugin \<= 2.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SteveSoehl WP-Revive Adserver)
- [CVE-2025-23796](https://cve.now/CVE-2025-23796.md): WordPress Easy Portfolio plugin \<= 1.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tushar Patel Easy Portfolio)
- [CVE-2025-23791](https://cve.now/CVE-2025-23791.md): WordPress Horizontal Line Shortcode Plugin \<= 1.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, mikakaltoft Horizontal Line Shortcode)
- [CVE-2025-23794](https://cve.now/CVE-2025-23794.md): WordPress wp\_amaps Plugin \<= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.5, \_rccoder\_ wp\_amaps)
- [CVE-2025-23780](https://cve.now/CVE-2025-23780.md): WordPress Easy Code Snippets Plugin \<= 1.0.2 - SQL Injection vulnerability (CVSS 7.6, Alpha BPO Easy Code Snippets)
- [CVE-2025-23785](https://cve.now/CVE-2025-23785.md): WordPress AI Responsive Gallery Album plugin \<= 1.4 - Broken Access Control vulnerability (CVSS 4.3, August Infotech AI Responsive Gallery Album)
- [CVE-2025-23778](https://cve.now/CVE-2025-23778.md): WordPress User Sync ActiveCampaign plugin \<= 1.3.2 - Broken Access Control vulnerability (CVSS 5.4, Pravin Durugkar User Sync ActiveCampaign)
- [CVE-2025-23779](https://cve.now/CVE-2025-23779.md): WordPress ResAds Plugin \<= 2.0.5 - SQL Injection vulnerability (CVSS 7.6, web-mv ResAds)
- [CVE-2025-23777](https://cve.now/CVE-2025-23777.md): WordPress GDPR Personal Data Reports Plugin \<= 1.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, willowsconsulting GDPR Personal Data Reports)
- [CVE-2025-23772](https://cve.now/CVE-2025-23772.md): WordPress imaGenius Plugin \<= 1.7 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Eugenio Petulla’ imaGenius)
- [CVE-2025-23775](https://cve.now/CVE-2025-23775.md): WordPress GMAPS for WPBakery Page Builder Free Plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WWP GMAPS for WPBakery Page Builder Free)
- [CVE-2025-23765](https://cve.now/CVE-2025-23765.md): WordPress W3SPEEDSTER plugin \<= 7.33 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, W3SPEEDSTER)
- [CVE-2025-23776](https://cve.now/CVE-2025-23776.md): WordPress Cache Sniper for Nginx plugin \<= 1.0.4.2 - Broken Access Control vulnerability (CVSS 4.3, ekaterir Cache Sniper for Nginx)
- [CVE-2025-23783](https://cve.now/CVE-2025-23783.md): WordPress Greek Namedays Widget Plugin \<= 20191113 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, carrotbits Greek Namedays Widget From Eortologio.Net)
- [CVE-2025-23767](https://cve.now/CVE-2025-23767.md): WordPress Marmoset Viewer plugin \<= 1.9.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, revoxis Marmoset Viewer)
- [CVE-2025-23749](https://cve.now/CVE-2025-23749.md): WordPress mybb Last Topics plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, progpars.net mybb Last Topics)
- [CVE-2025-23713](https://cve.now/CVE-2025-23713.md): WordPress Hack me if you can plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, artanik Hack me if you can)
- [CVE-2025-23745](https://cve.now/CVE-2025-23745.md): WordPress Call me Now plugin \<= 1.0.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Tussendoor B.V. Call me Now)
- [CVE-2025-23743](https://cve.now/CVE-2025-23743.md): WordPress Social Analytics plugin \<= 0.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, MartijnScheijbeler Social Analytics)
- [CVE-2025-23717](https://cve.now/CVE-2025-23717.md): WordPress Theme My Ontraport Smartform plugin \<= 1.2.11 - CSRF to Stored XSS vulnerability (CVSS 7.1, itmooti Theme My Ontraport Smartform)
- [CVE-2025-23720](https://cve.now/CVE-2025-23720.md): WordPress Web Push plugin \<= 1.4.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Marco Castelluccio Web Push)
- [CVE-2025-23702](https://cve.now/CVE-2025-23702.md): WordPress Anonymize Links plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Schalk Burger Anonymize Links)
- [CVE-2025-23712](https://cve.now/CVE-2025-23712.md): WordPress Kapost plugin \<= 2.2.9 - CSRF to Stored XSS vulnerability (CVSS 7.1, kapostintegrations Kapost)
- [CVE-2025-23715](https://cve.now/CVE-2025-23715.md): WordPress Post & Page Notes plugin \<= 0.1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, RaymondDesign Post & Page Notes)
- [CVE-2025-23703](https://cve.now/CVE-2025-23703.md): WordPress Free MailClient FMC plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, cstoltenkamp Free MailClient FMC)
- [CVE-2025-23710](https://cve.now/CVE-2025-23710.md): WordPress Flying Twitter Birds plugin \<= 1.8 - CSRF to Stored XSS vulnerability (CVSS 7.1, Mayur Sojitra Flying Twitter Birds)
- [CVE-2025-23708](https://cve.now/CVE-2025-23708.md): WordPress DF Draggable plugin \<= 1.13.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Dominic Fallows DF Draggable)
- [CVE-2025-23698](https://cve.now/CVE-2025-23698.md): WordPress WP Custom Google Search plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, ivanra10 WP Custom Google Search)
- [CVE-2025-23694](https://cve.now/CVE-2025-23694.md): WordPress Shabbos and Yom Tov plugin \<= 1.9 - CSRF to Stored XSS vulnerability (CVSS 7.1, shabboscommerce Shabbos and Yom Tov)
- [CVE-2025-23699](https://cve.now/CVE-2025-23699.md): WordPress Event Countdown Timer Plugin by TechMix plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Event Countdown Timer Plugin by TechMix)
- [CVE-2025-23692](https://cve.now/CVE-2025-23692.md): WordPress Slider for Writers plugin \<= 1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, artanik Slider for Writers)
- [CVE-2025-23690](https://cve.now/CVE-2025-23690.md): WordPress Book a Place plugin \<= 0.7.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, ArtkanMedia Book a Place)
- [CVE-2025-23675](https://cve.now/CVE-2025-23675.md): WordPress Import Users to MailChimp plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Sana Ullah Import Users to MailChimp)
- [CVE-2025-23689](https://cve.now/CVE-2025-23689.md): WordPress Blogger Image Import plugin \<= 2.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Poco Blogger Image Import)
- [CVE-2025-23677](https://cve.now/CVE-2025-23677.md): WordPress HTTP to HTTPS link changer by Eyga.net plugin \<= 0.2.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, DSmidge HTTP to HTTPS link changer by Eyga.net)
- [CVE-2025-23673](https://cve.now/CVE-2025-23673.md): WordPress Email on Publish plugin \<= 1.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, dkukral Email on Publish)
- [CVE-2025-23693](https://cve.now/CVE-2025-23693.md): WordPress Secure CAPTCHA plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, uosiu Secure CAPTCHA)
- [CVE-2025-23691](https://cve.now/CVE-2025-23691.md): WordPress Send to Twitter plugin \<= 1.7.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Braulio Aquino Send to Twitter)
- [CVE-2025-23665](https://cve.now/CVE-2025-23665.md): WordPress RSV GMaps plugin \<= 1.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Ravi Kumar Vanukuru RSV GMaps)
- [CVE-2025-23644](https://cve.now/CVE-2025-23644.md): WordPress QuoteMedia Tools plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, justin.kuepper QuoteMedia Tools)
- [CVE-2025-23661](https://cve.now/CVE-2025-23661.md): WordPress NV Slider plugin \<= 1.6 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, ryscript NV Slider)
- [CVE-2025-23649](https://cve.now/CVE-2025-23649.md): WordPress Auphonic Importer plugin \<= 1.5.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Kreg Steppe Auphonic Importer)
- [CVE-2025-23654](https://cve.now/CVE-2025-23654.md): WordPress Twitter Post plugin \<= 0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, krolow Twitter Post)
- [CVE-2025-23664](https://cve.now/CVE-2025-23664.md): WordPress Real Seguro Viagem plugin \<= 2.0.5 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, Real Seguro Viagem)
- [CVE-2025-23660](https://cve.now/CVE-2025-23660.md): WordPress MFPlugin plugin \<= 1.3 - CSRF to Cross-Site Scripting vulnerability (CVSS 7.1, waltercerrudo MFPlugin)
- [CVE-2025-23662](https://cve.now/CVE-2025-23662.md): WordPress WP Panoramio plugin \<= 1.5.0 - CSRF to Cross-Site Scripting vulnerability (CVSS 7.1, ryscript WP Panoramio)
- [CVE-2025-23659](https://cve.now/CVE-2025-23659.md): WordPress MercadoLibre Integration plugin \<= 1.1 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, hernanjh MercadoLibre Integration)
- [CVE-2025-23642](https://cve.now/CVE-2025-23642.md): WordPress Sidebar-Content from Shortcode plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, pflonk Sidebar-Content from Shortcode)
- [CVE-2025-23640](https://cve.now/CVE-2025-23640.md): WordPress Rename Author Slug plugin \<= 1.2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Nazmul Ahsan Rename Author Slug)
- [CVE-2025-23623](https://cve.now/CVE-2025-23623.md): WordPress Contact Form 7 – CCAvenue Add-on plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mahesh Bisen Contact Form 7 – CCAvenue Add-on)
- [CVE-2025-23641](https://cve.now/CVE-2025-23641.md): WordPress Powie's pLinks PagePeeker plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PowieT Powie's pLinks PagePeeker)
- [CVE-2025-23627](https://cve.now/CVE-2025-23627.md): WordPress Comment-Emailer plugin \<= 1.0.5 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, frenchsquared Comment-Emailer)
- [CVE-2025-23639](https://cve.now/CVE-2025-23639.md): WordPress MDC YouTube Downloader plugin \<= 3.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Nazmul Ahsan MDC YouTube Downloader)
- [CVE-2025-23573](https://cve.now/CVE-2025-23573.md): WordPress WP Background Tile plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, sammyb WP Background Tile)
- [CVE-2025-23618](https://cve.now/CVE-2025-23618.md): WordPress Twitter Shortcode plugin \<= 0.9 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, starise Twitter Shortcode)
- [CVE-2025-23577](https://cve.now/CVE-2025-23577.md): WordPress Word Freshener plugin \<= 1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, Sourov Amin Word Freshener)
- [CVE-2025-23559](https://cve.now/CVE-2025-23559.md): WordPress MemeOne plugin \<= 2.0.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Stepan Stepasyuk MemeOne)
- [CVE-2025-23617](https://cve.now/CVE-2025-23617.md): WordPress Floatbox Plus plugin \<= 1.4.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, cybio Floatbox Plus)
- [CVE-2025-23567](https://cve.now/CVE-2025-23567.md): WordPress GDReseller plugin \<= 1.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, Tamer Ziady GDReseller)
- [CVE-2025-23547](https://cve.now/CVE-2025-23547.md): WordPress LH Login Page plugin \<= 2.14 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, shawfactor LH Login Page)
- [CVE-2025-23569](https://cve.now/CVE-2025-23569.md): WordPress Shortcode in Comment plugin \<= 1.1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Kelvin Ng Shortcode in Comment)
- [CVE-2025-23620](https://cve.now/CVE-2025-23620.md): WordPress Captchelfie – Captcha by Selfie plugin \<= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, trof Captchelfie – Captcha by Selfie)
- [CVE-2025-23572](https://cve.now/CVE-2025-23572.md): WordPress UpDownUpDown plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Dave Konopka UpDownUpDown)
- [CVE-2025-23557](https://cve.now/CVE-2025-23557.md): WordPress Find Your Reps plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Kathleen Malone Find Your Reps)
- [CVE-2025-23560](https://cve.now/CVE-2025-23560.md): WordPress Web Testimonials plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, plumwd Web Testimonials)
- [CVE-2025-23566](https://cve.now/CVE-2025-23566.md): WordPress Custom Post plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, syedamirhussain91 Custom Post)
- [CVE-2025-23528](https://cve.now/CVE-2025-23528.md): WordPress DD Roles plugin \<= 4.1 - Privilege Escalation vulnerability (CVSS 8.8, Mosterd3d DD Roles)
- [CVE-2025-23532](https://cve.now/CVE-2025-23532.md): WordPress MyAnime Widget plugin \<= 1.0 - CSRF to Privilege Escalation vulnerability (CVSS 8.8, Regios MyAnime Widget)
- [CVE-2025-23558](https://cve.now/CVE-2025-23558.md): WordPress Geotagged Media plugin \<= 0.3.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, digitalfisherman Geotagged Media)
- [CVE-2025-23537](https://cve.now/CVE-2025-23537.md): WordPress add custom google tag manager plugin \<= 1.0.3 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, קידום ובניית אתרים add custom google tag manager)
- [CVE-2025-23510](https://cve.now/CVE-2025-23510.md): WordPress WordPress Logging Service plugin \<= 1.5.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jan Štětina WordPress Logging Service)
- [CVE-2025-23511](https://cve.now/CVE-2025-23511.md): WordPress WP-BlackCheck plugin \<= 2.7.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Stargazer WP-BlackCheck)
- [CVE-2025-23530](https://cve.now/CVE-2025-23530.md): WordPress Custom Post Type Lockdown plugin \<= 1.11 - CSRF to Privilege Escalation vulnerability (CVSS 8.8, yonisink Custom Post Type Lockdown)
- [CVE-2025-23533](https://cve.now/CVE-2025-23533.md): WordPress WP Lyrics plugin \<= 0.4.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, zetxek WP Lyrics)
- [CVE-2025-23514](https://cve.now/CVE-2025-23514.md): WordPress Loginplus plugin \<= 1.2 - Broken Access Control vulnerability (CVSS 5.3, Sanjay Prasad Loginplus)
- [CVE-2025-23513](https://cve.now/CVE-2025-23513.md): WordPress Bible Embed plugin \<= 0.0.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jd7777 Bible Embed)
- [CVE-2025-23499](https://cve.now/CVE-2025-23499.md): WordPress Board Election plugin \<= 1.0.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pascal Casier Board Election)
- [CVE-2025-23508](https://cve.now/CVE-2025-23508.md): WordPress Extra Options – Favicons plugin \<= 1.1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, OrigoThemes Extra Options – Favicons)
- [CVE-2025-23501](https://cve.now/CVE-2025-23501.md): WordPress Cookie Consent & Autoblock for GDPR/CCPA plugin \<= 1.0.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, SpruceJoy Cookie Consent & Autoblock for GDPR/CCPA)
- [CVE-2025-23435](https://cve.now/CVE-2025-23435.md): WordPress Password Protect Plugin for WordPress plugin \<= 0.8.1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, marcucci Password Protect Plugin for WordPress)
- [CVE-2025-23452](https://cve.now/CVE-2025-23452.md): WordPress EditionGuard for WooCommerce plugin \<= 3.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, EditionGuard for WooCommerce – eBook Sales with DRM)
- [CVE-2025-23438](https://cve.now/CVE-2025-23438.md): WordPress WP PT-Viewer plugin \<= 2.0.2 - Reflected XSS vulnerability (CVSS 7.1, Vincent Mimoun-Prat WP PT-Viewer)
- [CVE-2025-23497](https://cve.now/CVE-2025-23497.md): WordPress Simple Project Manager plugin \<= 1.2.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, albdesign Simple Project Manager)
- [CVE-2025-23434](https://cve.now/CVE-2025-23434.md): WordPress Easy EU Cookie law plugin \<= 1.3.3.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, viher3 Easy EU Cookie law)
- [CVE-2025-23471](https://cve.now/CVE-2025-23471.md): WordPress ECT Add to Cart Button plugin \<= 1.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, etemplates ECT Add to Cart Button)
- [CVE-2025-23444](https://cve.now/CVE-2025-23444.md): WordPress Scroll Top Advanced plugin \<= 2.5 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nasir179125 Scroll Top Advanced)
- [CVE-2025-23424](https://cve.now/CVE-2025-23424.md): WordPress Marquee Style RSS News Ticker plugin \<= 3.2.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, bnovotny Marquee Style RSS News Ticker)
- [CVE-2025-23426](https://cve.now/CVE-2025-23426.md): WordPress go Social plugin \<= 1.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Binesh Dobhal go Social)
- [CVE-2025-23453](https://cve.now/CVE-2025-23453.md): WordPress Stars SMTP Mailer plugin \<= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Myriad Solutionz Stars SMTP Mailer)
- [CVE-2025-23445](https://cve.now/CVE-2025-23445.md): WordPress Easy Tynt plugin \<= 0.2.5.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, scottswezey Easy Tynt)
- [CVE-2025-23430](https://cve.now/CVE-2025-23430.md): WordPress Mass Custom Fields Manager plugin \<= 1.5 - CSRF to Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Oren Yomtov Mass Custom Fields Manager)
- [CVE-2025-23455](https://cve.now/CVE-2025-23455.md): WordPress WP VTiger Synchronization plugin \<= 1.1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Master Software Solutions WP VTiger Synchronization)
- [CVE-2025-23436](https://cve.now/CVE-2025-23436.md): WordPress Wp-Scribd-List plugin \<= 1.2 - CSRF to XSS vulnerability (CVSS 7.1, capa Wp-Scribd-List)
- [CVE-2025-23442](https://cve.now/CVE-2025-23442.md): WordPress Shockingly Big IE6 Warning plugin \<= 1.6.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, mschertel Shockingly Big IE6 Warning)
- [CVE-2025-23456](https://cve.now/CVE-2025-23456.md): WordPress EmailShroud plugin \<= 2.2.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Oddthinking EmailShroud)
- [CVE-2025-23476](https://cve.now/CVE-2025-23476.md): WordPress my-related-posts plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, isnowfy my-related-posts)
- [CVE-2025-23429](https://cve.now/CVE-2025-23429.md): WordPress Altima Lookbook Free for WooCommerce plugin \<= 1.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, altima-interactive Altima Lookbook Free for WooCommerce)
- [CVE-2025-23483](https://cve.now/CVE-2025-23483.md): WordPress Universal Analytics Injector plugin \<= 1.0.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, hoyce Universal Analytics Injector)
- [CVE-2025-23463](https://cve.now/CVE-2025-23463.md): WordPress MD Custom content after or before of post plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Mukesh Dak MD Custom content after or before of post)
- [CVE-2025-23432](https://cve.now/CVE-2025-23432.md): WordPress AlT Report plugin \<= 1.12.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AlTi5 AlT Report)
- [CVE-2025-23470](https://cve.now/CVE-2025-23470.md): WordPress Visit Site Link enhanced plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, xavsio4 Visit Site Link enhanced)
- [CVE-2025-23467](https://cve.now/CVE-2025-23467.md): WordPress RSS News Scroller plugin \<= 2.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, vimal.ghorecha RSS News Scroller)
- [CVE-2025-23423](https://cve.now/CVE-2025-23423.md): WordPress SendGrid for WordPress plugin \<= 1.4 - Broken Access Control vulnerability (CVSS 4.3, Smackcoders Inc., SendGrid for WordPress)
- [CVE-2024-55954](https://cve.now/CVE-2024-55954.md): OpenObserve Improper Authorization Allows Admin User to Remove Root User (CVSS 8.7, openobserve)
- [CVE-2024-56136](https://cve.now/CVE-2024-56136.md): /api/v1/jwt/fetch\_api\_key endpoint can leak if an email address has an account in Zulip server (CVSS 6.9, zulip)
- [CVE-2024-36402](https://cve.now/CVE-2024-36402.md): Unauthenticated writes to the media repository allow planting of problematic content in Matrix Media Repo (CVSS 5.3, t2bot matrix-media-repo · github.com/t2bot/matrix-media-repo)
- [CVE-2024-36403](https://cve.now/CVE-2024-36403.md): Denial of service/high operating costs through unauthenticated downloads in Matrix Media Repo (CVSS 5.3, t2bot matrix-media-repo · github.com/t2bot/matrix-media-repo)
- [CVE-2024-52602](https://cve.now/CVE-2024-52602.md): Server-Side Request Forgery (SSRF) on redirects and federation in Matrix Media Repo (CVSS 5.0, t2bot matrix-media-repo · github.com/t2bot/matrix-media-repo)
- [CVE-2024-52791](https://cve.now/CVE-2024-52791.md): Denial of service through memory exhaustion in Matrix Media Repo (CVSS 5.3, t2bot matrix-media-repo · github.com/t2bot/matrix-media-repo)
- [CVE-2024-56515](https://cve.now/CVE-2024-56515.md): Untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in Matrix Media Repo (CVSS 6.8, t2bot matrix-media-repo · github.com/t2bot/matrix-media-repo)
- [CVE-2024-52594](https://cve.now/CVE-2024-52594.md): Server-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlib (CVSS 4.3, matrix-org gomatrixserverlib · github.com/matrix-org/gomatr…)
- [CVE-2025-20630](https://cve.now/CVE-2025-20630.md): Mobile crash via object that can't be cast to String in Attachment Field (CVSS 6.5, Mattermost)
- [CVE-2025-20621](https://cve.now/CVE-2025-20621.md): Webapp crash via object that can't be cast to String in Attachment Field (CVSS 6.5, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-37181](https://cve.now/CVE-2024-37181.md): Time-of-check time-of-use race condition in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user… (CVSS 2.1, Intel(R) Neural Compressor software)
- [CVE-2025-20072](https://cve.now/CVE-2025-20072.md): Mobile crash via improper validation of proto style in attachments (CVSS 6.5, Mattermost)
- [CVE-2024-41746](https://cve.now/CVE-2024-41746.md): IBM CICS TX cross-site scripting (CVSS 7.2, IBM CICS TX Advanced · IBM CICS TX Standard)
- [CVE-2025-0518](https://cve.now/CVE-2025-0518.md): Unchecked sscanf return value which leads to memory data leak (CVSS 4.8, FFmpeg)
- [CVE-2025-0473](https://cve.now/CVE-2025-0473.md): Incomplete Cleanup vulnerability in PMB platform (CVSS 6.5, PMB Services PMB platform)
- [CVE-2025-0472](https://cve.now/CVE-2025-0472.md): Information exposure vulnerability in PMB platform (CVSS 7.5, PMB Services PMB platform)
- [CVE-2025-0471](https://cve.now/CVE-2025-0471.md): Unrestricted Upload of File with Dangerous Type vulnerability in PMB platform (CVSS 9.9, PMB Services PMB platform)
- [CVE-2018-25108](https://cve.now/CVE-2018-25108.md): WAGO: Denial of service in 750-8xx controller due to uncontrolled resource consumption (CVSS 7.5, WAGO 750-8100 · WAGO 750-831 +2)
- [CVE-2024-12427](https://cve.now/CVE-2024-12427.md): Multi Step Form \<= 1.7.23 - Missing Authorization to Unauthenticated Limited File Upload (CVSS 5.3, mondula2016 Multi Step Form)
- [CVE-2024-12613](https://cve.now/CVE-2024-12613.md): Passwords Manager \<= 1.4.8 - Unauthenticated SQL Injection (CVSS 7.5, coder426 Passwords Manager)
- [CVE-2024-12615](https://cve.now/CVE-2024-12615.md): Passwords Manager \<= 1.4.8 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, coder426 Passwords Manager)
- [CVE-2024-12614](https://cve.now/CVE-2024-12614.md): Passwords Manager \<= 1.4.8 - Missing Authorization to Authenticated (Subscriber+) Add Password + Update Encryption Key (CVSS 7.5, coder426 Passwords Manager)
- [CVE-2024-13355](https://cve.now/CVE-2024-13355.md): Admin and Customer Messages After Order for WooCommerce \<= 13.2 - Authenticated (Subscriber+) Limited File Upload to Cross-Site Scripting (CVSS 5.4, nmedia Admin and Customer Messages After Order for WooComme…)
- [CVE-2024-13387](https://cve.now/CVE-2024-13387.md): WP Responsive Tabs \<= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, fahadmahmood WP Responsive Tabs)
- [CVE-2024-50563](https://cve.now/CVE-2024-50563.md): A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud… (CVSS 6.7, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2024-48885](https://cve.now/CVE-2024-48885.md): A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through… (CVSS 5.2, Fortinet FortiVoice · Fortinet FortiRecorder +1)
- [CVE-2024-45331](https://cve.now/CVE-2024-45331.md): A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5… (CVSS 6.9, Fortinet FortiAnalyzer Cloud · Fortinet FortiManager +1)
- [CVE-2024-12226](https://cve.now/CVE-2024-12226.md): In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in… (CVSS 6.5, Octopus Deploy Kubernetes Worker or Kubernetes Agent)
- [CVE-2024-10789](https://cve.now/CVE-2024-10789.md): WP User Profile Avatar \<= 1.0.5 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, wpeventmanager WP User Profile Avatar)
- [CVE-2024-11452](https://cve.now/CVE-2024-11452.md): Chamber Dashboard Business Directory \<= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, gwendydd Chamber Dashboard Business Directory)
- [CVE-2024-10970](https://cve.now/CVE-2024-10970.md): Motors – Car Dealer, Classifieds & Listing \<= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title (CVSS 5.4, stylemix Motors – Car Dealership & Classified Listings Plug…)
- [CVE-2025-0170](https://cve.now/CVE-2025-0170.md): DWT - Directory & Listing WordPress Theme \<= 3.3.3 - Reflected Cross-Site Scripting (CVSS 6.1, scriptsbundle DWT - Directory & Listing WordPress Theme)
- [CVE-2025-0457](https://cve.now/CVE-2025-0457.md): NetVision Information airPASS - OS Command Injection (CVSS 8.8, NetVision Information airPASS)
- [CVE-2025-0456](https://cve.now/CVE-2025-0456.md): NetVision Information airPASS - Missing Authentication (CVSS 9.8, NetVision Information airPASS)
- [CVE-2025-0455](https://cve.now/CVE-2025-0455.md): NetVision Information airPASS - SQL injection (CVSS 9.8, NetVision Information airPASS)
- [CVE-2024-40513](https://cve.now/CVE-2024-40513.md): An issue in themesebrand Chatvia v.5.3.2 allows a remote attacker to execute arbitrary code via the User profile Upload image function. (CVSS 4.6)
- [CVE-2024-40514](https://cve.now/CVE-2024-40514.md): Insecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to escalate privileges via the User profile… (CVSS 4.6)
- [CVE-2024-46450](https://cve.now/CVE-2024-46450.md): Incorrect access control in Tenda AC1200 Smart Dual-Band WiFi Router Model AC6 v2.0 Firmware v15.03.06.50 allows attackers to bypass… (CVSS 8.1)
- [CVE-2024-48460](https://cve.now/CVE-2024-48460.md): An issue in Eugeny Tabby 1.0.213 allows a remote attacker to obtain sensitive information via the server and sends the SSH username and… (CVSS 4.3, tabby-ssh)
- [CVE-2024-50633](https://cve.now/CVE-2024-50633.md): A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted… (CVSS 0.0, CERN Indico · indico)
- [CVE-2024-53553](https://cve.now/CVE-2024-53553.md): An issue in OPEXUS FOIAXPRESS PUBLIC ACCESS LINK v11.1.0 allows attackers to bypass authentication via crafted web requests. (CVSS 9.1)
- [CVE-2024-54660](https://cve.now/CVE-2024-54660.md): A JNDI injection issue was discovered in Cloudera JDBC Connector for Hive before 2.6.26 and JDBC Connector for Impala before 2.6.35. (CVSS 8.7)
- [CVE-2024-55511](https://cve.now/CVE-2024-55511.md): A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or… (CVSS 7.8)
- [CVE-2024-57159](https://cve.now/CVE-2024-57159.md): 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via /erp.07fly.net:80/oa/OaWorkReport/add.html. (CVSS 3.5)
- [CVE-2024-57160](https://cve.now/CVE-2024-57160.md): 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via /erp.07fly.net:80/oa/OaTask/edit.html. (CVSS 4.3)
- [CVE-2024-57161](https://cve.now/CVE-2024-57161.md): 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via /erp.07fly.net:80/oa/OaWorkReport/edit.html (CVSS 4.3)
- [CVE-2024-57162](https://cve.now/CVE-2024-57162.md): Campcodes Cybercafe Management System v1.0 is vulnerable to SQL Injection in /ccms/view-user-detail.php. (CVSS 7.2)
- [CVE-2024-57575](https://cve.now/CVE-2024-57575.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the ssid parameter in the form\_fast\_setting\_wifi\_set function. (CVSS 9.8)
- [CVE-2024-57577](https://cve.now/CVE-2024-57577.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the speed\_dir parameter in the formSetSpeedWan function. (CVSS 5.7)
- [CVE-2024-57578](https://cve.now/CVE-2024-57578.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the funcpara1 parameter in the formSetCfm function. (CVSS 5.7)
- [CVE-2024-57579](https://cve.now/CVE-2024-57579.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the limitSpeedUp parameter in the formSetClientState function. (CVSS 9.8)
- [CVE-2024-57580](https://cve.now/CVE-2024-57580.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function. (CVSS 9.8)
- [CVE-2024-57581](https://cve.now/CVE-2024-57581.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function. (CVSS 9.8)
- [CVE-2024-57582](https://cve.now/CVE-2024-57582.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the startIP parameter in the formSetPPTPServer function. (CVSS 9.8)
- [CVE-2024-57583](https://cve.now/CVE-2024-57583.md): Tenda AC18 V15.03.05.19 was discovered to contain a command injection vulnerability via the usbName parameter in the formSetSambaConf… (CVSS 9.8)
- [CVE-2024-57611](https://cve.now/CVE-2024-57611.md): 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/doAdminAction.php?act=editShop&shopId. (CVSS 3.5)
- [CVE-2024-57676](https://cve.now/CVE-2024-57676.md): An access control issue in the component form2WlanBasicSetup.cgi of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated… (CVSS 6.5)
- [CVE-2024-57677](https://cve.now/CVE-2024-57677.md): An access control issue in the component form2Wan.cgi of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated attackers to set… (CVSS 6.5)
- [CVE-2024-57678](https://cve.now/CVE-2024-57678.md): An access control issue in the component form2WlAc.cgi of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated attackers to set… (CVSS 6.5)
- [CVE-2024-57679](https://cve.now/CVE-2024-57679.md): An access control issue in the component form2RepeaterSetup.cgi of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated attackers… (CVSS 6.5)
- [CVE-2024-57680](https://cve.now/CVE-2024-57680.md): An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated… (CVSS 5.3)
- [CVE-2024-57681](https://cve.now/CVE-2024-57681.md): An access control issue in the component form2alg.cgi of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated attackers to set… (CVSS 5.3)
- [CVE-2024-57682](https://cve.now/CVE-2024-57682.md): An information disclosure vulnerability in the component d\_status.asp of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated… (CVSS 6.5)
- [CVE-2024-57683](https://cve.now/CVE-2024-57683.md): An access control issue in the component websURLFilterAddDel of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated attackers to… (CVSS 4.3)
- [CVE-2024-57684](https://cve.now/CVE-2024-57684.md): An access control issue in the component formDMZ.cgi of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated attackers to set the… (CVSS 9.8)
- [CVE-2024-57703](https://cve.now/CVE-2024-57703.md): Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability. (CVSS 7.3)
- [CVE-2024-57704](https://cve.now/CVE-2024-57704.md): Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability. (CVSS 4.6)
- [CVE-2024-57768](https://cve.now/CVE-2024-57768.md): JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component validRoleKey?sysRole.key. (CVSS 9.8)
- [CVE-2024-57769](https://cve.now/CVE-2024-57769.md): JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component borrowmoney/listData?applyUser. (CVSS 8.8)
- [CVE-2024-57770](https://cve.now/CVE-2024-57770.md): JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id. (CVSS 8.8)
- [CVE-2024-57771](https://cve.now/CVE-2024-57771.md): A cross-site scripting (XSS) vulnerability in the common/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to… (CVSS 4.8)
- [CVE-2024-57772](https://cve.now/CVE-2024-57772.md): A cross-site scripting (XSS) vulnerability in the /bumph/getDraftListPage?type interface of JFinalOA before v2025.01.01 allows attackers… (CVSS 4.8)
- [CVE-2024-57773](https://cve.now/CVE-2024-57773.md): A cross-site scripting (XSS) vulnerability in the openSelectManyUserPage?orgid interface of JFinalOA before v2025.01.01 allows attackers… (CVSS 4.8)
- [CVE-2024-57774](https://cve.now/CVE-2024-57774.md): A cross-site scripting (XSS) vulnerability in the getBusinessUploadListPage?busid interface of JFinalOA before v2025.01.01 allows… (CVSS 4.8)
- [CVE-2024-57775](https://cve.now/CVE-2024-57775.md): JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component getWorkFlowHis?insid. (CVSS 8.8)
- [CVE-2024-57776](https://cve.now/CVE-2024-57776.md): A cross-site scripting (XSS) vulnerability in the /apply/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to… (CVSS 4.6)
- [CVE-2024-57784](https://cve.now/CVE-2024-57784.md): An issue in the component /php/script\_uploads.php of Zenitel AlphaWeb XE v11.2.3.10 allows attackers to execute a directory traversal. (CVSS 5.5)
- [CVE-2024-57785](https://cve.now/CVE-2024-57785.md): Zenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc\_uploads.php. (CVSS 4.9)
- [CVE-2025-22904](https://cve.now/CVE-2025-22904.md): RE11S v1.11 was discovered to contain a stack overflow via the pptpUserName parameter in the setWAN function. (CVSS 9.8)
- [CVE-2025-22905](https://cve.now/CVE-2025-22905.md): RE11S v1.11 was discovered to contain a command injection vulnerability via the command parameter at /goform/mp. (CVSS 9.8)
- [CVE-2025-22906](https://cve.now/CVE-2025-22906.md): RE11S v1.11 was discovered to contain a command injection vulnerability via the L2TPUserName parameter at /goform/setWAN. (CVSS 9.8)
- [CVE-2025-22907](https://cve.now/CVE-2025-22907.md): RE11S v1.11 was discovered to contain a stack overflow via the selSSID parameter in the formWlSiteSurvey function. (CVSS 9.8)
- [CVE-2025-22912](https://cve.now/CVE-2025-22912.md): RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept. (CVSS 9.8)
- [CVE-2025-22913](https://cve.now/CVE-2025-22913.md): RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formStaDrvSetup function. (CVSS 9.8)
- [CVE-2025-22916](https://cve.now/CVE-2025-22916.md): RE11S v1.11 was discovered to contain a stack overflow via the pppUserName parameter in the formPPPoESetup function. (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2025-01-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.