CVEs published October 18, 2025
42 CVEs were published on October 18, 2025: 4 critical, 6 high. Browse them by severity, product and exploitation status.
- Published
- 42
- Critical
- 4
- High
- 6
- Medium
- 29
- Low
- 0
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Linux
- 3
- The Wikimedia Foundation Mediawiki - GrowthExperiments Exte…
- 2
- themeisle PPOM – Product Addons & Custom Fields for WooComm…
- 2
- wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- 2
- 10Web Map Builder for Google Maps
- 1
- Apache Software Foundation org.apache.geode:geode-web · org…
- 1
- cloughit Async JavaScript
- 1
- creative-solutions-1 GSpeech TTS – WordPress Text To Speech…
- 1
- cyberlord92 PowerBI Embed Reports
- 1
- Dan Coulter Flickr Gallery
- 1
Critical 4
- CVE-2025-11391PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Uploadthemeisle PPOM – Product Addons & Custom Fields for WooComm…
- CVE-2017-20208RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injectionmetagauss RegistrationMagic – Custom Registration Forms, Us…
- CVE-2017-20207Flickr Gallery <= 1.5.2 - Unauthenticated PHP Object InjectionDan Coulter Flickr Gallery
- CVE-2017-20206Appointments <= 2.2.1 - Unauthenticated PHP Object Injectionwpmudev Appointments
High 6
- CVE-2025-47410Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target…Apache Software Foundation org.apache.geode:geode-web · org…
- CVE-2025-9890Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Executionmndpsingh287 Theme Editor
- CVE-2025-5555Nixdorf Wincor PORT IO Driver IOCTL wnport.sys sub_11100 stack-based overflowNixdorf Wincor PORT IO Driver
- CVE-2025-11691PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injectionthemeisle PPOM – Product Addons & Custom Fields for WooComm…
- CVE-2025-11517Event Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypassstellarwp Event Tickets and Registration
- CVE-2020-3685310WebMapBuilder <= 1.0.63 - Unauthenticated Stored Cross-Site Scripting via Plugin Settings Change10Web Map Builder for Google Maps
Medium, low and unrated 32
- CVE-2025-11926Related Posts Lite <= 1.12 - Authenticated (Admin+) Stored Cross-Site Scriptingwpdreams Related Posts Lite
- CVE-2025-40003net: mscc: ocelot: Fix use-after-free caused by cyclic delayed workLinux
- CVE-2025-40002thunderbolt: Fix use-after-free in tb_dp_dprx_workLinux
- CVE-2025-40001scsi: mvsas: Fix use-after-free bugs in mvs_work_queueLinux
- CVE-2025-10750PowerBI Embed Reports <= 1.2.0 - Unauthenticated Sensitive Information Disclosurecyberlord92 PowerBI Embed Reports
- CVE-2025-11256Kognetiks Chatbot <= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation ErasingKognetiks Chatbot for WordPress
- CVE-2025-11372LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulationthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2025-11270Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site…wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2025-11519Image optimization service by Optimole <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media OffloadOptimole – Optimize Images in Real Time
- CVE-2025-11510FileBird <= 6.4.9 - Improper Authorization to Authenticated (Author+) Settings Resetninjateam FileBird – WordPress Media Library Folders & File…
- CVE-2025-9562Redirection for Contact Form 7 <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcodethemeisle Redirection for Contact Form
- CVE-2025-11703WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoningwpgmaps WP Go Maps
- CVE-2025-10006WPBakery Page Builder <= 8.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingWPBakery Page Builder
- CVE-2025-10187GSpeech TTS – WordPress Text To Speech Plugin <= 3.17.13 - Authenticated (Admin+) SQL injectioncreative-solutions-1 GSpeech TTS – WordPress Text To Speech…
- CVE-2025-11741WPC Smart Quick View for WooCommerce <= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposurewpclever WPC Smart Quick View for WooCommerce
- CVE-2025-11742WPC Smart Wishlist for WooCommerce <= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information Exposurewpclever WPC Smart Wishlist for WooCommerce
- CVE-2025-11857XX2WP Integration Tools <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingmxp XX2WP Integration Tools
- CVE-2025-11738Media Library Assistant <= 3.29 - Unauthenticated Limited File Readdglingren Media Library Assistant
- CVE-2025-11937Stored XSS through a system message in SecurePollThe Wikimedia Foundation Mediawiki - SecurePoll Extension
- CVE-2025-62666DoS vector through the cirrusbuilddoc query APIThe Wikimedia Foundation Mediawiki - CirrusSearch Extension
- CVE-2025-62667Stored XSS through article extracts in GrowthExperimentsThe Wikimedia Foundation Mediawiki - GrowthExperiments Exte…
- CVE-2025-62668Insufficient permission checks in action=growthsetmentorThe Wikimedia Foundation Mediawiki - GrowthExperiments Exte…
- CVE-2025-62669UserInfoCard: activeLocalBlocksAllWikis does not do permissions checksThe Wikimedia Foundation Mediawiki - CentralAuth Extension
- CVE-2025-62670Stored XSS through a system message in FlexDiagramsThe Wikimedia Foundation Mediawiki - FlexDiagrams Extension
- CVE-2025-11361Essential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request Forgerywpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
Show all 32 entriesShow fewer entries
- CVE-2025-62671Stored XSS through wikitext in CargoThe Wikimedia Foundation Mediawiki - Cargo Extension · medi…
- CVE-2025-62662Stored XSS through system messages in AdvancedSearchThe Wikimedia Foundation Mediawiki - AdvancedSearch Extensi…
- CVE-2025-62663Stored XSS through a system message in UploadWizardThe Wikimedia Foundation Mediawiki - UploadWizard Extension
- CVE-2025-62664Stored XSS through a system message in ImageRatingThe Wikimedia Foundation Mediawiki - ImageRating Extension
- CVE-2025-62665Stored XSS through system messages in Skin:BlueSkyWikimedia Foundation Mediawiki - Skin:BlueSky
- CVE-2020-36854Async JavaScript <= 2.19.07.14 - Authenticated (Subscriber+) Stored Cross-Site Scriptingcloughit Async JavaScript
- CVE-2025-11378ShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/ExportShortPixel Image Optimizer – Optimize Images, Convert WebP…