CVEs published January 18, 2025
35 CVEs were published on January 18, 2025: 1 critical, 5 high. 1 is now in CISA KEV.
- Published
- 35
- Critical
- 1
- High
- 5
- Medium
- 29
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 2
Most affected products
- IBM Robotic Process Automation
- 2
- ultimatemember Ultimate Member – User Profile, Registration…
- 2
- advancedcreation ShipWorks Connector for Woocommerce
- 1
- Campcodes School Management Software
- 1
- CampCodes School Management Software
- 1
- cmsmasters Buzz Club – Night Club, DJ and Music Festival Ev…
- 1
- craftcms cms · craftcms/cms
- 1
- Crocoblock JetEngine
- 1
- eteubert Podlove Podcast Publisher
- 1
- evergreencontentposter Evergreen Content Poster – Auto Post…
- 1
Critical 1
High 5
- CVE-2024-45662IBM Safer Payments denial of serviceIBM Safer Payments
- CVE-2024-47113IBM ICP - Voice Gateway XML injectionIBM Voice Gateway
- CVE-2024-13184The Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Modulewpextended The Ultimate WordPress Toolkit – WP Extended
- CVE-2025-0308Ultimate Member <= 2.9.1 - Unauthenticated SQL Injectionultimatemember Ultimate Member – User Profile, Registration…
- CVE-2025-23209Potential RCE with a compromised security key in craft/cmscraftcms cms · craftcms/cms
Medium, low and unrated 29
- CVE-2025-0561itsourcecode Farm Management System add-pig.php sql injectionitsourcecode Farm Management System
- CVE-2024-47106IBM Jazz for Service Management information disclosureIBM Jazz for Service Management
- CVE-2024-49354IBM Concert information disclosureIBM Concert Software
- CVE-2024-49824IBM Robotic Process Automation security bypassIBM Robotic Process Automation
- CVE-2024-51448IBM Robotic Process Automation privilege escalationIBM Robotic Process Automation
- CVE-2025-0560CampCodes School Management Software Photo Gallery Page photo-gallery cross site scriptingCampCodes School Management Software
- CVE-2024-49338IBM App Connect Enterprise information disclosureIBM App Connect Enterprise
- CVE-2025-0559Campcodes School Management Software Create Id Card Page create-id-card cross site scriptingCampcodes School Management Software
- CVE-2025-0558TDuckCloud tduck-platform QueryProThemeRequest.java QueryProThemeRequest sql injectionTDuckCloud tduck-platform
- CVE-2025-0557Hyland Alfresco Community Edition URL s cross site scriptingHyland Alfresco Community Edition · Hyland Alfresco Enterpr…
- CVE-2024-13392Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingvideowhisper Rate Star Review Vote – AJAX Reviews, Votes, S…
- CVE-2024-13433Utilities for MTG <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingyunra Utilities for MTG
- CVE-2024-13393Video Share VOD – Turnkey Video Site Builder Script <= 2.6.31 - Authenticated (Contributor+) Stored Cross-Site Scriptingvideowhisper Video Share VOD – Turnkey Video Site Builder S…
- CVE-2025-0369Jet Engine <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag ParameterCrocoblock JetEngine
- CVE-2024-12696Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via videowhisper_picture_upload_guest Shortcodevideowhisper Picture Gallery – Frontend Image Uploads, AJAX…
- CVE-2024-13385JSM Screenshot Machine Shortcode <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingjsmoriss JSM Screenshot Machine Shortcode
- CVE-2024-13517Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Titlesmub Easy Digital Downloads – eCommerce Payments and Subscr…
- CVE-2024-12385WP Abstracts <= 2.7.2 - Cross-Site Request Forgery to Reflected Cross-Site Scriptingkevonadonis WP Abstracts
- CVE-2024-13519MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 1.9.80 - Authenticated (Shop Manager+) Stored Cross-Site Scriptingwebwizardsdev MarketKing — Ultimate WooCommerce Multivendor…
- CVE-2024-13317ShipWorks Connector for Woocommerce <= 5.2.5 - Cross-Site Request Forgery to Service Password/Username Updateadvancedcreation ShipWorks Connector for Woocommerce
- CVE-2025-0515Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Option Updatecmsmasters Buzz Club – Night Club, DJ and Music Festival Ev…
- CVE-2024-13432Webcamconsult <= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scriptingsjhand Webcamconsult
- CVE-2024-13391MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet <= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scriptingvideowhisper MicroPayments – Fans Paysite: Paid Creator Sub…
- CVE-2024-9020List category posts < 0.90.3 - Author+ Stored XSSList category posts
- CVE-2024-13516Kubio AI Page Builder <= 2.3.5 - Reflected Cross-Site Scriptingextendthemes Kubio AI Page Builder
- CVE-2024-13515Image Source Control Lite – Show Image Credits and Captions <= 2.28.0 - Reflected Cross-Site Scriptingwebzunft Image Source Control Lite – Show Image Credits and…
- CVE-2025-0318Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposureultimatemember Ultimate Member – User Profile, Registration…
- CVE-2025-0554Podlove Podcast Publisher <= 4.1.25 - Authenticated (Admin+) Stored Cross-Site Scripting via Feed Nameeteubert Podlove Podcast Publisher
- CVE-2024-12071Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Post Deletionevergreencontentposter Evergreen Content Poster – Auto Post…