# CVEs published 2025-01-16

299 CVEs were published on January 16, 2025: 21 critical, 137 high. Days are UTC.

- [CVE-2024-56144](https://cve.now/CVE-2024-56144.md): Stored XSS-LibreNMS-Display Name 2 in librenms (CVSS 4.6, librenms · librenms/librenms)
- [CVE-2025-23198](https://cve.now/CVE-2025-23198.md): Stored-XSS-LibreNMS-Display-Name in librenms (CVSS 4.6, librenms · librenms/librenms)
- [CVE-2025-23199](https://cve.now/CVE-2025-23199.md): Stored XSS-LibreNMS-Ports in librenms (CVSS 4.6, librenms · librenms/librenms)
- [CVE-2025-23200](https://cve.now/CVE-2025-23200.md): Stored XSS-LibreNMS-Misc Section in librenms (CVSS 4.6, librenms · librenms/librenms)
- [CVE-2025-23201](https://cve.now/CVE-2025-23201.md): Reflected Cross-site Scripting on error alert in librenms (CVSS 5.4, librenms · librenms/librenms)
- [CVE-2025-23907](https://cve.now/CVE-2025-23907.md): WordPress SOCIAL.NINJA plugin \<= 0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, closed SOCIAL.NINJA)
- [CVE-2025-23764](https://cve.now/CVE-2025-23764.md): WordPress Copy Move Posts plugin \<= 1.6 - Broken Access Control vulnerability (CVSS 5.3, ujjavaljani Copy Move Posts)
- [CVE-2025-23816](https://cve.now/CVE-2025-23816.md): WordPress Metaphor Widgets plugin \<= 2.4 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, metaphorcreations Metaphor Widgets)
- [CVE-2025-23815](https://cve.now/CVE-2025-23815.md): WordPress root Cookie plugin \<= 1.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, linickx root Cookie)
- [CVE-2025-23793](https://cve.now/CVE-2025-23793.md): WordPress Auto FTP plugin \<= 1.0.1 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, Ciprian Turcu Auto FTP)
- [CVE-2025-23761](https://cve.now/CVE-2025-23761.md): WordPress Woo Tuner plugin \<= 0.1.2 - Broken Access Control vulnerability (CVSS 5.4, Alex Volkov Woo Tuner)
- [CVE-2025-23760](https://cve.now/CVE-2025-23760.md): WordPress Chatter plugin \<= 1.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Alex Volkov Chatter)
- [CVE-2025-23957](https://cve.now/CVE-2025-23957.md): WordPress Sur.ly plugin \<= 3.0.3 - Broken Access Control vulnerability (CVSS 4.3, surdotly Sur.ly)
- [CVE-2025-23965](https://cve.now/CVE-2025-23965.md): WordPress Kopa Nictitate Toolkit plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, kopatheme Kopa Nictitate Toolkit)
- [CVE-2025-23961](https://cve.now/CVE-2025-23961.md): WordPress WordPress Graphs & Charts Plugin \<= 2.0.8 - Broken Access Control vulnerability (CVSS 5.4, wptasker WordPress Graphs & Charts)
- [CVE-2025-23955](https://cve.now/CVE-2025-23955.md): WordPress Xola plugin \<= 1.6 - Broken Access Control vulnerability (CVSS 4.3, Xola)
- [CVE-2025-23963](https://cve.now/CVE-2025-23963.md): WordPress Mark Posts plugin \<= 2.2.4 - Broken Access Control vulnerability (CVSS 5.4, flymke Mark Posts)
- [CVE-2025-23962](https://cve.now/CVE-2025-23962.md): WordPress Goldstar plugin \<= 2.1.1 - Broken Access Control vulnerability (CVSS 4.3, jjtrabucco Goldstar)
- [CVE-2025-23954](https://cve.now/CVE-2025-23954.md): WordPress Salvador – AI Image Generator plugin \<= 1.0.11 - Broken Access Control vulnerability (CVSS 4.3, awcode Salvador – AI Image Generator)
- [CVE-2025-23939](https://cve.now/CVE-2025-23939.md): WordPress Image Switcher plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, KHAN-IT Image Switcher)
- [CVE-2025-23950](https://cve.now/CVE-2025-23950.md): WordPress EZPlayer plugin \<= 1.0.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ezmarketing EZPlayer)
- [CVE-2025-23943](https://cve.now/CVE-2025-23943.md): WordPress PDF.js Shortcode plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, aruvi PDF.js Shortcode)
- [CVE-2025-23946](https://cve.now/CVE-2025-23946.md): WordPress Enhanced YouTube Shortcode plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Le-Pixel-Solitaire Enhanced YouTube Shortcode)
- [CVE-2025-23941](https://cve.now/CVE-2025-23941.md): WordPress MeinTurnierplan.de Widget Viewer plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MeinTurnierplan.de Widget Viewer)
- [CVE-2025-23951](https://cve.now/CVE-2025-23951.md): WordPress Gallery: Hybrid – Advanced Visual Gallery plugin \<= 1.4.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DIVENGINE Gallery: Hybrid – Advanced Visual Gallery)
- [CVE-2025-23947](https://cve.now/CVE-2025-23947.md): WordPress WP-Player plugin \<= 2.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, M.J WP-Player)
- [CVE-2025-23934](https://cve.now/CVE-2025-23934.md): WordPress Giveaways and Contests by PromoSimple plugin \<= 1.24 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sam Brodie Giveaways and Contests by PromoSimple)
- [CVE-2025-23940](https://cve.now/CVE-2025-23940.md): WordPress jupdf pdf viewer plugin \<= 0.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, horiyuki Image Switcher)
- [CVE-2025-23928](https://cve.now/CVE-2025-23928.md): WordPress Google Org Chart plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Aleksandar Arsovski Google Org Chart)
- [CVE-2025-23924](https://cve.now/CVE-2025-23924.md): WordPress WP Photo Sphere plugin \<= 3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jeremy WP Photo Sphere)
- [CVE-2025-23935](https://cve.now/CVE-2025-23935.md): WordPress Magic Google Maps plugin \<= 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Fengler Magic Google Maps)
- [CVE-2025-23933](https://cve.now/CVE-2025-23933.md): WordPress WpF Ultimate Carousel plugin \<= 1.0.11 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpfreeware WpF Ultimate Carousel)
- [CVE-2025-23930](https://cve.now/CVE-2025-23930.md): WordPress PayPal Marketing Solutions plugin \<= 1.2 - Broken Access Control vulnerability (CVSS 4.3, paypalmuse PayPal Marketing Solutions)
- [CVE-2025-23917](https://cve.now/CVE-2025-23917.md): WordPress Chamber Dashboard Business Directory Plugin \<= 3.3.8 - Broken Access Control vulnerability (CVSS 5.4, Chandrika Guntur, Morgan Kay Chamber Dashboard Business Dir…)
- [CVE-2025-23925](https://cve.now/CVE-2025-23925.md): WordPress Feedburner Optin Form plugin \<= 0.2.8 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, jp2112 Feedburner Optin Form)
- [CVE-2025-23936](https://cve.now/CVE-2025-23936.md): WordPress CC Circle Progress Bar plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Harun R. Rayhan(thecrazycoder) CC Circle Progress Bar)
- [CVE-2025-23927](https://cve.now/CVE-2025-23927.md): WordPress Incredible Font Awesome plugin \<= 1.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, massimo.serpilli Incredible Font Awesome)
- [CVE-2025-23929](https://cve.now/CVE-2025-23929.md): WordPress Email Capture & Lead Generation Plugin \<= 1.0.2 - Broken Access Control vulnerability (CVSS 4.3, wishfulthemes Email Capture & Lead Generation)
- [CVE-2025-23922](https://cve.now/CVE-2025-23922.md): WordPress iSpring Embedder plugin \<= 1.0 - CSRF to Arbitrary File Upload vulnerability (CVSS 10.0, Harsh iSpring Embedder)
- [CVE-2025-23915](https://cve.now/CVE-2025-23915.md): WordPress FAT Event Lite plugin \<= 1.1 - Authenticated Non-Arbitrary Local File Inclusion vulnerability (CVSS 7.5, roninwp FAT Event Lite)
- [CVE-2025-23926](https://cve.now/CVE-2025-23926.md): WordPress Ajax WP Query Search Filter plugin \<= 1.0.7 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, TC.K Ajax WP Query Search Filter)
- [CVE-2025-23916](https://cve.now/CVE-2025-23916.md): WordPress WP Meetup plugin \<= 2.3.0 - Settings Change vulnerability (CVSS 5.4, Nuanced Media WP Meetup)
- [CVE-2025-23919](https://cve.now/CVE-2025-23919.md): WordPress Slides & Presentations Plugin \<= 0.0.39 - Content Injection vulnerability (CVSS 5.4, Ella Van Durpe Slides & Presentations)
- [CVE-2025-23912](https://cve.now/CVE-2025-23912.md): WordPress WordPress Custom Sidebar Plugin \<= 2.3 - SQL Injection vulnerability (CVSS 8.5, Philipp Speck WordPress Custom Sidebar)
- [CVE-2025-23901](https://cve.now/CVE-2025-23901.md): WordPress GravatarLocalCache plugin \<= 1.1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, cybio GravatarLocalCache)
- [CVE-2025-23913](https://cve.now/CVE-2025-23913.md): WordPress Google Map Professional Plugin \<= 1.0 - SQL Injection vulnerability (CVSS 8.5, pankajpragma WordPress Google Map Professional)
- [CVE-2025-23911](https://cve.now/CVE-2025-23911.md): WordPress Solidres – Hotel booking plugin for WordPress Plugin \<= 0.9.4 - SQL Injection vulnerability (CVSS 8.5, Solidres – Hotel booking plugin)
- [CVE-2025-23909](https://cve.now/CVE-2025-23909.md): WordPress Compare Ninja plugin \<= 2.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Common Ninja Compare Ninja)
- [CVE-2025-23908](https://cve.now/CVE-2025-23908.md): WordPress Pastebin plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Rami Yushuvaev Pastebin)
- [CVE-2025-23900](https://cve.now/CVE-2025-23900.md): WordPress Genki Announcement plugin \<= 1.4.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, genkisan Genki Announcement)
- [CVE-2025-23902](https://cve.now/CVE-2025-23902.md): WordPress Error Notification plugin \<= 0.2.7 - CSRF to Stored XSS vulnerability (CVSS 7.1, Taras Dashkevych Error Notification)
- [CVE-2025-23899](https://cve.now/CVE-2025-23899.md): WordPress Bookalet plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Bookalet)
- [CVE-2025-23897](https://cve.now/CVE-2025-23897.md): WordPress Apply with LinkedIn buttons plugin \<= 2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ivobrett Apply with LinkedIn buttons)
- [CVE-2025-23898](https://cve.now/CVE-2025-23898.md): WordPress Apply with LinkedIn buttons plugin \<= 2.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, ivobrett Apply with LinkedIn buttons)
- [CVE-2025-23887](https://cve.now/CVE-2025-23887.md): WordPress Blog Summary plugin \<= 0.1.2 β - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, scottwallick Blog Summary)
- [CVE-2025-23891](https://cve.now/CVE-2025-23891.md): WordPress Yet Another Countdown Plugin plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Vincent Loy Yet Another Countdown)
- [CVE-2025-23884](https://cve.now/CVE-2025-23884.md): WordPress Annie plugin \<= 2.1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Chris Roberts Annie)
- [CVE-2025-23892](https://cve.now/CVE-2025-23892.md): WordPress Progress Tracker plugin \<= 0.9.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Alex Furr Progress Tracker)
- [CVE-2025-23896](https://cve.now/CVE-2025-23896.md): WordPress Mindmeister Shortcode plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, thom4 Mindmeister Shortcode)
- [CVE-2025-23890](https://cve.now/CVE-2025-23890.md): WordPress Easy Tweet Embed plugin \<= 1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tom Ewer Easy Tweet Embed)
- [CVE-2025-23895](https://cve.now/CVE-2025-23895.md): WordPress Add RSS plugin \<= 1.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Dan Cameron Add RSS)
- [CVE-2025-23876](https://cve.now/CVE-2025-23876.md): WordPress WP krpano plugin \<= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, No-Nonsense WP krpano)
- [CVE-2025-23893](https://cve.now/CVE-2025-23893.md): WordPress GMap Shortcode plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Manny Costales GMap Shortcode)
- [CVE-2025-23875](https://cve.now/CVE-2025-23875.md): WordPress Better Protected Pages plugin \<= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, madeglobal Better Protected Pages)
- [CVE-2025-23886](https://cve.now/CVE-2025-23886.md): WordPress Annie plugin \<= 2.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Chris Roberts Annie)
- [CVE-2025-23880](https://cve.now/CVE-2025-23880.md): WordPress amr personalise plugin \<= 2.10 - CSRF to Stored XSS vulnerability (CVSS 7.1, anmari amr personalise)
- [CVE-2025-23878](https://cve.now/CVE-2025-23878.md): WordPress Post-to-Post Links plugin \<= 4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Scott Reilly Post-to-Post Links)
- [CVE-2025-23873](https://cve.now/CVE-2025-23873.md): WordPress Category D3 Tree plugin \<= 1.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Anshi Solutions Category D3 Tree)
- [CVE-2025-23877](https://cve.now/CVE-2025-23877.md): WordPress Nite Shortcodes plugin \<= 1.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nitethemes Nite Shortcodes)
- [CVE-2025-23872](https://cve.now/CVE-2025-23872.md): WordPress PayForm plugin \<= 2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, PayForm)
- [CVE-2025-23864](https://cve.now/CVE-2025-23864.md): WordPress WCS QR Code Generator plugin \<= 1.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Luke America WCS QR Code Generator)
- [CVE-2025-23868](https://cve.now/CVE-2025-23868.md): WordPress Chess Tempo Viewer plugin \<= 0.9.5 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, mliebelt Chess Tempo Viewer)
- [CVE-2025-23871](https://cve.now/CVE-2025-23871.md): WordPress LSD Google Maps Embedder plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Bas Matthee LSD Google Maps Embedder)
- [CVE-2025-23865](https://cve.now/CVE-2025-23865.md): WordPress Winning Portfolio plugin \<= 1.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, pressfore Winning Portfolio)
- [CVE-2025-23863](https://cve.now/CVE-2025-23863.md): WordPress Rollover Tab plugin \<= 1.3.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sabaoh Rollover Tab)
- [CVE-2025-23870](https://cve.now/CVE-2025-23870.md): WordPress Copyright Safeguard Footer Notice plugin \<= 3.0 - CSRF to Stored Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, wygk Copyright Safeguard Footer Notice)
- [CVE-2025-23854](https://cve.now/CVE-2025-23854.md): WordPress Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com plugin \<= 3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, yesstreamingdev Shoutcast and Icecast HTML5 Web Radio Playe…)
- [CVE-2025-23869](https://cve.now/CVE-2025-23869.md): WordPress CJ Custom Content plugin \<= 2.0 - CSRF to Cross-Site Scripting vulnerability (CVSS 7.1, shibulijack CJ Custom Content)
- [CVE-2025-23859](https://cve.now/CVE-2025-23859.md): WordPress Daily Proverb plugin \<= 2.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, jd7777 Daily Proverb)
- [CVE-2025-23860](https://cve.now/CVE-2025-23860.md): WordPress Charity-thermometer plugin \<= 1.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, crea8xion Charity-thermometer)
- [CVE-2025-23862](https://cve.now/CVE-2025-23862.md): WordPress Contact Form 7 Anti Spambot plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 5.3, SzMake Contact Form 7 Anti Spambot)
- [CVE-2025-23861](https://cve.now/CVE-2025-23861.md): WordPress Debt Calculator plugin \<= 1.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Zack Katz Debt Calculator)
- [CVE-2025-23856](https://cve.now/CVE-2025-23856.md): WordPress Simple Vertical Timeline plugin \<= 0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Odyno Simple Vertical Timeline)
- [CVE-2025-23848](https://cve.now/CVE-2025-23848.md): WordPress Hotspots Analytics plugin \<= 4.0.12 - CSRF to Stored XSS vulnerability (CVSS 7.1, dpowney Hotspots Analytics)
- [CVE-2025-23842](https://cve.now/CVE-2025-23842.md): WordPress WordPress Gallery Plugin plugin \<= 1.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, Nilesh Shiragave WordPress Gallery Plugin)
- [CVE-2025-23830](https://cve.now/CVE-2025-23830.md): WordPress JB Horizontal Scroller News Ticker plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, jobair JB Horizontal Scroller News Ticker)
- [CVE-2025-23841](https://cve.now/CVE-2025-23841.md): WordPress Top Flash Embed plugin \<= 0.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, foo123 Top Flash Embed)
- [CVE-2025-23844](https://cve.now/CVE-2025-23844.md): WordPress Custom Widget Classes plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Jamsheer K Custom Widget Classes)
- [CVE-2025-23831](https://cve.now/CVE-2025-23831.md): WordPress QR Code Generator plugin \<= 1.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, mobstac QR Code Generator)
- [CVE-2025-23828](https://cve.now/CVE-2025-23828.md): WordPress WordPress Data Guard \[Website Security\] plugin \<= 8 - CSRF to Stored XSS vulnerability (CVSS 7.1, sindhi WordPress Data Guard)
- [CVE-2025-23826](https://cve.now/CVE-2025-23826.md): WordPress Stop Comment Spam plugin \<= 0.5.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, pedjas Stop Comment Spam)
- [CVE-2025-23824](https://cve.now/CVE-2025-23824.md): WordPress FontAwesome.io ShortCodes plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Alexander Weleczka FontAwesome.io ShortCodes)
- [CVE-2025-23833](https://cve.now/CVE-2025-23833.md): WordPress Links/Problem Reporter plugin \<= 2.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RaminMT Links/Problem Reporter)
- [CVE-2025-23823](https://cve.now/CVE-2025-23823.md): WordPress CNZZ&51LA for WordPress plugin \<= 1.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, jprintf CNZZ&51LA for WordPress)
- [CVE-2025-23825](https://cve.now/CVE-2025-23825.md): WordPress Easy Shortcode Buttons plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, osuthorpe Easy Shortcode Buttons)
- [CVE-2025-23821](https://cve.now/CVE-2025-23821.md): WordPress WP Cookies Alert plugin \<= 1.1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, aleapp WP Cookies Alert)
- [CVE-2025-23832](https://cve.now/CVE-2025-23832.md): WordPress Admin Cleanup plugin \<= 1.0.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Matt Gibbs Admin Cleanup)
- [CVE-2025-23820](https://cve.now/CVE-2025-23820.md): WordPress Content Security Policy Pro plugin \<= 1.3.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, thapa.laxman Content Security Policy Pro)
- [CVE-2025-23827](https://cve.now/CVE-2025-23827.md): WordPress Strx Magic Floating Sidebar Maker plugin \<= 1.4.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, straps Strx Magic Floating Sidebar Maker)
- [CVE-2025-23818](https://cve.now/CVE-2025-23818.md): WordPress More Link Modifier plugin \<= 1.0.3 - CSRF to Cross-Site Scripting vulnerability (CVSS 7.1, pyko More Link Modifier)
- [CVE-2025-23807](https://cve.now/CVE-2025-23807.md): WordPress Spiderpowa Embed PDF plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, jim2212001 Spiderpowa Embed PDF)
- [CVE-2025-23822](https://cve.now/CVE-2025-23822.md): WordPress Category Custom Fields plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, alicornea Category Custom Fields)
- [CVE-2025-23808](https://cve.now/CVE-2025-23808.md): WordPress Custom List Table Example Plugin \<=1.4.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dutch van Andel Custom List Table Example)
- [CVE-2025-23805](https://cve.now/CVE-2025-23805.md): WordPress SEOReseller Partner plugin \<= 1.3.15 - CSRF to Stored XSS vulnerability (CVSS 7.1, itamarg SEOReseller Partner)
- [CVE-2025-23817](https://cve.now/CVE-2025-23817.md): WordPress MHR-Custom-Anti-Copy plugin \<= 2.0 - CSRF to Stored Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, mahadirz MHR-Custom-Anti-Copy)
- [CVE-2025-23810](https://cve.now/CVE-2025-23810.md): WordPress Len Slider Plugin \<= 2.0.11 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Igor Sazonov Len Slider)
- [CVE-2025-23801](https://cve.now/CVE-2025-23801.md): WordPress Style Admin Plugin \<= 1.4.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, FuzzGuard Style Admin)
- [CVE-2025-23804](https://cve.now/CVE-2025-23804.md): WordPress WP Service Payment Form With Authorize.net Plugin \<= 2.6.0 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Shiv Prakash Tiwari WP Service Payment Form With Authorize.…)
- [CVE-2025-23797](https://cve.now/CVE-2025-23797.md): WordPress WP Options Editor plugin \<= 1.1 - CSRF to Privilege Escalation vulnerability (CVSS 9.8, Mike Selander WP Options Editor)
- [CVE-2025-23795](https://cve.now/CVE-2025-23795.md): WordPress Easy FAQs plugin \<= 3.2.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ghuger Easy FAQs)
- [CVE-2025-23800](https://cve.now/CVE-2025-23800.md): WordPress OrangeBox plugin \<= 3.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, nova706 OrangeBox)
- [CVE-2025-23802](https://cve.now/CVE-2025-23802.md): WordPress WP-Revive Adserver Plugin \<= 2.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SteveSoehl WP-Revive Adserver)
- [CVE-2025-23796](https://cve.now/CVE-2025-23796.md): WordPress Easy Portfolio plugin \<= 1.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tushar Patel Easy Portfolio)
- [CVE-2025-23791](https://cve.now/CVE-2025-23791.md): WordPress Horizontal Line Shortcode Plugin \<= 1.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, mikakaltoft Horizontal Line Shortcode)
- [CVE-2025-23794](https://cve.now/CVE-2025-23794.md): WordPress wp\_amaps Plugin \<= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.5, \_rccoder\_ wp\_amaps)
- [CVE-2025-23780](https://cve.now/CVE-2025-23780.md): WordPress Easy Code Snippets Plugin \<= 1.0.2 - SQL Injection vulnerability (CVSS 7.6, Alpha BPO Easy Code Snippets)
- [CVE-2025-23785](https://cve.now/CVE-2025-23785.md): WordPress AI Responsive Gallery Album plugin \<= 1.4 - Broken Access Control vulnerability (CVSS 4.3, August Infotech AI Responsive Gallery Album)
- [CVE-2025-23778](https://cve.now/CVE-2025-23778.md): WordPress User Sync ActiveCampaign plugin \<= 1.3.2 - Broken Access Control vulnerability (CVSS 5.4, Pravin Durugkar User Sync ActiveCampaign)
- [CVE-2025-23779](https://cve.now/CVE-2025-23779.md): WordPress ResAds Plugin \<= 2.0.5 - SQL Injection vulnerability (CVSS 7.6, web-mv ResAds)
- [CVE-2025-23777](https://cve.now/CVE-2025-23777.md): WordPress GDPR Personal Data Reports Plugin \<= 1.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, willowsconsulting GDPR Personal Data Reports)
- [CVE-2025-23772](https://cve.now/CVE-2025-23772.md): WordPress imaGenius Plugin \<= 1.7 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Eugenio Petulla’ imaGenius)
- [CVE-2025-23775](https://cve.now/CVE-2025-23775.md): WordPress GMAPS for WPBakery Page Builder Free Plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WWP GMAPS for WPBakery Page Builder Free)
- [CVE-2025-23765](https://cve.now/CVE-2025-23765.md): WordPress W3SPEEDSTER plugin \<= 7.33 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, W3SPEEDSTER)
- [CVE-2025-23776](https://cve.now/CVE-2025-23776.md): WordPress Cache Sniper for Nginx plugin \<= 1.0.4.2 - Broken Access Control vulnerability (CVSS 4.3, ekaterir Cache Sniper for Nginx)
- [CVE-2025-23783](https://cve.now/CVE-2025-23783.md): WordPress Greek Namedays Widget Plugin \<= 20191113 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, carrotbits Greek Namedays Widget From Eortologio.Net)
- [CVE-2025-23767](https://cve.now/CVE-2025-23767.md): WordPress Marmoset Viewer plugin \<= 1.9.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, revoxis Marmoset Viewer)
- [CVE-2025-23749](https://cve.now/CVE-2025-23749.md): WordPress mybb Last Topics plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, progpars.net mybb Last Topics)
- [CVE-2025-23713](https://cve.now/CVE-2025-23713.md): WordPress Hack me if you can plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, artanik Hack me if you can)
- [CVE-2025-23745](https://cve.now/CVE-2025-23745.md): WordPress Call me Now plugin \<= 1.0.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Tussendoor B.V. Call me Now)
- [CVE-2025-23743](https://cve.now/CVE-2025-23743.md): WordPress Social Analytics plugin \<= 0.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, MartijnScheijbeler Social Analytics)
- [CVE-2025-23717](https://cve.now/CVE-2025-23717.md): WordPress Theme My Ontraport Smartform plugin \<= 1.2.11 - CSRF to Stored XSS vulnerability (CVSS 7.1, itmooti Theme My Ontraport Smartform)
- [CVE-2025-23720](https://cve.now/CVE-2025-23720.md): WordPress Web Push plugin \<= 1.4.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Marco Castelluccio Web Push)
- [CVE-2025-23702](https://cve.now/CVE-2025-23702.md): WordPress Anonymize Links plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Schalk Burger Anonymize Links)
- [CVE-2025-23712](https://cve.now/CVE-2025-23712.md): WordPress Kapost plugin \<= 2.2.9 - CSRF to Stored XSS vulnerability (CVSS 7.1, kapostintegrations Kapost)
- [CVE-2025-23715](https://cve.now/CVE-2025-23715.md): WordPress Post & Page Notes plugin \<= 0.1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, RaymondDesign Post & Page Notes)
- [CVE-2025-23703](https://cve.now/CVE-2025-23703.md): WordPress Free MailClient FMC plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, cstoltenkamp Free MailClient FMC)
- [CVE-2025-23710](https://cve.now/CVE-2025-23710.md): WordPress Flying Twitter Birds plugin \<= 1.8 - CSRF to Stored XSS vulnerability (CVSS 7.1, Mayur Sojitra Flying Twitter Birds)
- [CVE-2025-23708](https://cve.now/CVE-2025-23708.md): WordPress DF Draggable plugin \<= 1.13.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Dominic Fallows DF Draggable)
- [CVE-2025-23698](https://cve.now/CVE-2025-23698.md): WordPress WP Custom Google Search plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, ivanra10 WP Custom Google Search)
- [CVE-2025-23694](https://cve.now/CVE-2025-23694.md): WordPress Shabbos and Yom Tov plugin \<= 1.9 - CSRF to Stored XSS vulnerability (CVSS 7.1, shabboscommerce Shabbos and Yom Tov)
- [CVE-2025-23699](https://cve.now/CVE-2025-23699.md): WordPress Event Countdown Timer Plugin by TechMix plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Event Countdown Timer Plugin by TechMix)
- [CVE-2025-23692](https://cve.now/CVE-2025-23692.md): WordPress Slider for Writers plugin \<= 1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, artanik Slider for Writers)
- [CVE-2025-23690](https://cve.now/CVE-2025-23690.md): WordPress Book a Place plugin \<= 0.7.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, ArtkanMedia Book a Place)
- [CVE-2025-23675](https://cve.now/CVE-2025-23675.md): WordPress Import Users to MailChimp plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Sana Ullah Import Users to MailChimp)
- [CVE-2025-23689](https://cve.now/CVE-2025-23689.md): WordPress Blogger Image Import plugin \<= 2.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Poco Blogger Image Import)
- [CVE-2025-23677](https://cve.now/CVE-2025-23677.md): WordPress HTTP to HTTPS link changer by Eyga.net plugin \<= 0.2.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, DSmidge HTTP to HTTPS link changer by Eyga.net)
- [CVE-2025-23673](https://cve.now/CVE-2025-23673.md): WordPress Email on Publish plugin \<= 1.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, dkukral Email on Publish)
- [CVE-2025-23693](https://cve.now/CVE-2025-23693.md): WordPress Secure CAPTCHA plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, uosiu Secure CAPTCHA)
- [CVE-2025-23691](https://cve.now/CVE-2025-23691.md): WordPress Send to Twitter plugin \<= 1.7.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Braulio Aquino Send to Twitter)
- [CVE-2025-23665](https://cve.now/CVE-2025-23665.md): WordPress RSV GMaps plugin \<= 1.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Ravi Kumar Vanukuru RSV GMaps)
- [CVE-2025-23644](https://cve.now/CVE-2025-23644.md): WordPress QuoteMedia Tools plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, justin.kuepper QuoteMedia Tools)
- [CVE-2025-23661](https://cve.now/CVE-2025-23661.md): WordPress NV Slider plugin \<= 1.6 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, ryscript NV Slider)
- [CVE-2025-23649](https://cve.now/CVE-2025-23649.md): WordPress Auphonic Importer plugin \<= 1.5.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Kreg Steppe Auphonic Importer)
- [CVE-2025-23654](https://cve.now/CVE-2025-23654.md): WordPress Twitter Post plugin \<= 0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, krolow Twitter Post)
- [CVE-2025-23664](https://cve.now/CVE-2025-23664.md): WordPress Real Seguro Viagem plugin \<= 2.0.5 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, Real Seguro Viagem)
- [CVE-2025-23660](https://cve.now/CVE-2025-23660.md): WordPress MFPlugin plugin \<= 1.3 - CSRF to Cross-Site Scripting vulnerability (CVSS 7.1, waltercerrudo MFPlugin)
- [CVE-2025-23662](https://cve.now/CVE-2025-23662.md): WordPress WP Panoramio plugin \<= 1.5.0 - CSRF to Cross-Site Scripting vulnerability (CVSS 7.1, ryscript WP Panoramio)
- [CVE-2025-23659](https://cve.now/CVE-2025-23659.md): WordPress MercadoLibre Integration plugin \<= 1.1 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, hernanjh MercadoLibre Integration)
- [CVE-2025-23642](https://cve.now/CVE-2025-23642.md): WordPress Sidebar-Content from Shortcode plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, pflonk Sidebar-Content from Shortcode)
- [CVE-2025-23640](https://cve.now/CVE-2025-23640.md): WordPress Rename Author Slug plugin \<= 1.2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Nazmul Ahsan Rename Author Slug)
- [CVE-2025-23623](https://cve.now/CVE-2025-23623.md): WordPress Contact Form 7 – CCAvenue Add-on plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mahesh Bisen Contact Form 7 – CCAvenue Add-on)
- [CVE-2025-23641](https://cve.now/CVE-2025-23641.md): WordPress Powie's pLinks PagePeeker plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PowieT Powie's pLinks PagePeeker)
- [CVE-2025-23627](https://cve.now/CVE-2025-23627.md): WordPress Comment-Emailer plugin \<= 1.0.5 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, frenchsquared Comment-Emailer)
- [CVE-2025-23639](https://cve.now/CVE-2025-23639.md): WordPress MDC YouTube Downloader plugin \<= 3.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Nazmul Ahsan MDC YouTube Downloader)
- [CVE-2025-23573](https://cve.now/CVE-2025-23573.md): WordPress WP Background Tile plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, sammyb WP Background Tile)
- [CVE-2025-23618](https://cve.now/CVE-2025-23618.md): WordPress Twitter Shortcode plugin \<= 0.9 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, starise Twitter Shortcode)
- [CVE-2025-23577](https://cve.now/CVE-2025-23577.md): WordPress Word Freshener plugin \<= 1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, Sourov Amin Word Freshener)
- [CVE-2025-23559](https://cve.now/CVE-2025-23559.md): WordPress MemeOne plugin \<= 2.0.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Stepan Stepasyuk MemeOne)
- [CVE-2025-23617](https://cve.now/CVE-2025-23617.md): WordPress Floatbox Plus plugin \<= 1.4.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, cybio Floatbox Plus)
- [CVE-2025-23567](https://cve.now/CVE-2025-23567.md): WordPress GDReseller plugin \<= 1.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, Tamer Ziady GDReseller)
- [CVE-2025-23547](https://cve.now/CVE-2025-23547.md): WordPress LH Login Page plugin \<= 2.14 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, shawfactor LH Login Page)
- [CVE-2025-23569](https://cve.now/CVE-2025-23569.md): WordPress Shortcode in Comment plugin \<= 1.1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Kelvin Ng Shortcode in Comment)
- [CVE-2025-23620](https://cve.now/CVE-2025-23620.md): WordPress Captchelfie – Captcha by Selfie plugin \<= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, trof Captchelfie – Captcha by Selfie)
- [CVE-2025-23572](https://cve.now/CVE-2025-23572.md): WordPress UpDownUpDown plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Dave Konopka UpDownUpDown)
- [CVE-2025-23557](https://cve.now/CVE-2025-23557.md): WordPress Find Your Reps plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Kathleen Malone Find Your Reps)
- [CVE-2025-23560](https://cve.now/CVE-2025-23560.md): WordPress Web Testimonials plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, plumwd Web Testimonials)
- [CVE-2025-23566](https://cve.now/CVE-2025-23566.md): WordPress Custom Post plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, syedamirhussain91 Custom Post)
- [CVE-2025-23528](https://cve.now/CVE-2025-23528.md): WordPress DD Roles plugin \<= 4.1 - Privilege Escalation vulnerability (CVSS 8.8, Mosterd3d DD Roles)
- [CVE-2025-23532](https://cve.now/CVE-2025-23532.md): WordPress MyAnime Widget plugin \<= 1.0 - CSRF to Privilege Escalation vulnerability (CVSS 8.8, Regios MyAnime Widget)
- [CVE-2025-23558](https://cve.now/CVE-2025-23558.md): WordPress Geotagged Media plugin \<= 0.3.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, digitalfisherman Geotagged Media)
- [CVE-2025-23537](https://cve.now/CVE-2025-23537.md): WordPress add custom google tag manager plugin \<= 1.0.3 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, קידום ובניית אתרים add custom google tag manager)
- [CVE-2025-23510](https://cve.now/CVE-2025-23510.md): WordPress WordPress Logging Service plugin \<= 1.5.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jan Štětina WordPress Logging Service)
- [CVE-2025-23511](https://cve.now/CVE-2025-23511.md): WordPress WP-BlackCheck plugin \<= 2.7.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Stargazer WP-BlackCheck)
- [CVE-2025-23530](https://cve.now/CVE-2025-23530.md): WordPress Custom Post Type Lockdown plugin \<= 1.11 - CSRF to Privilege Escalation vulnerability (CVSS 8.8, yonisink Custom Post Type Lockdown)
- [CVE-2025-23533](https://cve.now/CVE-2025-23533.md): WordPress WP Lyrics plugin \<= 0.4.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, zetxek WP Lyrics)
- [CVE-2025-23514](https://cve.now/CVE-2025-23514.md): WordPress Loginplus plugin \<= 1.2 - Broken Access Control vulnerability (CVSS 5.3, Sanjay Prasad Loginplus)
- [CVE-2025-23513](https://cve.now/CVE-2025-23513.md): WordPress Bible Embed plugin \<= 0.0.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jd7777 Bible Embed)
- [CVE-2025-23499](https://cve.now/CVE-2025-23499.md): WordPress Board Election plugin \<= 1.0.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pascal Casier Board Election)
- [CVE-2025-23508](https://cve.now/CVE-2025-23508.md): WordPress Extra Options – Favicons plugin \<= 1.1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, OrigoThemes Extra Options – Favicons)
- [CVE-2025-23501](https://cve.now/CVE-2025-23501.md): WordPress Cookie Consent & Autoblock for GDPR/CCPA plugin \<= 1.0.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, SpruceJoy Cookie Consent & Autoblock for GDPR/CCPA)
- [CVE-2025-23435](https://cve.now/CVE-2025-23435.md): WordPress Password Protect Plugin for WordPress plugin \<= 0.8.1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, marcucci Password Protect Plugin for WordPress)
- [CVE-2025-23452](https://cve.now/CVE-2025-23452.md): WordPress EditionGuard for WooCommerce plugin \<= 3.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, EditionGuard for WooCommerce – eBook Sales with DRM)
- [CVE-2025-23438](https://cve.now/CVE-2025-23438.md): WordPress WP PT-Viewer plugin \<= 2.0.2 - Reflected XSS vulnerability (CVSS 7.1, Vincent Mimoun-Prat WP PT-Viewer)
- [CVE-2025-23497](https://cve.now/CVE-2025-23497.md): WordPress Simple Project Manager plugin \<= 1.2.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, albdesign Simple Project Manager)
- [CVE-2025-23434](https://cve.now/CVE-2025-23434.md): WordPress Easy EU Cookie law plugin \<= 1.3.3.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, viher3 Easy EU Cookie law)
- [CVE-2025-23471](https://cve.now/CVE-2025-23471.md): WordPress ECT Add to Cart Button plugin \<= 1.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, etemplates ECT Add to Cart Button)
- [CVE-2025-23444](https://cve.now/CVE-2025-23444.md): WordPress Scroll Top Advanced plugin \<= 2.5 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nasir179125 Scroll Top Advanced)
- [CVE-2025-23424](https://cve.now/CVE-2025-23424.md): WordPress Marquee Style RSS News Ticker plugin \<= 3.2.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, bnovotny Marquee Style RSS News Ticker)
- [CVE-2025-23426](https://cve.now/CVE-2025-23426.md): WordPress go Social plugin \<= 1.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Binesh Dobhal go Social)
- [CVE-2025-23453](https://cve.now/CVE-2025-23453.md): WordPress Stars SMTP Mailer plugin \<= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Myriad Solutionz Stars SMTP Mailer)
- [CVE-2025-23445](https://cve.now/CVE-2025-23445.md): WordPress Easy Tynt plugin \<= 0.2.5.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, scottswezey Easy Tynt)
- [CVE-2025-23430](https://cve.now/CVE-2025-23430.md): WordPress Mass Custom Fields Manager plugin \<= 1.5 - CSRF to Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Oren Yomtov Mass Custom Fields Manager)
- [CVE-2025-23455](https://cve.now/CVE-2025-23455.md): WordPress WP VTiger Synchronization plugin \<= 1.1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Master Software Solutions WP VTiger Synchronization)
- [CVE-2025-23436](https://cve.now/CVE-2025-23436.md): WordPress Wp-Scribd-List plugin \<= 1.2 - CSRF to XSS vulnerability (CVSS 7.1, capa Wp-Scribd-List)
- [CVE-2025-23442](https://cve.now/CVE-2025-23442.md): WordPress Shockingly Big IE6 Warning plugin \<= 1.6.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, mschertel Shockingly Big IE6 Warning)
- [CVE-2025-23456](https://cve.now/CVE-2025-23456.md): WordPress EmailShroud plugin \<= 2.2.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Oddthinking EmailShroud)
- [CVE-2025-23476](https://cve.now/CVE-2025-23476.md): WordPress my-related-posts plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, isnowfy my-related-posts)
- [CVE-2025-23429](https://cve.now/CVE-2025-23429.md): WordPress Altima Lookbook Free for WooCommerce plugin \<= 1.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, altima-interactive Altima Lookbook Free for WooCommerce)
- [CVE-2025-23483](https://cve.now/CVE-2025-23483.md): WordPress Universal Analytics Injector plugin \<= 1.0.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, hoyce Universal Analytics Injector)
- [CVE-2025-23463](https://cve.now/CVE-2025-23463.md): WordPress MD Custom content after or before of post plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Mukesh Dak MD Custom content after or before of post)
- [CVE-2025-23432](https://cve.now/CVE-2025-23432.md): WordPress AlT Report plugin \<= 1.12.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AlTi5 AlT Report)
- [CVE-2025-23470](https://cve.now/CVE-2025-23470.md): WordPress Visit Site Link enhanced plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, xavsio4 Visit Site Link enhanced)
- [CVE-2025-23467](https://cve.now/CVE-2025-23467.md): WordPress RSS News Scroller plugin \<= 2.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, vimal.ghorecha RSS News Scroller)
- [CVE-2025-23423](https://cve.now/CVE-2025-23423.md): WordPress SendGrid for WordPress plugin \<= 1.4 - Broken Access Control vulnerability (CVSS 4.3, Smackcoders Inc., SendGrid for WordPress)
- [CVE-2024-55954](https://cve.now/CVE-2024-55954.md): OpenObserve Improper Authorization Allows Admin User to Remove Root User (CVSS 8.7, openobserve)
- [CVE-2024-56136](https://cve.now/CVE-2024-56136.md): /api/v1/jwt/fetch\_api\_key endpoint can leak if an email address has an account in Zulip server (CVSS 6.9, zulip)
- [CVE-2024-36402](https://cve.now/CVE-2024-36402.md): Unauthenticated writes to the media repository allow planting of problematic content in Matrix Media Repo (CVSS 5.3, t2bot matrix-media-repo · github.com/t2bot/matrix-media-repo)
- [CVE-2024-36403](https://cve.now/CVE-2024-36403.md): Denial of service/high operating costs through unauthenticated downloads in Matrix Media Repo (CVSS 5.3, t2bot matrix-media-repo · github.com/t2bot/matrix-media-repo)
- [CVE-2024-52602](https://cve.now/CVE-2024-52602.md): Server-Side Request Forgery (SSRF) on redirects and federation in Matrix Media Repo (CVSS 5.0, t2bot matrix-media-repo · github.com/t2bot/matrix-media-repo)
- [CVE-2024-52791](https://cve.now/CVE-2024-52791.md): Denial of service through memory exhaustion in Matrix Media Repo (CVSS 5.3, t2bot matrix-media-repo · github.com/t2bot/matrix-media-repo)
- [CVE-2024-56515](https://cve.now/CVE-2024-56515.md): Untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in Matrix Media Repo (CVSS 6.8, t2bot matrix-media-repo · github.com/t2bot/matrix-media-repo)
- [CVE-2024-52594](https://cve.now/CVE-2024-52594.md): Server-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlib (CVSS 4.3, matrix-org gomatrixserverlib · github.com/matrix-org/gomatr…)
- [CVE-2025-20630](https://cve.now/CVE-2025-20630.md): Mobile crash via object that can't be cast to String in Attachment Field (CVSS 6.5, Mattermost)
- [CVE-2025-20621](https://cve.now/CVE-2025-20621.md): Webapp crash via object that can't be cast to String in Attachment Field (CVSS 6.5, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2024-37181](https://cve.now/CVE-2024-37181.md): Time-of-check time-of-use race condition in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to (CVSS 2.1, Intel(R) Neural Compressor software)
- [CVE-2025-20072](https://cve.now/CVE-2025-20072.md): Mobile crash via improper validation of proto style in attachments (CVSS 6.5, Mattermost)
- [CVE-2024-41746](https://cve.now/CVE-2024-41746.md): IBM CICS TX cross-site scripting (CVSS 7.2, IBM CICS TX Advanced · IBM CICS TX Standard)
- [CVE-2025-0518](https://cve.now/CVE-2025-0518.md): Unchecked sscanf return value which leads to memory data leak (CVSS 4.8, FFmpeg)
- [CVE-2025-0473](https://cve.now/CVE-2025-0473.md): Incomplete Cleanup vulnerability in PMB platform (CVSS 6.5, PMB Services PMB platform)
- [CVE-2025-0472](https://cve.now/CVE-2025-0472.md): Information exposure vulnerability in PMB platform (CVSS 7.5, PMB Services PMB platform)
- [CVE-2025-0471](https://cve.now/CVE-2025-0471.md): Unrestricted Upload of File with Dangerous Type vulnerability in PMB platform (CVSS 9.9, PMB Services PMB platform)
- [CVE-2018-25108](https://cve.now/CVE-2018-25108.md): WAGO: Denial of service in 750-8xx controller due to uncontrolled resource consumption (CVSS 7.5, WAGO 750-8100 · WAGO 750-831 +2)
- [CVE-2024-12427](https://cve.now/CVE-2024-12427.md): Multi Step Form \<= 1.7.23 - Missing Authorization to Unauthenticated Limited File Upload (CVSS 5.3, mondula2016 Multi Step Form)
- [CVE-2024-12613](https://cve.now/CVE-2024-12613.md): Passwords Manager \<= 1.4.8 - Unauthenticated SQL Injection (CVSS 7.5, coder426 Passwords Manager)
- [CVE-2024-12615](https://cve.now/CVE-2024-12615.md): Passwords Manager \<= 1.4.8 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, coder426 Passwords Manager)
- [CVE-2024-12614](https://cve.now/CVE-2024-12614.md): Passwords Manager \<= 1.4.8 - Missing Authorization to Authenticated (Subscriber+) Add Password + Update Encryption Key (CVSS 7.5, coder426 Passwords Manager)
- [CVE-2024-13355](https://cve.now/CVE-2024-13355.md): Admin and Customer Messages After Order for WooCommerce \<= 13.2 - Authenticated (Subscriber+) Limited File Upload to Cross-Site Scripting (CVSS 5.4, nmedia Admin and Customer Messages After Order for WooComme…)
- [CVE-2024-13387](https://cve.now/CVE-2024-13387.md): WP Responsive Tabs \<= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, fahadmahmood WP Responsive Tabs)
- [CVE-2024-50563](https://cve.now/CVE-2024-50563.md): A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud v (CVSS 6.7, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2024-48885](https://cve.now/CVE-2024-48885.md): A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1 (CVSS 5.2, Fortinet FortiVoice · Fortinet FortiRecorder +1)
- [CVE-2024-45331](https://cve.now/CVE-2024-45331.md): A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyz (CVSS 6.9, Fortinet FortiAnalyzer Cloud · Fortinet FortiManager +1)
- [CVE-2024-12226](https://cve.now/CVE-2024-12226.md): In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in cle (CVSS 6.5, Octopus Deploy Kubernetes Worker or Kubernetes Agent)
- [CVE-2024-10789](https://cve.now/CVE-2024-10789.md): WP User Profile Avatar \<= 1.0.5 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, wpeventmanager WP User Profile Avatar)
- [CVE-2024-11452](https://cve.now/CVE-2024-11452.md): Chamber Dashboard Business Directory \<= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, gwendydd Chamber Dashboard Business Directory)
- [CVE-2024-10970](https://cve.now/CVE-2024-10970.md): Motors – Car Dealer, Classifieds & Listing \<= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title (CVSS 5.4, stylemix Motors – Car Dealership & Classified Listings Plug…)
- [CVE-2025-0170](https://cve.now/CVE-2025-0170.md): DWT - Directory & Listing WordPress Theme \<= 3.3.3 - Reflected Cross-Site Scripting (CVSS 6.1, scriptsbundle DWT - Directory & Listing WordPress Theme)
- [CVE-2025-0457](https://cve.now/CVE-2025-0457.md): NetVision Information airPASS - OS Command Injection (CVSS 8.8, NetVision Information airPASS)
- [CVE-2025-0456](https://cve.now/CVE-2025-0456.md): NetVision Information airPASS - Missing Authentication (CVSS 9.8, NetVision Information airPASS)
- [CVE-2025-0455](https://cve.now/CVE-2025-0455.md): NetVision Information airPASS - SQL injection (CVSS 9.8, NetVision Information airPASS)
- [CVE-2024-40513](https://cve.now/CVE-2024-40513.md): An issue in themesebrand Chatvia v.5.3.2 allows a remote attacker to execute arbitrary code via the User profile Upload image function. (CVSS 4.6)
- [CVE-2024-40514](https://cve.now/CVE-2024-40514.md): Insecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to escalate privileges via the User profile name (CVSS 4.6)
- [CVE-2024-46450](https://cve.now/CVE-2024-46450.md): Incorrect access control in Tenda AC1200 Smart Dual-Band WiFi Router Model AC6 v2.0 Firmware v15.03.06.50 allows attackers to bypass authent (CVSS 8.1)
- [CVE-2024-48460](https://cve.now/CVE-2024-48460.md): An issue in Eugeny Tabby 1.0.213 allows a remote attacker to obtain sensitive information via the server and sends the SSH username and pass (CVSS 4.3, tabby-ssh)
- [CVE-2024-50633](https://cve.now/CVE-2024-50633.md): A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted P (CVSS 0.0, CERN Indico · indico)
- [CVE-2024-53553](https://cve.now/CVE-2024-53553.md): An issue in OPEXUS FOIAXPRESS PUBLIC ACCESS LINK v11.1.0 allows attackers to bypass authentication via crafted web requests. (CVSS 9.1)
- [CVE-2024-54660](https://cve.now/CVE-2024-54660.md): A JNDI injection issue was discovered in Cloudera JDBC Connector for Hive before 2.6.26 and JDBC Connector for Impala before 2.6.35. (CVSS 8.7)
- [CVE-2024-55511](https://cve.now/CVE-2024-55511.md): A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentially (CVSS 7.8)
- [CVE-2024-57159](https://cve.now/CVE-2024-57159.md): 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via /erp.07fly.net:80/oa/OaWorkReport/add.html. (CVSS 3.5)
- [CVE-2024-57160](https://cve.now/CVE-2024-57160.md): 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via /erp.07fly.net:80/oa/OaTask/edit.html. (CVSS 4.3)
- [CVE-2024-57161](https://cve.now/CVE-2024-57161.md): 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via /erp.07fly.net:80/oa/OaWorkReport/edit.html (CVSS 4.3)
- [CVE-2024-57162](https://cve.now/CVE-2024-57162.md): Campcodes Cybercafe Management System v1.0 is vulnerable to SQL Injection in /ccms/view-user-detail.php. (CVSS 7.2)
- [CVE-2024-57575](https://cve.now/CVE-2024-57575.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the ssid parameter in the form\_fast\_setting\_wifi\_set function. (CVSS 9.8)
- [CVE-2024-57577](https://cve.now/CVE-2024-57577.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the speed\_dir parameter in the formSetSpeedWan function. (CVSS 5.7)
- [CVE-2024-57578](https://cve.now/CVE-2024-57578.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the funcpara1 parameter in the formSetCfm function. (CVSS 5.7)
- [CVE-2024-57579](https://cve.now/CVE-2024-57579.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the limitSpeedUp parameter in the formSetClientState function. (CVSS 9.8)
- [CVE-2024-57580](https://cve.now/CVE-2024-57580.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function. (CVSS 9.8)
- [CVE-2024-57581](https://cve.now/CVE-2024-57581.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function. (CVSS 9.8)
- [CVE-2024-57582](https://cve.now/CVE-2024-57582.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the startIP parameter in the formSetPPTPServer function. (CVSS 9.8)
- [CVE-2024-57583](https://cve.now/CVE-2024-57583.md): Tenda AC18 V15.03.05.19 was discovered to contain a command injection vulnerability via the usbName parameter in the formSetSambaConf functi (CVSS 9.8)
- [CVE-2024-57611](https://cve.now/CVE-2024-57611.md): 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/doAdminAction.php?act=editShop&shopId. (CVSS 3.5)
- [CVE-2024-57676](https://cve.now/CVE-2024-57676.md): An access control issue in the component form2WlanBasicSetup.cgi of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated attackers (CVSS 6.5)
- [CVE-2024-57677](https://cve.now/CVE-2024-57677.md): An access control issue in the component form2Wan.cgi of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated attackers to set the (CVSS 6.5)
- [CVE-2024-57678](https://cve.now/CVE-2024-57678.md): An access control issue in the component form2WlAc.cgi of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated attackers to set the (CVSS 6.5)
- [CVE-2024-57679](https://cve.now/CVE-2024-57679.md): An access control issue in the component form2RepeaterSetup.cgi of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated attackers t (CVSS 6.5)
- [CVE-2024-57680](https://cve.now/CVE-2024-57680.md): An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated attackers (CVSS 5.3)
- [CVE-2024-57681](https://cve.now/CVE-2024-57681.md): An access control issue in the component form2alg.cgi of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated attackers to set the (CVSS 5.3)
- [CVE-2024-57682](https://cve.now/CVE-2024-57682.md): An information disclosure vulnerability in the component d\_status.asp of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated attac (CVSS 6.5)
- [CVE-2024-57683](https://cve.now/CVE-2024-57683.md): An access control issue in the component websURLFilterAddDel of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated attackers to s (CVSS 4.3)
- [CVE-2024-57684](https://cve.now/CVE-2024-57684.md): An access control issue in the component formDMZ.cgi of D-Link 816A2\_FWv1.10CNB05\_R1B011D88210 allows unauthenticated attackers to set the D (CVSS 9.8)
- [CVE-2024-57703](https://cve.now/CVE-2024-57703.md): Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability. (CVSS 7.3)
- [CVE-2024-57704](https://cve.now/CVE-2024-57704.md): Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability. (CVSS 4.6)
- [CVE-2024-57768](https://cve.now/CVE-2024-57768.md): JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component validRoleKey?sysRole.key. (CVSS 9.8)
- [CVE-2024-57769](https://cve.now/CVE-2024-57769.md): JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component borrowmoney/listData?applyUser. (CVSS 8.8)
- [CVE-2024-57770](https://cve.now/CVE-2024-57770.md): JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id. (CVSS 8.8)
- [CVE-2024-57771](https://cve.now/CVE-2024-57771.md): A cross-site scripting (XSS) vulnerability in the common/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execu (CVSS 4.8)
- [CVE-2024-57772](https://cve.now/CVE-2024-57772.md): A cross-site scripting (XSS) vulnerability in the /bumph/getDraftListPage?type interface of JFinalOA before v2025.01.01 allows attackers to (CVSS 4.8)
- [CVE-2024-57773](https://cve.now/CVE-2024-57773.md): A cross-site scripting (XSS) vulnerability in the openSelectManyUserPage?orgid interface of JFinalOA before v2025.01.01 allows attackers to (CVSS 4.8)
- [CVE-2024-57774](https://cve.now/CVE-2024-57774.md): A cross-site scripting (XSS) vulnerability in the getBusinessUploadListPage?busid interface of JFinalOA before v2025.01.01 allows attackers (CVSS 4.8)
- [CVE-2024-57775](https://cve.now/CVE-2024-57775.md): JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component getWorkFlowHis?insid. (CVSS 8.8)
- [CVE-2024-57776](https://cve.now/CVE-2024-57776.md): A cross-site scripting (XSS) vulnerability in the /apply/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execu (CVSS 4.6)
- [CVE-2024-57784](https://cve.now/CVE-2024-57784.md): An issue in the component /php/script\_uploads.php of Zenitel AlphaWeb XE v11.2.3.10 allows attackers to execute a directory traversal. (CVSS 5.5)
- [CVE-2024-57785](https://cve.now/CVE-2024-57785.md): Zenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc\_uploads.php. (CVSS 4.9)
- [CVE-2025-22904](https://cve.now/CVE-2025-22904.md): RE11S v1.11 was discovered to contain a stack overflow via the pptpUserName parameter in the setWAN function. (CVSS 9.8)
- [CVE-2025-22905](https://cve.now/CVE-2025-22905.md): RE11S v1.11 was discovered to contain a command injection vulnerability via the command parameter at /goform/mp. (CVSS 9.8)
- [CVE-2025-22906](https://cve.now/CVE-2025-22906.md): RE11S v1.11 was discovered to contain a command injection vulnerability via the L2TPUserName parameter at /goform/setWAN. (CVSS 9.8)
- [CVE-2025-22907](https://cve.now/CVE-2025-22907.md): RE11S v1.11 was discovered to contain a stack overflow via the selSSID parameter in the formWlSiteSurvey function. (CVSS 9.8)
- [CVE-2025-22912](https://cve.now/CVE-2025-22912.md): RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept. (CVSS 9.8)
- [CVE-2025-22913](https://cve.now/CVE-2025-22913.md): RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formStaDrvSetup function. (CVSS 9.8)
- [CVE-2025-22916](https://cve.now/CVE-2025-22916.md): RE11S v1.11 was discovered to contain a stack overflow via the pppUserName parameter in the formPPPoESetup function. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.