# CVEs published 2025-01-18

35 CVEs were published on January 18, 2025: 1 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-0561](https://cve.now/CVE-2025-0561.md): itsourcecode Farm Management System add-pig.php sql injection (CVSS 5.3, itsourcecode Farm Management System)
- [CVE-2024-45662](https://cve.now/CVE-2024-45662.md): IBM Safer Payments denial of service (CVSS 7.5, IBM Safer Payments)
- [CVE-2024-47106](https://cve.now/CVE-2024-47106.md): IBM Jazz for Service Management information disclosure (CVSS 5.3, IBM Jazz for Service Management)
- [CVE-2024-47113](https://cve.now/CVE-2024-47113.md): IBM ICP - Voice Gateway XML injection (CVSS 8.1, IBM Voice Gateway)
- [CVE-2024-49354](https://cve.now/CVE-2024-49354.md): IBM Concert information disclosure (CVSS 5.3, IBM Concert Software)
- [CVE-2024-49824](https://cve.now/CVE-2024-49824.md): IBM Robotic Process Automation security bypass (CVSS 6.5, IBM Robotic Process Automation)
- [CVE-2024-51448](https://cve.now/CVE-2024-51448.md): IBM Robotic Process Automation privilege escalation (CVSS 6.7, IBM Robotic Process Automation)
- [CVE-2025-0560](https://cve.now/CVE-2025-0560.md): CampCodes School Management Software Photo Gallery Page photo-gallery cross site scripting (CVSS 5.1, CampCodes School Management Software)
- [CVE-2024-49338](https://cve.now/CVE-2024-49338.md): IBM App Connect Enterprise information disclosure (CVSS 4.4, IBM App Connect Enterprise)
- [CVE-2025-0559](https://cve.now/CVE-2025-0559.md): Campcodes School Management Software Create Id Card Page create-id-card cross site scripting (CVSS 5.1, Campcodes School Management Software)
- [CVE-2025-0558](https://cve.now/CVE-2025-0558.md): TDuckCloud tduck-platform QueryProThemeRequest.java QueryProThemeRequest sql injection (CVSS 5.3, TDuckCloud tduck-platform)
- [CVE-2025-0557](https://cve.now/CVE-2025-0557.md): Hyland Alfresco Community Edition URL s cross site scripting (CVSS 6.9, Hyland Alfresco Community Edition · Hyland Alfresco Enterpr…)
- [CVE-2024-13375](https://cve.now/CVE-2024-13375.md): Adifier System \<= 3.1.7 - Unauthenticated Arbitrary Password Reset (CVSS 9.8, spoonthemes Adifier System)
- [CVE-2024-13184](https://cve.now/CVE-2024-13184.md): The Ultimate WordPress Toolkit – WP Extended \<= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module (CVSS 7.5, wpextended The Ultimate WordPress Toolkit – WP Extended)
- [CVE-2024-13392](https://cve.now/CVE-2024-13392.md): Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings \<= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, videowhisper Rate Star Review Vote – AJAX Reviews, Votes, S…)
- [CVE-2024-13433](https://cve.now/CVE-2024-13433.md): Utilities for MTG \<= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, yunra Utilities for MTG)
- [CVE-2024-13393](https://cve.now/CVE-2024-13393.md): Video Share VOD – Turnkey Video Site Builder Script \<= 2.6.31 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, videowhisper Video Share VOD – Turnkey Video Site Builder S…)
- [CVE-2025-0369](https://cve.now/CVE-2025-0369.md): Jet Engine \<= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list\_tag Parameter (CVSS 6.4, Crocoblock JetEngine)
- [CVE-2024-12696](https://cve.now/CVE-2024-12696.md): Picture Gallery – Frontend Image Uploads, AJAX Photo List \<= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via videowhisper\_picture\_upload\_guest Shortcode (CVSS 6.4, videowhisper Picture Gallery – Frontend Image Uploads, AJAX…)
- [CVE-2024-13385](https://cve.now/CVE-2024-13385.md): JSM Screenshot Machine Shortcode \<= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, jsmoriss JSM Screenshot Machine Shortcode)
- [CVE-2024-13517](https://cve.now/CVE-2024-13517.md): Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) \<= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title (CVSS 4.4, smub Easy Digital Downloads – eCommerce Payments and Subscr…)
- [CVE-2024-12385](https://cve.now/CVE-2024-12385.md): WP Abstracts \<= 2.7.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 6.1, kevonadonis WP Abstracts)
- [CVE-2024-13519](https://cve.now/CVE-2024-13519.md): MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution \<= 1.9.80 - Authenticated (Shop Manager+) Stored Cross-Site Scripting (CVSS 4.4, webwizardsdev MarketKing — Ultimate WooCommerce Multivendor…)
- [CVE-2024-13317](https://cve.now/CVE-2024-13317.md): ShipWorks Connector for Woocommerce \<= 5.2.5 - Cross-Site Request Forgery to Service Password/Username Update (CVSS 4.3, advancedcreation ShipWorks Connector for Woocommerce)
- [CVE-2025-0515](https://cve.now/CVE-2025-0515.md): Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme \<= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Option Update (CVSS 4.3, cmsmasters Buzz Club – Night Club, DJ and Music Festival Ev…)
- [CVE-2024-13432](https://cve.now/CVE-2024-13432.md): Webcamconsult \<= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, sjhand Webcamconsult)
- [CVE-2024-13391](https://cve.now/CVE-2024-13391.md): MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet \<= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, videowhisper MicroPayments – Fans Paysite: Paid Creator Sub…)
- [CVE-2024-9020](https://cve.now/CVE-2024-9020.md): List category posts \< 0.90.3 - Author+ Stored XSS (CVSS 5.4, List category posts)
- [CVE-2025-0308](https://cve.now/CVE-2025-0308.md): Ultimate Member \<= 2.9.1 - Unauthenticated SQL Injection (CVSS 7.5, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2024-13516](https://cve.now/CVE-2024-13516.md): Kubio AI Page Builder \<= 2.3.5 - Reflected Cross-Site Scripting (CVSS 6.1, extendthemes Kubio AI Page Builder)
- [CVE-2024-13515](https://cve.now/CVE-2024-13515.md): Image Source Control Lite – Show Image Credits and Captions \<= 2.28.0 - Reflected Cross-Site Scripting (CVSS 6.1, webzunft Image Source Control Lite – Show Image Credits and…)
- [CVE-2025-0318](https://cve.now/CVE-2025-0318.md): Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin \<= 2.9.1 - Information Exposure (CVSS 5.3, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2025-0554](https://cve.now/CVE-2025-0554.md): Podlove Podcast Publisher \<= 4.1.25 - Authenticated (Admin+) Stored Cross-Site Scripting via Feed Name (CVSS 4.4, eteubert Podlove Podcast Publisher)
- [CVE-2024-12071](https://cve.now/CVE-2024-12071.md): Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media \<= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (CVSS 5.3, evergreencontentposter Evergreen Content Poster – Auto Post…)
- [CVE-2025-23209](https://cve.now/CVE-2025-23209.md): Potential RCE with a compromised security key in craft/cms (CVSS 8.1, KEV, craftcms cms · craftcms/cms)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.