# CVEs published 2025-01-07

348 CVEs were published on January 7, 2025: 23 critical, 103 high. Days are UTC.

- [CVE-2018-4301](https://cve.now/CVE-2018-4301.md): This issue is fixed in SCSSU-201801. (CVSS 9.8, Apple Smart Card Services)
- [CVE-2025-22133](https://cve.now/CVE-2025-22133.md): WeGIA Allows Arbitrary File Upload with Remote Code Execution (RCE) (CVSS 10.0, nilsonLazarin WeGIA)
- [CVE-2025-22132](https://cve.now/CVE-2025-22132.md): WeGIA has a Cross-Site Scripting (XSS) in File Upload Field (CVSS 8.3, nilsonLazarin WeGIA)
- [CVE-2025-0218](https://cve.now/CVE-2025-0218.md): pgAgent scheduled batch job scripts are created in a predictable temporary directory potentially allowing a denial of service (CVSS 5.5, pgAgent)
- [CVE-2025-0301](https://cve.now/CVE-2025-0301.md): code-projects Online Book Shop subcat.php cross site scripting (CVSS 5.3, code-projects Online Book Shop)
- [CVE-2024-54007](https://cve.now/CVE-2024-54007.md): Authenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client Bridge (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE Aruba Networking 501 W…)
- [CVE-2024-54006](https://cve.now/CVE-2024-54006.md): Authenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client Bridge (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE Aruba Networking 501 W…)
- [CVE-2025-0300](https://cve.now/CVE-2025-0300.md): code-projects Online Book Shop subcat.php sql injection (CVSS 5.3, code-projects Online Book Shop)
- [CVE-2025-22306](https://cve.now/CVE-2025-22306.md): WordPress Link Whisper Free plugin \<= 0.7.7 - Sensitive Data Exposure vulnerability (CVSS 5.3, Spencer Haws Link Whisper Free)
- [CVE-2025-22363](https://cve.now/CVE-2025-22363.md): WordPress Allada T-shirt Designer for Woocommerce plugin \<= 1.1 - Broken Access Control vulnerability (CVSS 5.3, Hermann LAHAMI Allada T-shirt Designer for Woocommerce)
- [CVE-2025-22296](https://cve.now/CVE-2025-22296.md): WordPress Hash Elements plugin \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, hashthemes Hash Elements)
- [CVE-2025-22319](https://cve.now/CVE-2025-22319.md): WordPress MashShare plugin \<= 4.0.47 - Broken Access Control vulnerability (CVSS 4.3, DearHive Social Media Share Buttons | MashShare)
- [CVE-2025-22334](https://cve.now/CVE-2025-22334.md): WordPress Education LMS theme \<= 0.0.7 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, FilaThemes Education LMS)
- [CVE-2024-12429](https://cve.now/CVE-2024-12429.md): An attacker who successfully exploited these vulnerabilities could grant read access to files. (CVSS 5.1, ABB AC500)
- [CVE-2025-22354](https://cve.now/CVE-2025-22354.md): WordPress Digi Store theme \<= 1.1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Code Themes Digi Store)
- [CVE-2025-22365](https://cve.now/CVE-2025-22365.md): WordPress EMC2 Alert Boxes Plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Eric McNiece EMC2 Alert Boxes)
- [CVE-2025-22500](https://cve.now/CVE-2025-22500.md): WordPress Alpha Price Table For Elementor plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ali Ali Alpha Price Table For Elementor)
- [CVE-2025-22350](https://cve.now/CVE-2025-22350.md): WordPress Indeed Ultimate Learning Pro plugin \<= 3.9 - SQL Injection vulnerability (CVSS 7.6, WpIndeed Ultimate Learning Pro)
- [CVE-2025-22621](https://cve.now/CVE-2025-22621.md): Privilege escalation for users who hold the “splunk\_app\_soar“ role in the Splunk App for SOAR (CVSS 6.4, Splunk App for SOAR)
- [CVE-2024-56270](https://cve.now/CVE-2024-56270.md): WordPress WP SecureSubmit plugin \<= 1.5.20 - Sensitive Data Exposure vulnerability (CVSS 5.3, WP SecureSubmit)
- [CVE-2024-56272](https://cve.now/CVE-2024-56272.md): WordPress Hide Category by User Role for WooCommerce plugin \<= 2.1.1 - Broken Access Control vulnerability (CVSS 4.3, ThemeSupport Hide Category by User Role for WooCommerce)
- [CVE-2025-0299](https://cve.now/CVE-2025-0299.md): code-projects Online Book Shop search\_result.php sql injection (CVSS 5.3, code-projects Online Book Shop)
- [CVE-2024-12430](https://cve.now/CVE-2024-12430.md): An attacker who successfully exploited these vulnerabilities could cause enable command execution. (CVSS 7.3, ABB AC500)
- [CVE-2024-40749](https://cve.now/CVE-2024-40749.md): \[20250103\] - Core - Read ACL violation in multiple core views (CVSS 7.5, Joomla! Project Joomla! CMS)
- [CVE-2024-40747](https://cve.now/CVE-2024-40747.md): \[20250101\] - Core - XSS vectors in module chromes (CVSS 6.1, Joomla! Project Joomla! CMS)
- [CVE-2024-40748](https://cve.now/CVE-2024-40748.md): \[20250102\] - Core - XSS vector in the id attribute of menu lists (CVSS 7.5, Joomla! Project Joomla! CMS)
- [CVE-2024-8361](https://cve.now/CVE-2024-8361.md): DoS caused due to wrong hash length returned for SHA2/224 algorithm (CVSS 7.5, silabs.com WiSeConnect SDK)
- [CVE-2025-0247](https://cve.now/CVE-2025-0247.md): Memory safety bugs fixed in Firefox 134 and Thunderbird 134 (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-0243](https://cve.now/CVE-2025-0243.md): Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6 (CVSS 5.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-0242](https://cve.now/CVE-2025-0242.md): Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-0241](https://cve.now/CVE-2025-0241.md): Memory corruption when using JavaScript Text Segmentation (CVSS 7.7, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-0240](https://cve.now/CVE-2025-0240.md): Compartment mismatch when parsing JavaScript JSON module (CVSS 4.0, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-0239](https://cve.now/CVE-2025-0239.md): Alt-Svc ALPN validation failure when redirected (CVSS 4.0, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-0238](https://cve.now/CVE-2025-0238.md): Use-after-free when breaking lines in text (CVSS 5.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-0237](https://cve.now/CVE-2025-0237.md): WebChannel APIs susceptible to confused deputy attack (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-0246](https://cve.now/CVE-2025-0246.md): Address bar spoofing using an invalid protocol scheme on Firefox for Android (CVSS 6.5, Mozilla Firefox)
- [CVE-2025-0245](https://cve.now/CVE-2025-0245.md): Lock screen setting bypass in Firefox Focus for Android (CVSS 3.3, Mozilla Firefox)
- [CVE-2025-0244](https://cve.now/CVE-2025-0244.md): Address bar spoofing using an invalid protocol scheme on Firefox for Android (CVSS 5.3, Mozilla Firefox)
- [CVE-2022-22363](https://cve.now/CVE-2022-22363.md): IBM Cognos Controller information disclosure (CVSS 4.3, IBM Controller · IBM Cognos Controller)
- [CVE-2021-20455](https://cve.now/CVE-2021-20455.md): IBM Cognos Controller information disclosure (CVSS 3.7, IBM Controller · IBM Cognos Controller)
- [CVE-2024-40702](https://cve.now/CVE-2024-40702.md): IBM Cognos Controller improper certificate validation (CVSS 8.2, IBM Controller · IBM Cognos Controller)
- [CVE-2025-0298](https://cve.now/CVE-2025-0298.md): code-projects Online Book Shop process\_login.php sql injection (CVSS 5.3, code-projects Online Book Shop)
- [CVE-2024-28778](https://cve.now/CVE-2024-28778.md): IBM Cognos Controller information disclosure (CVSS 6.5, IBM Controller · IBM Cognos Controller)
- [CVE-2024-25037](https://cve.now/CVE-2024-25037.md): IBM Cognos Controller information disclosure (CVSS 4.3, IBM Controller · IBM Cognos Controller)
- [CVE-2025-21624](https://cve.now/CVE-2025-21624.md): ClipBucket V5 Playlist Cover File Upload to Remote Code Execution (CVSS 9.8, MacWarrior clipbucket-v5)
- [CVE-2025-21623](https://cve.now/CVE-2025-21623.md): ClipBucket V5 Unauthenticated Template Directory Update to Denial-of-Service (CVSS 7.5, MacWarrior clipbucket-v5)
- [CVE-2025-21622](https://cve.now/CVE-2025-21622.md): ClipBucket V5 Avatar URL Path Traversal to Arbitrary File Delete (CVSS 7.5, MacWarrior clipbucket-v5)
- [CVE-2024-52813](https://cve.now/CVE-2024-52813.md): matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity (CVSS 4.3, matrix-org matrix-rust-sdk · matrix-sdk-crypto)
- [CVE-2025-0297](https://cve.now/CVE-2025-0297.md): code-projects Online Book Shop detail.php sql injection (CVSS 5.3, code-projects Online Book Shop)
- [CVE-2024-53800](https://cve.now/CVE-2024-53800.md): WordPress Rezgo Online Booking plugin \<= 4.17 - Local File Inclusion vulnerability (CVSS 8.1, Rezgo)
- [CVE-2024-56056](https://cve.now/CVE-2024-56056.md): WordPress SimpleCharm Theme \<= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kmfoysal06 SimpleCharm)
- [CVE-2025-22294](https://cve.now/CVE-2025-22294.md): WordPress Custom Field For WP Job Manager plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, theme funda Custom Field For WP Job Manager)
- [CVE-2025-22335](https://cve.now/CVE-2025-22335.md): WordPress Opencart Product in WP plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, rajib.dewan Opencart Product in WP)
- [CVE-2025-22338](https://cve.now/CVE-2025-22338.md): WordPress WP-tagMaker plugin \<= 0.2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, lich\_wang WP-tagMaker)
- [CVE-2025-22502](https://cve.now/CVE-2025-22502.md): WordPress MindValley Super PageMash Plugin \<= 1.1 - SQL Injection vulnerability (CVSS 7.6, MindValley Super PageMash)
- [CVE-2025-22503](https://cve.now/CVE-2025-22503.md): WordPress Admin debug wordpress – enable debug Plugin \<= 1.0.13 - Cross Site Request Forgery vulnerability (CVSS 4.3, digitalzoomstudio Admin debug wordpress – enable debug)
- [CVE-2025-22507](https://cve.now/CVE-2025-22507.md): WordPress WPMU Prefill Post Plugin \<= 1.02 - SQL Injection vulnerability (CVSS 7.6, iDo8p WPMU Prefill Post)
- [CVE-2025-22511](https://cve.now/CVE-2025-22511.md): WordPress Slides & Presentations Plugin \<= 0.0.39 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ella Van Durpe Slides & Presentations)
- [CVE-2025-22512](https://cve.now/CVE-2025-22512.md): WordPress Help Scout Plugin \<= 6.5.6 - Broken Access Control vulnerability (CVSS 4.3, BoldGrid Help Scout)
- [CVE-2025-22515](https://cve.now/CVE-2025-22515.md): WordPress Show Google Analytics widget plugin \<= 1.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Simon Show Google Analytics widget)
- [CVE-2025-22516](https://cve.now/CVE-2025-22516.md): WordPress Metadata SEO plugin \<= 2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, hpinfosys Metadata SEO)
- [CVE-2025-22517](https://cve.now/CVE-2025-22517.md): WordPress List Pages at Depth plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ben Huson List Pages at Depth)
- [CVE-2025-22518](https://cve.now/CVE-2025-22518.md): WordPress Justified Image Gallery plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PluginsPoint Justified Image Gallery)
- [CVE-2025-22519](https://cve.now/CVE-2025-22519.md): WordPress eDoc Easy Tables Plugin \<= 1.29 - SQL Injection vulnerability (CVSS 8.5, jerodmoore eDoc Easy Tables)
- [CVE-2025-22520](https://cve.now/CVE-2025-22520.md): WordPress Tock Widget Plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Tock Widget)
- [CVE-2025-22522](https://cve.now/CVE-2025-22522.md): WordPress SingSong plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, roya khosravi SingSong)
- [CVE-2025-22524](https://cve.now/CVE-2025-22524.md): WordPress فرم ساز فرم افزار Plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, formafzar فرم ساز فرم افزار)
- [CVE-2025-22525](https://cve.now/CVE-2025-22525.md): WordPress Donation Block For PayPal Plugin \<= 2.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Bharat Kambariya Donation Block For PayPal)
- [CVE-2025-22528](https://cve.now/CVE-2025-22528.md): WordPress Huurkalender WP Plugin \<= 1.5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Huurkalender.nl Huurkalender WP)
- [CVE-2025-22529](https://cve.now/CVE-2025-22529.md): WordPress WE Blocks \<= 1.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wordpresteem WE Blocks)
- [CVE-2025-22530](https://cve.now/CVE-2025-22530.md): WordPress 아임포트 결제버튼 생성 플러그인 plugin \<= 1.1.19 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PORTONE 아임포트 결제버튼 생성 플러그인)
- [CVE-2025-22531](https://cve.now/CVE-2025-22531.md): WordPress Urdu Formatter – Shamil plugin \<= 0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, M Bilal M Urdu Formatter – Shamil)
- [CVE-2025-22532](https://cve.now/CVE-2025-22532.md): WordPress Simple Photo Sphere plugin \<= 0.0.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, snagysandor Simple Photo Sphere)
- [CVE-2025-22533](https://cve.now/CVE-2025-22533.md): WordPress WOOEXIM Plugin \<= 5.0.0 - SQL Injection vulnerability (CVSS 7.6, bulktheme WOOEXIM)
- [CVE-2025-22534](https://cve.now/CVE-2025-22534.md): WordPress Slides & Presentations Plugin \<= 0.0.39 - Broken Access Control vulnerability (CVSS 5.4, Ella Van Durpe Slides & Presentations)
- [CVE-2025-22536](https://cve.now/CVE-2025-22536.md): WordPress WP Music Player Plugin \<= 1.3 - SQL Injection vulnerability (CVSS 7.6, hiren.sabd WP Music Player)
- [CVE-2025-22538](https://cve.now/CVE-2025-22538.md): WordPress Virtual Bot Plugin \<= 1.0.0 - CSRF Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ofek Nakar Virtual Bot)
- [CVE-2025-22541](https://cve.now/CVE-2025-22541.md): WordPress WP Delete Post Copies plugin \<= 5.5 - Broken Access Control vulnerability (CVSS 5.4, etruel WP Delete Post Copies)
- [CVE-2025-22543](https://cve.now/CVE-2025-22543.md): WordPress ST Gallery WP plugin \<= 1.0.8 - Settings Change vulnerability (CVSS 5.4, beautifultemplates ST Gallery WP)
- [CVE-2025-22544](https://cve.now/CVE-2025-22544.md): WordPress Mind Doodle Visual Sitemaps & Tasks plugin \<= 1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Mind Doodle Visual Sitemaps & Tasks)
- [CVE-2025-22545](https://cve.now/CVE-2025-22545.md): WordPress iframe to embed plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sw.galati iframe to embed)
- [CVE-2025-22546](https://cve.now/CVE-2025-22546.md): WordPress jQuery TwentyTwenty plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Obaid Hossain jQuery TwentyTwenty)
- [CVE-2025-22547](https://cve.now/CVE-2025-22547.md): WordPress JK Html To Pdf plugin \<= 1.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, jaykrishnang JK Html To Pdf)
- [CVE-2025-22548](https://cve.now/CVE-2025-22548.md): WordPress ldap\_login\_password\_and\_role\_manager plugin \<= 1.0.12 - CSRF to Stored XSS vulnerability (CVSS 7.1, frankkoenen ldap\_login\_password\_and\_role\_manager)
- [CVE-2025-22549](https://cve.now/CVE-2025-22549.md): WordPress WP Github plugin \<= 1.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, seinoxygen WP Github)
- [CVE-2025-22550](https://cve.now/CVE-2025-22550.md): WordPress AddFunc Mobile Detect plugin \<= 3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Joe Rhoney AddFunc Mobile Detect)
- [CVE-2025-22551](https://cve.now/CVE-2025-22551.md): WordPress Boot-Modal plugin \<= 1.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, albedo0 Boot-Modal)
- [CVE-2025-22552](https://cve.now/CVE-2025-22552.md): WordPress Affiliate Disclosure Statement plugin \<= 0.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, bnielsen Affiliate Disclosure Statement)
- [CVE-2025-22554](https://cve.now/CVE-2025-22554.md): WordPress Video Embed Optimizer plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, fdfranklin06 Video Embed Optimizer)
- [CVE-2025-22555](https://cve.now/CVE-2025-22555.md): WordPress Smoothness Slider Shortcode plugin \<= v1.2.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, njshofe Smoothness Slider Shortcode)
- [CVE-2025-22556](https://cve.now/CVE-2025-22556.md): WordPress Norse Rune Oracle plugin \<= 1.4.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, WP CMS Ninja Norse Rune Oracle Plugin)
- [CVE-2025-22557](https://cve.now/CVE-2025-22557.md): WordPress News Publisher Autopilot plugin \<= 2.1.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, cdowp News Publisher Autopilot)
- [CVE-2025-22558](https://cve.now/CVE-2025-22558.md): WordPress mcjh button shortcode plugin \<= 1.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Marcus C. J. Hartmann mcjh button shortcode)
- [CVE-2025-22559](https://cve.now/CVE-2025-22559.md): WordPress TubePress.NET Plugin \<= 4.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, TubePress.NET)
- [CVE-2025-22560](https://cve.now/CVE-2025-22560.md): WordPress Saoshyant Page Builder plugin \<= 3.8 - Broken Access Control vulnerability (CVSS 5.3, saoshyant1994 Saoshyant Page Builder)
- [CVE-2025-22562](https://cve.now/CVE-2025-22562.md): WordPress Title Experiments Free plugin \<= 9.0.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, kbowson Title Experiments Free)
- [CVE-2025-22563](https://cve.now/CVE-2025-22563.md): WordPress Pretty Urls Plugin \<= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, faaiq Pretty Url)
- [CVE-2025-22571](https://cve.now/CVE-2025-22571.md): WordPress Instabot plugin \<= 1.10 - CSRF to Stored XSS vulnerability (CVSS 7.1, Instabot)
- [CVE-2025-22572](https://cve.now/CVE-2025-22572.md): WordPress Legacy ePlayer plugin \<= 0.9.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Brian Legacy ePlayer)
- [CVE-2025-22573](https://cve.now/CVE-2025-22573.md): WordPress Icons Enricher plugin \<= 1.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, copist Icons Enricher)
- [CVE-2025-22574](https://cve.now/CVE-2025-22574.md): WordPress ICS Button plugin \<= 0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Cleanshooter ICS Button)
- [CVE-2025-22577](https://cve.now/CVE-2025-22577.md): WordPress Able Player plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Damion Armentrout Able Player)
- [CVE-2025-22578](https://cve.now/CVE-2025-22578.md): WordPress WP Cookie plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, aazztech WP Cookie)
- [CVE-2025-22579](https://cve.now/CVE-2025-22579.md): WordPress WP Header Notification plugin \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Arefly WP Header Notification)
- [CVE-2025-22580](https://cve.now/CVE-2025-22580.md): WordPress Biltorvet Dealer Tools plugin \<= 1.0.22 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Auto IT Biltorvet Dealer Tools)
- [CVE-2025-22581](https://cve.now/CVE-2025-22581.md): WordPress Arcade Ready plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Bytephp Arcade Ready)
- [CVE-2025-22582](https://cve.now/CVE-2025-22582.md): WordPress Uptime Robot plugin \<= 0.1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, Scott Nelle Uptime Robot)
- [CVE-2025-22584](https://cve.now/CVE-2025-22584.md): WordPress Timeline Pro plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PluginsPoint Timeline Pro)
- [CVE-2025-22585](https://cve.now/CVE-2025-22585.md): WordPress Ultimate Image Hover Effects plugin \<= 1.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, themebon Ultimate Image Hover Effects)
- [CVE-2025-22589](https://cve.now/CVE-2025-22589.md): WordPress Quote Tweet plugin \<= 0.7 - CSRF to Stored XSS vulnerability (CVSS 7.1, bozdoz Quote Tweet)
- [CVE-2025-22590](https://cve.now/CVE-2025-22590.md): WordPress Prayer Times Anywhere plugin \<= 2.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, mmrs151 Prayer Times Anywhere)
- [CVE-2025-22591](https://cve.now/CVE-2025-22591.md): WordPress 1003 Mortgage Application plugin \<= 1.87 - Broken Access Control vulnerability (CVSS 4.3, 8blocks 1003 Mortgage Application)
- [CVE-2025-22592](https://cve.now/CVE-2025-22592.md): WordPress 1003 Mortgage Application plugin \<= 1.87 - Broken Access Control vulnerability (CVSS 7.5, 8blocks 1003 Mortgage Application)
- [CVE-2025-22593](https://cve.now/CVE-2025-22593.md): WordPress Laika Pedigree Tree plugin \<= 1.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, burria Laika Pedigree Tree)
- [CVE-2024-11681](https://cve.now/CVE-2024-11681.md): Remote Code Execution in MacPorts (CVSS 6.9, MacPorts)
- [CVE-2025-0296](https://cve.now/CVE-2025-0296.md): code-projects Online Book Shop booklist.php sql injection (CVSS 5.3, code-projects Online Book Shop)
- [CVE-2025-0295](https://cve.now/CVE-2025-0295.md): code-projects Online Book Shop booklist.php cross site scripting (CVSS 5.3, code-projects Online Book Shop)
- [CVE-2025-0294](https://cve.now/CVE-2025-0294.md): SourceCodester Home Clean Services Management System process.php sql injection (CVSS 5.1, SourceCodester Home Clean Services Management System)
- [CVE-2024-12131](https://cve.now/CVE-2024-12131.md): WP Job Portal – A Complete Recruitment System for Company or Job Board website \<= 2.2.5- Authenticated (Subscriber+) Insecure Direct Object Reference (CVSS 4.3, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2024-12738](https://cve.now/CVE-2024-12738.md): User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor \<= 3.12.9 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1, cozmoslabs User Profile Builder – Beautiful User Registrati…)
- [CVE-2024-45100](https://cve.now/CVE-2024-45100.md): IBM Security QRadar EDR denial of service (CVSS 4.9, IBM Security QRadar EDR)
- [CVE-2024-12426](https://cve.now/CVE-2024-12426.md): URL fetching can be used to exfiltrate arbitrary INI file values and environment variables (CVSS 6.7, The Document Foundation LibreOffice)
- [CVE-2024-45640](https://cve.now/CVE-2024-45640.md): IBM Security QRadar EDR information disclosure (CVSS 5.3, IBM Security QRadar EDR)
- [CVE-2024-52893](https://cve.now/CVE-2024-52893.md): IBM Concert Software information disclosure (CVSS 5.3, IBM Concert Software)
- [CVE-2024-52366](https://cve.now/CVE-2024-52366.md): IBM Concert Software information disclosure (CVSS 5.9, IBM Concert Software)
- [CVE-2024-52891](https://cve.now/CVE-2024-52891.md): IBM Concert Software log manipulation (CVSS 5.4, IBM Concert Software)
- [CVE-2024-52367](https://cve.now/CVE-2024-52367.md): IBM Concert Software information disclosure (CVSS 5.3, IBM Concert Software)
- [CVE-2024-12425](https://cve.now/CVE-2024-12425.md): Path traversal leading to arbitrary .ttf file write (CVSS 2.4, The Document Foundation LibreOffice)
- [CVE-2024-11826](https://cve.now/CVE-2024-11826.md): Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress \<= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mdmag Quill Forms | Conversational Multi Step Forms, Survey…)
- [CVE-2024-12711](https://cve.now/CVE-2024-12711.md): RSVP and Event Management \<= 2.7.13 - Missing Authorization (CVSS 5.3, wpchill RSVP and Event Management)
- [CVE-2024-12532](https://cve.now/CVE-2024-12532.md): BWD Elementor Addons \<= 4.3.18 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates (CVSS 4.3, bestwpdeveloper BWD Elementor Addons)
- [CVE-2024-12033](https://cve.now/CVE-2024-12033.md): Jupiter X Core \<= 4.8.5 - Missing Authorization to Authenticated Library Sync (CVSS 4.3, artbees Jupiter X Core)
- [CVE-2024-12316](https://cve.now/CVE-2024-12316.md): Jupiter X Core \<= 4.8.5 - Missing Authorization to Unauthenticated Popup Template Export (CVSS 5.3, artbees Jupiter X Core)
- [CVE-2024-43243](https://cve.now/CVE-2024-43243.md): WordPress JobBoard Job listing plugin \<= 1.2.6 - Arbitrary File Upload vulnerability (CVSS 10.0, themeglow JobBoard Job listing)
- [CVE-2024-49222](https://cve.now/CVE-2024-49222.md): WordPress WPGuppy plugin \<= 1.1.0 - PHP Object Injection vulnerability (CVSS 9.8, AmentoTech Private Limited WPGuppy)
- [CVE-2024-49249](https://cve.now/CVE-2024-49249.md): WordPress SMSA Shipping plugin \<= 2.3 - Arbitrary File Deletion vulnerability (CVSS 8.6, SMSA Express SMSA Shipping)
- [CVE-2024-49294](https://cve.now/CVE-2024-49294.md): WordPress WpBusTicketly plugin \<= 5.4.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, magepeopleteam Bus Ticket Booking with Seat Reservation)
- [CVE-2024-49633](https://cve.now/CVE-2024-49633.md): WordPress DirectoryPress plugin \<= 3.6.19 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Designinvento DirectoryPress)
- [CVE-2024-49644](https://cve.now/CVE-2024-49644.md): WordPress Accessibility by AllAccessible plugin \<= 1.3.4 - Privilege Escalation vulnerability (CVSS 8.8, Accessibility by AllAccessible)
- [CVE-2024-49649](https://cve.now/CVE-2024-49649.md): WordPress Build App Online plugin \<= 1.0.23 - Local File Inclusion vulnerability (CVSS 9.8, hakeemnala Build App Online)
- [CVE-2024-51651](https://cve.now/CVE-2024-51651.md): WordPress CubeWP Forms plugin \<= 1.1.10 - Broken Access Control vulnerability (CVSS 5.3, Imran Tauqeer CubeWP Forms)
- [CVE-2024-51700](https://cve.now/CVE-2024-51700.md): WordPress NAVER Analytics plugin \<= 0.9 - CSRF to Stored XSS vulnerability (CVSS 7.1, eutrue NAVER Analytics)
- [CVE-2024-51715](https://cve.now/CVE-2024-51715.md): WordPress ClickWhale plugin \<= 2.4.1 - SQL Injection vulnerability (CVSS 8.5, ClickWhale)
- [CVE-2024-56271](https://cve.now/CVE-2024-56271.md): WordPress WP SecureSubmit plugin \<= 1.5.20 - Broken Access Control vulnerability (CVSS 4.3, WP SecureSubmit)
- [CVE-2024-56273](https://cve.now/CVE-2024-56273.md): WordPress WPvivid Backup plugin \<= 0.9.106 - Broken Access Control vulnerability (CVSS 4.3, wpvividplugins WPvivid Backup and Migration)
- [CVE-2024-56274](https://cve.now/CVE-2024-56274.md): WordPress Astra Widgets plugin \<= 1.2.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Brainstorm Force Astra Widgets)
- [CVE-2024-56275](https://cve.now/CVE-2024-56275.md): WordPress Envato Elements plugin \<= 2.0.14 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.1, Envato Elements)
- [CVE-2024-56276](https://cve.now/CVE-2024-56276.md): WordPress WPForms Lite plugin \<= 1.9.2.2 - Broken Access Control vulnerability (CVSS 4.3, Syed Balkhi Contact Form by WPForms)
- [CVE-2024-56278](https://cve.now/CVE-2024-56278.md): WordPress WP Ultimate Exporter plugin \<= 2.9.1 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, Smackcoders Inc., WP Ultimate Exporter)
- [CVE-2024-56279](https://cve.now/CVE-2024-56279.md): WordPress Compact WP Audio Player plugin \<= 1.9.14 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4, mra13 Compact WP Audio Player)
- [CVE-2024-56280](https://cve.now/CVE-2024-56280.md): WordPress WPGuppy plugin \<= 1.1.0 - Privilege Escalation vulnerability (CVSS 8.8, AmentoTech Private Limited WPGuppy)
- [CVE-2024-56281](https://cve.now/CVE-2024-56281.md): WordPress 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 plugin \<= 5.2.0 - Local File Inclusion vulnerability (CVSS 7.5, codemstory 워드프레스 결제 심플페이)
- [CVE-2024-56282](https://cve.now/CVE-2024-56282.md): WordPress WPMozo Addons Lite for Elementor plugin \<= 1.1.0 - Local File Inclusion vulnerability (CVSS 7.5, Elicus WPMozo Addons Lite for Elementor)
- [CVE-2024-56283](https://cve.now/CVE-2024-56283.md): WordPress Locatoraid Store Locator Plugin \<= 3.9.50 - PHP Object Injection vulnerability (CVSS 8.1, plainware Locatoraid Store Locator)
- [CVE-2024-56284](https://cve.now/CVE-2024-56284.md): WordPress SSL Wireless SMS Notification Plugin \<= 3.5.0 - SQL Injection vulnerability (CVSS 9.3, sslplugins SSL Wireless SMS Notification)
- [CVE-2024-56285](https://cve.now/CVE-2024-56285.md): WordPress WPBITS Addons For Elementor Page Builder plugin \<= 1.5.1 - Cross-Site Scripting vulnerability (CVSS 6.5, WPBITS Addons For Elementor Page Builder)
- [CVE-2024-56286](https://cve.now/CVE-2024-56286.md): WordPress Classic Addons – WPBakery Page Builder plugin \<= 3.0 - Local File Inclusion vulnerability (CVSS 7.5, webcodingplace Classic Addons – WPBakery Page Builder)
- [CVE-2024-56287](https://cve.now/CVE-2024-56287.md): WordPress WP jQuery DataTable Plugin \<= 4.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, AppJetty WP jQuery DataTable)
- [CVE-2024-56288](https://cve.now/CVE-2024-56288.md): WordPress WP Docs plugin \<= 2.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Fahad Mahmood WP Docs)
- [CVE-2024-56289](https://cve.now/CVE-2024-56289.md): WordPress Groundhogg plugin \<= 3.7.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Adrian Tobey Groundhogg)
- [CVE-2024-56290](https://cve.now/CVE-2024-56290.md): WordPress Multiple Shipping And Billing Address For Woocommerce Plugin \<= 1.2 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, silverplugins217 Multiple Shipping And Billing Address For…)
- [CVE-2024-56291](https://cve.now/CVE-2024-56291.md): WordPress PlainInventory – Inventory Management Plugin Plugin \<= 3.1.6 - PHP Object Injection vulnerability (CVSS 8.1, plainware PlainInventory)
- [CVE-2024-56292](https://cve.now/CVE-2024-56292.md): WordPress Email Reminders Plugin \<= 2.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, wpdevelop Email Reminders)
- [CVE-2024-56293](https://cve.now/CVE-2024-56293.md): WordPress AFI – The Easiest Integration Plugin \<= 1.95.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Nasir Ahmed Advanced Form Integration)
- [CVE-2024-56294](https://cve.now/CVE-2024-56294.md): WordPress Nexter Blocks plugin \<= 4.0.7 - Broken Access Control vulnerability (CVSS 6.4, POSIMYTH Nexter Blocks)
- [CVE-2024-56296](https://cve.now/CVE-2024-56296.md): WordPress Mang Board WP plugin \<= 1.8.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kitae Park Mang Board WP)
- [CVE-2024-56297](https://cve.now/CVE-2024-56297.md): WordPress Highlight plugin \<= 2.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, QuantumCloud Highlight)
- [CVE-2024-56298](https://cve.now/CVE-2024-56298.md): WordPress Pretty Simple Popup Builder Plugin \<= 1.0.9 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Rob @ 5 Star Plugins Pretty Simple Popup Builder)
- [CVE-2024-56299](https://cve.now/CVE-2024-56299.md): WordPress Notify Odoo plugin \<= 1.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Pektsekye Notify Odoo)
- [CVE-2024-56300](https://cve.now/CVE-2024-56300.md): WordPress Post/Page Copying Tool plugin \<= 2.0.0 - Sensitive Data Exposure vulnerability (CVSS 7.5, wpspin Post/Page Copying Tool)
- [CVE-2025-22261](https://cve.now/CVE-2025-22261.md): WordPress WP FullCalendar plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Marcus (aka @msykes) WP FullCalendar)
- [CVE-2025-22293](https://cve.now/CVE-2025-22293.md): WordPress Gutentor plugin \<= 3.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Gutentor)
- [CVE-2025-22297](https://cve.now/CVE-2025-22297.md): WordPress AI WP Writer plugin \<= 3.8.4.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, aipost AI WP Writer)
- [CVE-2025-22298](https://cve.now/CVE-2025-22298.md): WordPress Hive Support plugin \<= 1.1.6 - Broken Access Control vulnerability (CVSS 4.3, Hive Support)
- [CVE-2025-22299](https://cve.now/CVE-2025-22299.md): WordPress AI for SEO plugin \<= 1.2.9 - Broken Access Control vulnerability (CVSS 4.3, Space Codes AI for SEO)
- [CVE-2025-22300](https://cve.now/CVE-2025-22300.md): WordPress PixelYourSite plugin \<= 10.0.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, PixelYourSite – Your smart PIXEL (TAG) Manager)
- [CVE-2025-22301](https://cve.now/CVE-2025-22301.md): WordPress MyBookTable Bookstore by Stormhill Media plugin \<= 3.5.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, zookatron MyBookTable Bookstore)
- [CVE-2025-22302](https://cve.now/CVE-2025-22302.md): WordPress WP Wand plugin \<= 1.2.5 - Broken Access Control vulnerability (CVSS 5.3, WP Grids WP Wand)
- [CVE-2025-22303](https://cve.now/CVE-2025-22303.md): WordPress WP Mailster plugin \<= 1.8.17.0 - Sensitive Data Exposure vulnerability (CVSS 5.3, brandtoss WP Mailster)
- [CVE-2025-22304](https://cve.now/CVE-2025-22304.md): WordPress WP Visitor Statistics plugin \<= 7.5 - Broken Access Control vulnerability (CVSS 4.3, osama.esh WP Visitor Statistics)
- [CVE-2025-22305](https://cve.now/CVE-2025-22305.md): WordPress Hero Banner Ultimate plugin \<= 1.4.4 - Local File Inclusion vulnerability (CVSS 6.5, Essential Plugin Hero Banner Ultimate)
- [CVE-2025-22308](https://cve.now/CVE-2025-22308.md): WordPress Smart Custom FIelds plugin \<= 5.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Takashi Kitajima Smart Custom Fields)
- [CVE-2025-22309](https://cve.now/CVE-2025-22309.md): WordPress SpeakOut! Email Petitions plugin \<= 4.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RopeSwingHld SpeakOut! Email Petitions)
- [CVE-2025-22310](https://cve.now/CVE-2025-22310.md): WordPress TemplatesNext ToolKit plugin \<= 3.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, marsian TemplatesNext ToolKit)
- [CVE-2025-22312](https://cve.now/CVE-2025-22312.md): WordPress Thim Elementor Kit plugin \<= 1.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThimPress Thim Elementor Kit)
- [CVE-2025-22315](https://cve.now/CVE-2025-22315.md): WordPress Typing Text plugin \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPDeveloper Typing Text)
- [CVE-2025-22316](https://cve.now/CVE-2025-22316.md): WordPress WPBITS Addons For Elementor Page Builder plugin \<= 1.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WPBITS Addons For Elementor Page Builder)
- [CVE-2025-22320](https://cve.now/CVE-2025-22320.md): WordPress ProductDyno plugin \<= 1.0.24 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ProductDyno)
- [CVE-2025-22321](https://cve.now/CVE-2025-22321.md): WordPress ElementsCSS Addons for Elementor plugin \<= 1.0.8.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, TheInnovs ElementsCSS Addons for Elementor)
- [CVE-2025-22323](https://cve.now/CVE-2025-22323.md): WordPress Image Hover Effects for Elementor plugin \<= 1.0.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Liton Arefin Image Hover Effects for Elementor)
- [CVE-2025-22324](https://cve.now/CVE-2025-22324.md): WordPress OZ Canonical plugin \<= 0.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Andon Ivanov OZ Canonical)
- [CVE-2025-22325](https://cve.now/CVE-2025-22325.md): WordPress Autocompleter plugin \<= 1.3.5.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, nchankov Autocompleter)
- [CVE-2025-22326](https://cve.now/CVE-2025-22326.md): WordPress 5centsCDN plugin \<= 25.4.15 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, 5centsCDN)
- [CVE-2025-22327](https://cve.now/CVE-2025-22327.md): WordPress EO4WP plugin \<= 1.0.8.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Olaf Lederer EO4WP)
- [CVE-2025-22328](https://cve.now/CVE-2025-22328.md): WordPress Elevio plugin \<= 4.4.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Elevio by Dixa Elevio)
- [CVE-2025-22333](https://cve.now/CVE-2025-22333.md): WordPress Piotnet Addons For Elementor plugin \<= 2.4.31 - Cross-Site Scripting vulnerability (CVSS 6.5, piotnetdotcom Piotnet Addons For Elementor)
- [CVE-2025-22336](https://cve.now/CVE-2025-22336.md): WordPress Wizhi Multi Filters by Wenprise plugin \<= 1.8.6 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Amos Lee（一刀） Wizhi Multi Filters by Wenprise)
- [CVE-2025-22339](https://cve.now/CVE-2025-22339.md): WordPress Store Commerce theme \<= 1.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, athemeart Store Commerce)
- [CVE-2025-22342](https://cve.now/CVE-2025-22342.md): WordPress WP Simple Sitemap plugin \<= 0.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Jenst WP Simple Sitemap)
- [CVE-2025-22343](https://cve.now/CVE-2025-22343.md): WordPress wpSOL plugin \<= 1.2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, koter84 wpSOL)
- [CVE-2025-22347](https://cve.now/CVE-2025-22347.md): WordPress BSK Forms Blacklist plugin \<= 3.9 - CSRF to SQL Injection vulnerability (CVSS 8.2, bannersky BSK Forms Blacklist)
- [CVE-2025-22348](https://cve.now/CVE-2025-22348.md): WordPress DynamicTags plugin \<= 1.4.0 - SQL Injection vulnerability (CVSS 8.5, rtowebsites DynamicTags)
- [CVE-2025-22349](https://cve.now/CVE-2025-22349.md): WordPress WordPress Auction Plugin plugin \<= 3.7 - SQL Injection vulnerability (CVSS 7.6, WP Marka WordPress Auction Plugin)
- [CVE-2025-22351](https://cve.now/CVE-2025-22351.md): WordPress Contact Form 7 Database – CFDB7 plugin \<= 1.0.0 - SQL Injection vulnerability (CVSS 7.6, penguinarts Contact Form 7 Database – CFDB7)
- [CVE-2025-22352](https://cve.now/CVE-2025-22352.md): WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Plugin \<= 1.4.9 - SQL Injection vulnerability (CVSS 7.6, ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products,…)
- [CVE-2025-22353](https://cve.now/CVE-2025-22353.md): WordPress BVD Easy Gallery Manager plugin \<= 1.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, bvads BVD Easy Gallery Manager)
- [CVE-2025-22355](https://cve.now/CVE-2025-22355.md): WordPress Kikx Simple Post Author Filter plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, asokaaso2 Kikx Simple Post Author Filter)
- [CVE-2025-22357](https://cve.now/CVE-2025-22357.md): WordPress Target Notifications plugin \<= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpdever Target Notifications)
- [CVE-2025-22358](https://cve.now/CVE-2025-22358.md): WordPress Wp advertising management plugin \<= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Simone Marcon Wp advertising management)
- [CVE-2025-22359](https://cve.now/CVE-2025-22359.md): WordPress SyncFields plugin \<= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, pjfc SyncFields)
- [CVE-2025-22362](https://cve.now/CVE-2025-22362.md): WordPress WPAchievements Free Plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Daniel Bakovic WPAchievements Free)
- [CVE-2025-22364](https://cve.now/CVE-2025-22364.md): WordPress Ach Invoice App plugin \<= 1.0.1 - Local File Inclusion vulnerability (CVSS 7.5, Service Shogun Ach Invoice App)
- [CVE-2024-12699](https://cve.now/CVE-2024-12699.md): Service Box \<= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, themepoints Service Box)
- [CVE-2024-12152](https://cve.now/CVE-2024-12152.md): MIPL WC Multisite Sync \<= 1.1.5 - Unauthenticated Arbitrary File Download (CVSS 7.5, mulika MIPL Multistore Sync for WooCommerce. Sync Products,…)
- [CVE-2024-12719](https://cve.now/CVE-2024-12719.md): WordPress File Upload \<= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal (CVSS 4.3, nickboss Iptanus File Upload)
- [CVE-2024-54030](https://cve.now/CVE-2024-54030.md): Communication\_dsoftbus has an UAF vulnerability (CVSS 4.4, OpenHarmony)
- [CVE-2024-47398](https://cve.now/CVE-2024-47398.md): Liteos\_a has an out-of-bounds write vulnerability (CVSS 8.8, OpenHarmony)
- [CVE-2024-45070](https://cve.now/CVE-2024-45070.md): Liteos\_a has an out-of-bounds read vulnerability (CVSS 5.5, OpenHarmony)
- [CVE-2024-11627](https://cve.now/CVE-2024-11627.md): : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 thr (CVSS 6.8, Progress Sitefinity)
- [CVE-2024-11626](https://cve.now/CVE-2024-11626.md): Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerabilit (CVSS 8.4, Progress Software Sitefinity)
- [CVE-2024-11625](https://cve.now/CVE-2024-11625.md): Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from (CVSS 7.7, Progress Software Sitefinity)
- [CVE-2024-12516](https://cve.now/CVE-2024-12516.md): Coupon Plugin \<= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, vickydalmia Coupon Plugin)
- [CVE-2024-12077](https://cve.now/CVE-2024-12077.md): Booking Calendar and Booking Calendar Pro \<= Multiple Versions - Reflected Cross-Site Scripting via 'calendar\_id' (CVSS 6.1, wpdevart Booking calendar, Appointment Booking System · Boo…)
- [CVE-2024-12202](https://cve.now/CVE-2024-12202.md): Croma Music \<= 3.6 - Authenticated (Subscriber+) Arbitrary Options Update in ironMusic\_ajax (CVSS 8.8, IronTemplates Croma Music)
- [CVE-2024-10866](https://cve.now/CVE-2024-10866.md): Export Import Menus \<= 1.9.1 - Missing Authorization to Unauthenticated Menu Export (CVSS 5.3, akshay-menariya Export Import Menus)
- [CVE-2024-12437](https://cve.now/CVE-2024-12437.md): Marketplace Items \<= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, lumiblog Marketplace Items)
- [CVE-2024-12781](https://cve.now/CVE-2024-12781.md): Aurum - WordPress & WooCommerce Shopping Theme \<= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Demo Content Import (CVSS 4.3, Laborator Aurum - WordPress & WooCommerce Shopping Theme)
- [CVE-2024-11764](https://cve.now/CVE-2024-11764.md): Solar Wizard Lite \<= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, covertcommunication Solar Wizard Lite)
- [CVE-2024-12499](https://cve.now/CVE-2024-12499.md): WP jQuery DataTable \<= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, biztechc WP jQuery DataTable)
- [CVE-2024-12495](https://cve.now/CVE-2024-12495.md): Bootstrap Blocks for WP Editor v2 \<= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, virgial Bootstrap Blocks for WP Editor)
- [CVE-2024-9354](https://cve.now/CVE-2024-9354.md): Estatik Mortgage Calculator \<= 2.0.11 - Reflected Cross-Site Scripting (CVSS 6.1, Estatik Mortgage Calculator)
- [CVE-2024-9502](https://cve.now/CVE-2024-9502.md): Master Addons -- Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor \<= 2.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip Module (CVSS 6.4, litonice13 Master Addons For Elementor – Widgets, Extension…)
- [CVE-2024-12624](https://cve.now/CVE-2024-12624.md): Sina Extension for Elementor \<= 3.5.91 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Sina Image Differ (CVSS 6.4, shaonsina Sina Extension for Elementor)
- [CVE-2024-11725](https://cve.now/CVE-2024-11725.md): SMS Alert Order Notifications – WooCommerce \<= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…)
- [CVE-2024-11282](https://cve.now/CVE-2024-11282.md): Passster – Password Protect Pages and Content \<= 4.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3, wpchill Passster – Password Protect Pages and Content)
- [CVE-2024-9638](https://cve.now/CVE-2024-9638.md): Category Posts Widget \< 4.9.18 - Admin+ Stored XSS (CVSS 4.8, Category Posts Widget)
- [CVE-2024-8857](https://cve.now/CVE-2024-8857.md): WordPress Auction \<= 3.7 - Editor+ Stored XSS (CVSS 4.8, WordPress Auction Plugin)
- [CVE-2024-8855](https://cve.now/CVE-2024-8855.md): WordPress Auction \<= 3.7 - Editor+ SQL Injection (CVSS 9.8, WordPress Auction Plugin)
- [CVE-2024-11606](https://cve.now/CVE-2024-11606.md): Tabs Shortcode \<= 2.0.2 - Contributor+ XSS via Shortcode (CVSS 5.3, Tabs Shortcode)
- [CVE-2024-10562](https://cve.now/CVE-2024-10562.md): Form Maker by 10Web \< 1.15.31 - Admin+ Stored XSS (CVSS 2.7, Form Maker by 10Web)
- [CVE-2024-10102](https://cve.now/CVE-2024-10102.md): Photo Gallery, Images, Slider in Rbs Image Gallery \< 3.2.22 - Contributor+ Stored XSS (CVSS 2.7, Photo Gallery, Images, Slider in Rbs Image Gallery)
- [CVE-2024-7696](https://cve.now/CVE-2024-7696.md): Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tam (CVSS 6.3, Axis Communications AB AXIS Camera Station Pro)
- [CVE-2024-12384](https://cve.now/CVE-2024-12384.md): Binary MLM Woocommerce \<= 2.0 - Reflected Cross-Site Scripting via 'page' (CVSS 6.1, letscms Binary MLM For WooCommerce)
- [CVE-2024-11756](https://cve.now/CVE-2024-11756.md): SweepWidget Contests, Giveaways, Photo Contests, Competitions \<= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, SweepWidget – Contests, Giveaways, Sweepstakes & Photo Cont…)
- [CVE-2024-10536](https://cve.now/CVE-2024-10536.md): FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor \<= 6.0.0 - Missing Authorization to Authenticated (Subscriber+) Shortcode Export (CVSS 4.3, wpqode FancyPost – Post Blocks, Grids & Sliders for Block E…)
- [CVE-2024-11887](https://cve.now/CVE-2024-11887.md): Geo Content \<= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, geotargetly Geo Content)
- [CVE-2024-12440](https://cve.now/CVE-2024-12440.md): Candifly \<= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Candifly)
- [CVE-2024-12073](https://cve.now/CVE-2024-12073.md): Meteor Slides \<= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, jleuze Meteor Slides)
- [CVE-2024-12471](https://cve.now/CVE-2024-12471.md): Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator \<= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, postsaint Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusi…)
- [CVE-2024-12633](https://cve.now/CVE-2024-12633.md): JoomSport \<= 5.6.17 - Reflected Cross-Site Scripting via page (CVSS 7.1, beardev JoomSport – for Sports: Team & League, Football, Ho…)
- [CVE-2024-12383](https://cve.now/CVE-2024-12383.md): Binary MLM Woocommerce \<= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, letscms Binary MLM For WooCommerce)
- [CVE-2024-12438](https://cve.now/CVE-2024-12438.md): WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket \<= 4.75 - Reflected Cross-Site Scripting (CVSS 6.1, Digital Content Delivery (incl. DRM) by Flickrocket for Woo…)
- [CVE-2024-9702](https://cve.now/CVE-2024-9702.md): Social Rocket \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, socialrocket Social Rocket – Social Sharing Plugin)
- [CVE-2024-12535](https://cve.now/CVE-2024-12535.md): Host PHP Info \<= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure (CVSS 8.6, eflyjason Host PHP Info)
- [CVE-2024-12464](https://cve.now/CVE-2024-12464.md): Chatroll Live Chat \<= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Chatroll Live Chat)
- [CVE-2024-12261](https://cve.now/CVE-2024-12261.md): SmartEmailing.cz \<= 2.2.0 - Reflected Cross-Site Scripting (CVSS 6.1, marekzak01 SmartEmailing)
- [CVE-2024-12439](https://cve.now/CVE-2024-12439.md): Marketplace Items \<= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marketplace' Shortcode (CVSS 6.4, lumiblog Marketplace Items)
- [CVE-2024-12849](https://cve.now/CVE-2024-12849.md): Error Log Viewer By WP Guru \<= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read (CVSS 7.5, wpguruin Error Log Viewer By WP Guru)
- [CVE-2024-11369](https://cve.now/CVE-2024-11369.md): Store credit / Gift cards for woocommerce \<= 1.0.49.46 - Reflected Cross-Site Scripting (CVSS 6.1, rajeshsingh520 Store credit / Gift cards for woocommerce)
- [CVE-2024-9697](https://cve.now/CVE-2024-9697.md): Social Rocket – Social Sharing Plugin \<= 1.3.4 - Missing Authorization to Settings Update (CVSS 5.3, socialrocket Social Rocket – Social Sharing Plugin)
- [CVE-2024-11749](https://cve.now/CVE-2024-11749.md): App Embed \<= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, appizy App Embed)
- [CVE-2024-12324](https://cve.now/CVE-2024-12324.md): Unilevel MLM Plan \<= 1.1.0 - Reflected Cross-Site Scripting via 'page' (CVSS 6.1, letscms Unilevel MLM Plan)
- [CVE-2024-12435](https://cve.now/CVE-2024-12435.md): Compare Products for WooCommerce \<= 3.2.1 - Reflected Cross-Site Scripting (CVSS 6.1, a3rev Compare Products for WooCommerce)
- [CVE-2024-11382](https://cve.now/CVE-2024-11382.md): Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, commonninja Common Ninja: Fully Customizable & Perfectly Re…)
- [CVE-2024-12445](https://cve.now/CVE-2024-12445.md): RightMessage WP \<= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, RightMessage WP)
- [CVE-2024-12322](https://cve.now/CVE-2024-12322.md): ThePerfectWedding.nl Widget \<= 2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 8.8, ThePerfectWedding.nl Widget)
- [CVE-2024-11810](https://cve.now/CVE-2024-11810.md): PayGreen Payment Gateway \<= 1.0.26 - Reflected Cross-Site Scripting (CVSS 6.1, PayGreen Payment Gateway)
- [CVE-2024-12470](https://cve.now/CVE-2024-12470.md): School Management System – SakolaWP \<= 1.0.8 - Unauthenticated Privilege Escalation (CVSS 9.8, themesawesome School Management System – SakolaWP)
- [CVE-2024-9208](https://cve.now/CVE-2024-9208.md): Enable Accessibility \<= 1.4.1 - Reflected Cross-Site Scripting (CVSS 6.1, upress Enable Accessibility)
- [CVE-2024-12327](https://cve.now/CVE-2024-12327.md): LazyLoad Background Images \<= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update (CVSS 4.3, proloybhaduri LazyLoad Background Images)
- [CVE-2024-11496](https://cve.now/CVE-2024-11496.md): Infility Global \<= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Plugin Options Update (CVSS 6.5, Infility Global)
- [CVE-2024-12159](https://cve.now/CVE-2024-12159.md): Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords \<= 3.1 - Information Exposure (CVSS 5.3, muzaara Optimize Your Campaigns – Google Shopping – Google…)
- [CVE-2024-12256](https://cve.now/CVE-2024-12256.md): Simple Video Management System \<= 1.0.4 - Reflected Cross-Site Scripting (CVSS 6.1, maximize Simple Video Management System)
- [CVE-2024-12176](https://cve.now/CVE-2024-12176.md): WordLift – AI powered SEO – Schema \<= 3.54.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 5.3, WordLift – AI powered SEO – Schema)
- [CVE-2024-12332](https://cve.now/CVE-2024-12332.md): School Management System – WPSchoolPress \<= 2.2.14 - Authenticated (Student/Parent+) SQL Injection (CVSS 6.5, jdsofttech School Management System – WPSchoolPress)
- [CVE-2024-12140](https://cve.now/CVE-2024-12140.md): Elementor AI Addons – 70 Widgets, Premium Templates, Ultimate Elements \<= 2.2.1 - Authenticated (Contributor+) Private Templates Content Disclosure (CVSS 4.3, aiwp Elementor Addons AI Addons – 70 Widgets, Premium Templ…)
- [CVE-2024-12264](https://cve.now/CVE-2024-12264.md): PayU CommercePro Plugin \<= 3.8.3 - Unauthenticated Privilege Escalation (CVSS 9.8, payuplugin PayU CommercePro Plugin)
- [CVE-2024-11290](https://cve.now/CVE-2024-11290.md): Member Access \<= 1.1.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3, brownoxford Member Access)
- [CVE-2024-11377](https://cve.now/CVE-2024-11377.md): Automate Hub Free by Sperse.IO \<= 1.7.0 - Reflected Cross-Site Scripting (CVSS 6.1, Automate Hub Free by Sperse.IO)
- [CVE-2024-12158](https://cve.now/CVE-2024-12158.md): Popup – MailChimp, GetResponse and ActiveCampaign Intergrations \<= 3.2.6 - Missing Authorization to Unauthenticated DB Table Truncation (CVSS 5.3, arrowplugins Popup – MailChimp, GetResponse and ActiveCampa…)
- [CVE-2024-12153](https://cve.now/CVE-2024-12153.md): GDY Modular Content \<= 0.9.92 - Reflected Cross-Site Scripting (CVSS 6.1, grandy GDY Modular Content)
- [CVE-2024-11363](https://cve.now/CVE-2024-11363.md): Same but Different – Related Posts by Taxonomy \<= 1.0.16 - Reflected Cross-Site Scripting (CVSS 6.1, outtheboxthemes Same but Different – Related Posts by Taxon…)
- [CVE-2024-12453](https://cve.now/CVE-2024-12453.md): Uptodown APK Download Widget \<= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Uptodown APK Download Widget)
- [CVE-2024-12457](https://cve.now/CVE-2024-12457.md): Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode \<= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, faysal61 Chat Support for Viber – Chat Bubble and Chat Butt…)
- [CVE-2024-12207](https://cve.now/CVE-2024-12207.md): Toggles Shortcode and Widget \<= 1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, otwthemes Toggles Shortcode and Widget)
- [CVE-2024-11337](https://cve.now/CVE-2024-11337.md): Horoscope And Tarot \<= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, divineapi Divine Astro)
- [CVE-2024-12252](https://cve.now/CVE-2024-12252.md): SEO LAT Auto Post \<= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution) (CVSS 9.8, seobeginner SEO LAT Auto Post)
- [CVE-2024-12291](https://cve.now/CVE-2024-12291.md): ViewMedica 9 \<= 1.4.17 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 6.1, swarminteractive ViewMedica)
- [CVE-2024-12313](https://cve.now/CVE-2024-12313.md): Compare Products for WooCommerce \<= 3.2.1 - Unauthenticated PHP Object Injection (CVSS 8.1, a3rev Compare Products for WooCommerce)
- [CVE-2024-12290](https://cve.now/CVE-2024-12290.md): Infility Global \<= 2.9.8 - Reflected Cross-Site Scripting via set\_type Parameter (CVSS 6.1, Infility Global)
- [CVE-2024-12170](https://cve.now/CVE-2024-12170.md): ViewMedica Embed \<= 1.4.15 - Cross-Site Request Forgery to SQL Injection (CVSS 5.4, swarminteractive ViewMedica)
- [CVE-2024-11445](https://cve.now/CVE-2024-11445.md): Image Magnify \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, sazzadh Image Magnify)
- [CVE-2024-11375](https://cve.now/CVE-2024-11375.md): WC1C \<= 0.23.0 - Reflected Cross-Site Scripting (CVSS 6.1, WC1C)
- [CVE-2024-12288](https://cve.now/CVE-2024-12288.md): Simple add pages or posts \<= 2.0.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 6.1, ramon-fincken Simple add pages or posts)
- [CVE-2024-11378](https://cve.now/CVE-2024-11378.md): Bizapp for WooCommerce \<= 2.0.8 - Reflected Cross-Site Scripting (CVSS 6.1, bizappventures Bizapp for WooCommerce)
- [CVE-2024-12157](https://cve.now/CVE-2024-12157.md): Popup – MailChimp, GetResponse and ActiveCampaign Intergrations \<= 3.2.6 - Unauthenticated SQL Injection (CVSS 7.5, arrowplugins Popup – MailChimp, GetResponse and ActiveCampa…)
- [CVE-2024-12126](https://cve.now/CVE-2024-12126.md): SEO Keywords \<= 1.1.3 - Reflected Cross-Site Scripting via google\_error Parameter (CVSS 6.1, seomantis SEO Keywords)
- [CVE-2024-11690](https://cve.now/CVE-2024-11690.md): Financial Stocks & Crypto Market Data Plugin \<= 1.10.3 - Reflected Cross-Site Scripting (CVSS 6.1, deios Financial Stocks & Crypto Market Data Plugin)
- [CVE-2024-12214](https://cve.now/CVE-2024-12214.md): WooCommerce HSS Extension for Streaming Video \<= 3.31 - Reflected Cross-Site Scripting via videolink Parameter (CVSS 6.1, hoststreamsell WooCommerce HSS Extension for Streaming Video)
- [CVE-2024-11465](https://cve.now/CVE-2024-11465.md): Custom Product Tabs for WooCommerce \<= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injection (CVSS 7.2, eherman24 Custom Product Tabs for WooCommerce)
- [CVE-2024-11434](https://cve.now/CVE-2024-11434.md): WP – Bulk SMS – by SMS.to \<= 1.0.12 - Reflected Cross-Site Scripting (CVSS 6.1, intergotelecom WP – Bulk SMS – by SMS.to)
- [CVE-2024-11338](https://cve.now/CVE-2024-11338.md): PIXNET Plugin \<= 2.9.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, daniel1088 PIXNET Plugin)
- [CVE-2024-12462](https://cve.now/CVE-2024-12462.md): YOGO Booking \<= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, andersyogo YOGO Booking)
- [CVE-2024-10527](https://cve.now/CVE-2024-10527.md): Spacer \<= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Limited Information Disclosure (CVSS 3.1, clevelandwebdeveloper Spacer)
- [CVE-2024-12049](https://cve.now/CVE-2024-12049.md): Woo Ukrposhta \<= 1.17.11 - Reflected Cross-Site Scripting via order, post, and idd Parameters (CVSS 6.1, bandido Ukrposhta)
- [CVE-2024-11383](https://cve.now/CVE-2024-11383.md): CC Canadian Mortgage Calculator \<= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, calculatorscanadaca CC Canadian Mortgage Calculator)
- [CVE-2024-12538](https://cve.now/CVE-2024-12538.md): Duplicate Post, Page and Any Custom Post \<= 3.5.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication (CVSS 4.3, binsaifullah Duplicate Post, Page and Any Custom Post)
- [CVE-2024-11899](https://cve.now/CVE-2024-11899.md): Slider Pro Lite \<= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bqworks Slider Pro Lite)
- [CVE-2024-12559](https://cve.now/CVE-2024-12559.md): ClickDesigns \<= 1.8.0 - Missing Authorization to API Key Modification or Removal (CVSS 5.3, 1clickdesigns ClickDesigns)
- [CVE-2024-12098](https://cve.now/CVE-2024-12098.md): ARS Affiliate Page Plugin \<= 2.0.2 - Reflected Cross-Site Scripting (CVSS 6.1, arsdeveloper ARS Affiliate Page Plugin)
- [CVE-2024-12592](https://cve.now/CVE-2024-12592.md): Sellsy \<= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Sellsy)
- [CVE-2024-11777](https://cve.now/CVE-2024-11777.md): Sell Media \<= 2.5.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, endortrails Sell Media)
- [CVE-2024-12416](https://cve.now/CVE-2024-12416.md): Woomotiv \<= 3.6.1 - Unauthenticated SQL Injection (CVSS 7.5, delabon Live Sales Notification for Woocommerce – Woomotiv)
- [CVE-2024-12541](https://cve.now/CVE-2024-12541.md): Chative Live chat and Chatbot \<= 1.1 - Cross-Site Request Forgery via add\_chative\_widget\_action Function (CVSS 5.4, Chative Live chat and Chatbot)
- [CVE-2024-12419](https://cve.now/CVE-2024-12419.md): Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler \<= 1.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting (CVSS 6.5, tobias\_conrad WOW Styler for CF7 – Visual Styler for Contac…)
- [CVE-2024-12528](https://cve.now/CVE-2024-12528.md): WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress \<= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, pantherius WordPress Survey & Poll – Quiz, Survey and Poll…)
- [CVE-2024-11934](https://cve.now/CVE-2024-11934.md): Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce \<= 2.1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Formaloo Form Maker & Customer Analytics for WordPress & Wo…)
- [CVE-2024-12557](https://cve.now/CVE-2024-12557.md): Transporters.io \<= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, transportersio Transporters.io)
- [CVE-2024-12402](https://cve.now/CVE-2024-12402.md): Themes Coder – Create Android & iOS Apps For Your Woocommerce Site \<= 1.3.4 - Insecure Direct Object Reference to Password Change/Account Takeover/Privilege Escalation (CVSS 9.8, themescoder TC Ecommerce – Create Android & iOS Apps for Wo…)
- [CVE-2024-11437](https://cve.now/CVE-2024-11437.md): Timeline Designer \<= 1.4 - Authenticated (Admin+) SQL Injection (CVSS 4.9, solwininfotech Timeline Designer)
- [CVE-2024-12590](https://cve.now/CVE-2024-12590.md): WP Youtube Gallery \<= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, india-web-developer WP Youtube Gallery)
- [CVE-2025-22395](https://cve.now/CVE-2025-22395.md): Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. (CVSS 8.2, Dell Update Package (DUP) Framework)
- [CVE-2022-41572](https://cve.now/CVE-2022-41572.md): An issue was discovered in EyesOfNetwork (EON) through 5.3.11. (CVSS 9.8)
- [CVE-2022-41573](https://cve.now/CVE-2022-41573.md): An issue was discovered in Ovidentia 8.3. (CVSS 9.8)
- [CVE-2022-45185](https://cve.now/CVE-2022-45185.md): An issue was discovered in SuiteCRM 7.12.7. (CVSS 8.8)
- [CVE-2022-45186](https://cve.now/CVE-2022-45186.md): An issue was discovered in SuiteCRM 7.12.7. (CVSS 8.1)
- [CVE-2024-35532](https://cve.now/CVE-2024-35532.md): An XML External Entity (XXE) injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitr (CVSS 9.1)
- [CVE-2024-40427](https://cve.now/CVE-2024-40427.md): Stack Buffer Overflow in PX4-Autopilot v1.14.3, which allows attackers to execute commands to exploit this vulnerability and cause the progr (CVSS 7.9)
- [CVE-2024-44450](https://cve.now/CVE-2024-44450.md): Multiple functions are vulnerable to Authorization Bypass in AIMS eCrew. (CVSS 5.4)
- [CVE-2024-46242](https://cve.now/CVE-2024-46242.md): An issue in the validate\_email function in CTFd/utils/validators/\_\_init\_\_.py of CTFd 3.7.3 allows attackers to cause a Regular expression De (CVSS 7.5)
- [CVE-2024-46601](https://cve.now/CVE-2024-46601.md): Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 was discovered to contain a buffer overflow. (CVSS 7.5)
- [CVE-2024-46602](https://cve.now/CVE-2024-46602.md): An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. (CVSS 7.5)
- [CVE-2024-46603](https://cve.now/CVE-2024-46603.md): An XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a De (CVSS 7.5)
- [CVE-2024-48245](https://cve.now/CVE-2024-48245.md): Vehicle Management System 1.0 is vulnerable to SQL Injection. (CVSS 7.2)
- [CVE-2024-50658](https://cve.now/CVE-2024-50658.md): Server-Side Template Injection (SSTI) was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the shippingAsBill (CVSS 9.8)
- [CVE-2024-50659](https://cve.now/CVE-2024-50659.md): Cross Site Scripting vulnerability iPublish Media Solutions AdPortal 3.0.39 allows a remote attacker to escalate privileges via the shipping (CVSS 6.1)
- [CVE-2024-50660](https://cve.now/CVE-2024-50660.md): File Upload Bypass was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the file upload functionality (CVSS 9.8)
- [CVE-2024-53345](https://cve.now/CVE-2024-53345.md): An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code (CVSS 8.8)
- [CVE-2024-53522](https://cve.now/CVE-2024-53522.md): Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI co (CVSS 7.5)
- [CVE-2024-54819](https://cve.now/CVE-2024-54819.md): I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/sec (CVSS 9.1)
- [CVE-2024-55008](https://cve.now/CVE-2024-55008.md): JATOS 3.9.4 contains a denial-of-service (DoS) vulnerability in the authentication system, where an attacker can prevent legitimate users fr (CVSS 7.5)
- [CVE-2024-55218](https://cve.now/CVE-2024-55218.md): IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter. (CVSS 6.1)
- [CVE-2024-55411](https://cve.now/CVE-2024-55411.md): An issue in the snxpcamd.sys component of SUNIX Multi I/O Card v10.1.0.0 allows attackers to perform arbitrary read and write actions via su (CVSS 8.8)
- [CVE-2024-55412](https://cve.now/CVE-2024-55412.md): A vulnerability exits in driver snxpsamd.sys in SUNIX Serial Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbi (CVSS 7.8)
- [CVE-2024-55413](https://cve.now/CVE-2024-55413.md): A vulnerability exits in driver snxppamd.sys in SUNIX Parallel Driver x64 - 10.1.0.0, which allows low-privileged users to read and write ar (CVSS 7.8)
- [CVE-2024-55414](https://cve.now/CVE-2024-55414.md): A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping phys (CVSS 9.8)
- [CVE-2024-55555](https://cve.now/CVE-2024-55555.md): Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP\_KEY. (CVSS 8.8)
- [CVE-2024-55556](https://cve.now/CVE-2024-55556.md): A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP\_KEY to achieve remote command execution on th (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.