# CVEs published 2025-01-22 171 CVEs were published on January 22, 2025: 10 critical, 111 high. Days are UTC. - [CVE-2024-12477](https://cve.now/CVE-2024-12477.md): Avada Builder \<= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets (CVSS 6.4, themefusion Avada (Fusion) Builder) - [CVE-2025-0612](https://cve.now/CVE-2025-0612.md): Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption (CVSS 7.5, Google Chrome) - [CVE-2025-0611](https://cve.now/CVE-2025-0611.md): Object corruption in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.2, Google Chrome) - [CVE-2024-9310](https://cve.now/CVE-2024-9310.md): Traffic Alert and Collision Avoidance System (TCAS) II has a Reliance on Untrusted Inputs in a Security Decision vulnerability (CVSS 6.0, Traffic Alert and Collision Avoidance System (TCAS) II Coll…) - [CVE-2024-11166](https://cve.now/CVE-2024-11166.md): Traffic Alert and Collision Avoidance System (TCAS) II has an External Control of System or Configuration Setting vulnerability (CVSS 7.1, Traffic Alert and Collision Avoidance System (TCAS) II Coll…) - [CVE-2025-0651](https://cve.now/CVE-2025-0651.md): File symlink abuse might lead to deleting files belonging to SYSTEM user (CVSS 6.1, Cloudflare WARP) - [CVE-2025-23047](https://cve.now/CVE-2025-23047.md): Cilium vulnerable to information leakage via insecure default Hubble UI CORS header (CVSS 6.5, cilium · github.com/cilium/cilium) - [CVE-2025-24403](https://cve.now/CVE-2025-24403.md): A missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read permission to enumerate (CVSS 4.3, Jenkins Project Jenkins Azure Service Fabric Plugin · org.j…) - [CVE-2025-24402](https://cve.now/CVE-2025-24402.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers to connect to a Se (CVSS 4.3, Jenkins Project Jenkins Azure Service Fabric Plugin · org.j…) - [CVE-2025-24401](https://cve.now/CVE-2025-24401.md): Jenkins Folder-based Authorization Strategy Plugin 217.vd5b\_18537403e and earlier does not verify that permissions configured to be granted (CVSS 6.8, Jenkins Project Jenkins Folder-based Authorization Strategy…) - [CVE-2025-24400](https://cve.now/CVE-2025-24400.md): Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, a (CVSS 4.3, Jenkins Project Jenkins Eiffel Broadcaster Plugin · com.axi…) - [CVE-2025-24399](https://cve.now/CVE-2025-24399.md): Jenkins OpenId Connect Authentication Plugin 4.452.v2849b\_d3945fa\_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-ins (CVSS 8.8, Jenkins Project Jenkins OpenId Connect Authentication Plugi…) - [CVE-2025-24398](https://cve.now/CVE-2025-24398.md): Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF p (CVSS 8.8, Jenkins Project Jenkins Bitbucket Server Integration Plugin…) - [CVE-2025-24397](https://cve.now/CVE-2025-24397.md): An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacki (CVSS 4.3, Jenkins Project Jenkins GitLab Plugin · org.jenkins-ci.plug…) - [CVE-2025-23028](https://cve.now/CVE-2025-23028.md): DoS in Cilium agent DNS proxy from crafted DNS responses (CVSS 5.3, cilium · github.com/cilium/cilium) - [CVE-2024-51457](https://cve.now/CVE-2024-51457.md): IBM Robotic Process Automation for Cloud Pak cross-site scripting (CVSS 4.4, IBM Robotic Process Automation for Cloud Pak) - [CVE-2025-20165](https://cve.now/CVE-2025-20165.md): Cisco BroadWorks SIP Denial of Service Vulnerability (CVSS 7.5, Cisco BroadWorks) - [CVE-2025-20156](https://cve.now/CVE-2025-20156.md): Cisco Meeting Management Client-Server Privilege Escalation Vulnerability (CVSS 9.9, Cisco Meeting Management) - [CVE-2025-20128](https://cve.now/CVE-2025-20128.md): ClamAV OLE2 File Format Decryption Denial of Service Vulnerability (CVSS 5.3, Cisco Secure Endpoint) - [CVE-2024-31903](https://cve.now/CVE-2024-31903.md): IBM Sterling B2B Integrator Standard Edition code execution (CVSS 8.8, IBM Sterling B2B Integrator Standard Edition) - [CVE-2024-10929](https://cve.now/CVE-2024-10929.md): Spectre-BSE (CVSS 5.1, Arm Cortex-A72 · Arm Cortex-A73 +2) - [CVE-2025-0638](https://cve.now/CVE-2025-0638.md): Routinator crashes when illegal characters are present in manifest file names (CVSS 7.5, NLnet Labs Routinator) - [CVE-2025-23914](https://cve.now/CVE-2025-23914.md): WordPress Muzaara Google Ads Report Plugin \<= 3.1 - PHP Object Injection vulnerability (CVSS 9.8, Muzaara Google Ads Report) - [CVE-2025-23809](https://cve.now/CVE-2025-23809.md): WordPress Blue Wrench Video Widget Plugin \<= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sunil Nanda Blue Wrench Video Widget) - [CVE-2025-23992](https://cve.now/CVE-2025-23992.md): WordPress Toocheke Companion plugin \<= 1.166 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Toocheke Companion) - [CVE-2025-0604](https://cve.now/CVE-2025-0604.md): Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak (CVSS 5.4, keycloak-ldap-federation · Red Hat Build of Keycloak +2) - [CVE-2025-23882](https://cve.now/CVE-2025-23882.md): WordPress WP Download Codes Plugin \<= 2.5.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, misanthrop WP Download Codes) - [CVE-2025-23846](https://cve.now/CVE-2025-23846.md): WordPress Flexible Blogtitle Plugin \<= 0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, thaikolja Flexible Blogtitle) - [CVE-2025-23812](https://cve.now/CVE-2025-23812.md): WordPress Contact Form 7 Round Robin Lead Distribution Plugin \<= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, David Jeffrey Contact Form 7 Round Robin Lead Distribution) - [CVE-2025-23768](https://cve.now/CVE-2025-23768.md): WordPress InFunding plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, inwavethemes InFunding) - [CVE-2025-23746](https://cve.now/CVE-2025-23746.md): WordPress CMC MIGRATE plugin \<= 0.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Edem CMC MIGRATE) - [CVE-2025-23709](https://cve.now/CVE-2025-23709.md): WordPress Formatted post plugin \<= 1.01 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kiroro Formatted post) - [CVE-2025-23643](https://cve.now/CVE-2025-23643.md): WordPress ReadMe Creator plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, a.ankit ReadMe Creator) - [CVE-2025-23506](https://cve.now/CVE-2025-23506.md): WordPress WP IMAP Auth plugin \<= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, imsoftware WP IMAP Auth) - [CVE-2025-23486](https://cve.now/CVE-2025-23486.md): WordPress Database Sync plugin \<= 0.5.1 - Sensitive Data Exposure vulnerability (CVSS 6.5, tamlyn Database Sync) - [CVE-2025-23475](https://cve.now/CVE-2025-23475.md): WordPress History timeline plugin \<= 0.7.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fireantology History timeline) - [CVE-2025-23462](https://cve.now/CVE-2025-23462.md): WordPress FWD Slider plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Anil Jailta FWD Slider) - [CVE-2025-23449](https://cve.now/CVE-2025-23449.md): WordPress Simple shortcode buttons plugin \<= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, davidpuc Simple shortcode buttons) - [CVE-2025-22772](https://cve.now/CVE-2025-22772.md): WordPress Mapbox for WP Advanced Plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, stephanemartinw Mapbox for WP Advanced) - [CVE-2025-23966](https://cve.now/CVE-2025-23966.md): WordPress a Gateway for Pasargad Bank on WooCommerce Plugin \<= 2.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ala Falaki a Gateway for Pasargad Bank on WooCommerce) - [CVE-2025-23959](https://cve.now/CVE-2025-23959.md): WordPress Good Old Gallery Plugin \<= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Linus Lundahl Good Old Gallery) - [CVE-2025-23953](https://cve.now/CVE-2025-23953.md): WordPress user files plugin \<= 2.4.2 - Arbitrary File Upload vulnerability (CVSS 10.0, Scriptonite user files) - [CVE-2025-23949](https://cve.now/CVE-2025-23949.md): WordPress Improved Sale Badges – Free Version Plugin \<= 1.0.1 - Local File Inclusion vulnerability (CVSS 8.1, dzeriho Improved Sale Badges – Free Version) - [CVE-2025-23948](https://cve.now/CVE-2025-23948.md): WordPress Background animation blocks Plugin \<= 2.1.5 - Local File Inclusion vulnerability (CVSS 8.1, Webarea Background animation blocks) - [CVE-2025-23944](https://cve.now/CVE-2025-23944.md): WordPress WOOEXIM Plugin \<= 5.0.0 - PHP Object Injection vulnerability (CVSS 8.8, bulktheme WOOEXIM) - [CVE-2025-23942](https://cve.now/CVE-2025-23942.md): WordPress WP Load Gallery Plugin \<= 2.1.6 - Arbitrary File Upload vulnerability (CVSS 9.1, ngocuct0912 WP Load Gallery) - [CVE-2025-23938](https://cve.now/CVE-2025-23938.md): WordPress Image Gallery Box by CRUDLab Plugin \<= 1.0.3 - Local File Inclusion vulnerability (CVSS 7.5, Image Gallery Box by CRUDLab) - [CVE-2025-23932](https://cve.now/CVE-2025-23932.md): WordPress Quick Count Plugin \<= 3.00 - PHP Object Injection vulnerability (CVSS 9.8, Marko-M Quick Count) - [CVE-2025-23931](https://cve.now/CVE-2025-23931.md): WordPress WordPress Local SEO plugin \<= 2.3 - SQL Injection vulnerability (CVSS 9.3, Oliver Fuhrmann WordPress Local SEO) - [CVE-2025-23921](https://cve.now/CVE-2025-23921.md): WordPress Multi Uploader for Gravity Forms plugin \<= 1.1.3 - Arbitrary File Upload vulnerability (CVSS 9.0, sh1zen Multi Uploader for Gravity Forms) - [CVE-2025-23918](https://cve.now/CVE-2025-23918.md): WordPress Smallerik File Browser plugin \<= 1.1 - Arbitrary File Upload vulnerability (CVSS 9.9, Enrico Sandoli Smallerik File Browser) - [CVE-2025-23910](https://cve.now/CVE-2025-23910.md): WordPress Menus Plus+ Plugin \<= 1.9.6 - SQL Injection vulnerability (CVSS 8.5, keighl Menus Plus+) - [CVE-2025-23874](https://cve.now/CVE-2025-23874.md): WordPress WP Block Pack plugin \<= 1.1.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, FalconTheme Team WP Block Pack) - [CVE-2025-23867](https://cve.now/CVE-2025-23867.md): WordPress WordPress File Search Plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, markcoker WordPress File Search) - [CVE-2025-23866](https://cve.now/CVE-2025-23866.md): WordPress EU DSGVO Helper Plugin \<= 1.0.6.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, E. Marten EU DSGVO Helper) - [CVE-2025-23811](https://cve.now/CVE-2025-23811.md): WordPress WP2APP Plugin \<= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ghasemy14 WP2APP) - [CVE-2025-23806](https://cve.now/CVE-2025-23806.md): WordPress Ultimate Subscribe Plugin \<=1.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeFarmer Ultimate Subscribe) - [CVE-2025-23803](https://cve.now/CVE-2025-23803.md): WordPress Snippy Plugin \<= 1.4.1 - CSRF to Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rik Schennink Snippy) - [CVE-2025-23798](https://cve.now/CVE-2025-23798.md): WordPress Mass Messaging in BuddyPress Plugin \<= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ElbowRobo Mass Messaging in BuddyPress) - [CVE-2025-23784](https://cve.now/CVE-2025-23784.md): WordPress Contact Form 7 Round Robin Lead Distribution Plugin \<= 1.2.1 - SQL Injection vulnerability (CVSS 7.6, David Jeffrey Contact Form 7 Round Robin Lead Distribution) - [CVE-2025-23781](https://cve.now/CVE-2025-23781.md): WordPress WM Options Import Export plugin \<= 1.0.1 - Sensitive Data Exposure vulnerability (CVSS 7.5, Web Mumbai WM Options Import Export) - [CVE-2025-23774](https://cve.now/CVE-2025-23774.md): WordPress WPDB to Sql plugin \<= 1.2 - Sensitive Data Exposure vulnerability (CVSS 7.5, Niket Joshi WPDB to Sql) - [CVE-2025-23770](https://cve.now/CVE-2025-23770.md): WordPress Fast Tube plugin \<= 2.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Caspie Fast Tube) - [CVE-2025-23769](https://cve.now/CVE-2025-23769.md): WordPress Content Mirror plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, dreamsofmatter Content Mirror) - [CVE-2025-23758](https://cve.now/CVE-2025-23758.md): WordPress pootle button plugin \<= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, pootlepress Pootle button) - [CVE-2025-23732](https://cve.now/CVE-2025-23732.md): WordPress Easy Filtering plugin \<= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, franciscopalacios Easy Filtering) - [CVE-2025-23706](https://cve.now/CVE-2025-23706.md): WordPress Jet Skinner for BuddyPress plugin \<= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, milordk Jet Skinner for BuddyPress) - [CVE-2025-23701](https://cve.now/CVE-2025-23701.md): WordPress Lime Developer Login plugin \<= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, limesquare Lime Developer Login) - [CVE-2025-23700](https://cve.now/CVE-2025-23700.md): WordPress yCyclista plugin \<= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, yonisink yCyclista) - [CVE-2025-23697](https://cve.now/CVE-2025-23697.md): WordPress Podčlánková inzerce plugin \<= 2.4.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, webdeal Podčlánková inzerce) - [CVE-2025-23696](https://cve.now/CVE-2025-23696.md): WordPress Staging CDN plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ronan Mockett Staging CDN) - [CVE-2025-23695](https://cve.now/CVE-2025-23695.md): WordPress CtyGrid Hyp3rL0cal Search plugin \<= 0.1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kinlane CtyGrid Hyp3rL0cal Search) - [CVE-2025-23686](https://cve.now/CVE-2025-23686.md): WordPress Admin Menu Organizer plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, phpdevca Admin Menu Organizer) - [CVE-2025-23684](https://cve.now/CVE-2025-23684.md): WordPress Debug Tool plugin \<= 2.2 - Broken Access Control vulnerability (CVSS 4.3, Eugen Bobrowski Debug Tool) - [CVE-2025-23683](https://cve.now/CVE-2025-23683.md): WordPress MACME plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, xdxdVSxdxd MACME) - [CVE-2025-23682](https://cve.now/CVE-2025-23682.md): WordPress Preloader Quotes plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bhuvnesh Gupta Preloader Quotes) - [CVE-2025-23681](https://cve.now/CVE-2025-23681.md): WordPress REDIRECTION PLUS plugin \<= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tahminajannat REDIRECTION PLUS) - [CVE-2025-23679](https://cve.now/CVE-2025-23679.md): WordPress FP RSS Category Excluder plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Flourish Pixel FP RSS Category Excluder) - [CVE-2025-23678](https://cve.now/CVE-2025-23678.md): WordPress LocalGrid plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Md Imranur Rahman LocalGrid) - [CVE-2025-23676](https://cve.now/CVE-2025-23676.md): WordPress LH Email plugin \<= 1.12 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, shawfactor LH Email) - [CVE-2025-23674](https://cve.now/CVE-2025-23674.md): WordPress Bit.ly linker plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, andygauk Bit.ly linker) - [CVE-2025-23672](https://cve.now/CVE-2025-23672.md): WordPress Instant Appointment plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tenteeglobal Instant Appointment) - [CVE-2025-23631](https://cve.now/CVE-2025-23631.md): WordPress Content Planner plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sarah Lewis Content Planner) - [CVE-2025-23630](https://cve.now/CVE-2025-23630.md): WordPress Cyber Slider plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Irshad A.Khan Cyber Slider) - [CVE-2025-23625](https://cve.now/CVE-2025-23625.md): WordPress Unique UX plugin \<= 0.9.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, awcode Unique UX) - [CVE-2025-23611](https://cve.now/CVE-2025-23611.md): WordPress WH Cache & Security plugin \<= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, webhue WH Cache & Security) - [CVE-2025-23610](https://cve.now/CVE-2025-23610.md): WordPress Ultimate Events plugin \<= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tehsmash Ultimate Events) - [CVE-2025-23609](https://cve.now/CVE-2025-23609.md): WordPress Tagesteller plugin \<= v.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Helle1 Tagesteller) - [CVE-2025-23607](https://cve.now/CVE-2025-23607.md): WordPress CAMOO SMS plugin \<= 3.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Camoo Sarl CAMOO SMS) - [CVE-2025-23606](https://cve.now/CVE-2025-23606.md): WordPress Calendi plugin \<= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sebkay Calendi) - [CVE-2025-23605](https://cve.now/CVE-2025-23605.md): WordPress Call To Action Popup plugin \<= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, lampd Call To Action Popup) - [CVE-2025-23604](https://cve.now/CVE-2025-23604.md): WordPress Rezdy Reloaded plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Maeve Lander Rezdy Reloaded) - [CVE-2025-23603](https://cve.now/CVE-2025-23603.md): WordPress Group category creator plugin \<= 1.3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, MohammadJafar Khajeh Group category creator) - [CVE-2025-23602](https://cve.now/CVE-2025-23602.md): WordPress EELV Newsletter plugin \<= 4.8.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Europe Ecologie Les Verts EELV Newsletter) - [CVE-2025-23601](https://cve.now/CVE-2025-23601.md): WordPress Tab My Content plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, patrice Tab My Content) - [CVE-2025-23597](https://cve.now/CVE-2025-23597.md): WordPress Rio Photo Gallery plugin \<= 0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sabareesha Rio Photo Gallery) - [CVE-2025-23592](https://cve.now/CVE-2025-23592.md): WordPress dForms plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, animexxx dForms) - [CVE-2025-23589](https://cve.now/CVE-2025-23589.md): WordPress ContentOptin Lite plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, markugwuanyi ContentOptin Lite) - [CVE-2025-23583](https://cve.now/CVE-2025-23583.md): WordPress Explara Membership plugin \<= 0.0.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Explara Membership) - [CVE-2025-23578](https://cve.now/CVE-2025-23578.md): WordPress Custom CSS Addons plugin \<= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bastien Ho Custom CSS Addons) - [CVE-2025-23562](https://cve.now/CVE-2025-23562.md): WordPress XLSXviewer plugin \<= 2.1.1 - Arbitrary File Deletion vulnerability (CVSS 7.5, pitinca XLSXviewer) - [CVE-2025-23548](https://cve.now/CVE-2025-23548.md): WordPress Responsivity plugin \<= 0.0.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bilal TAS Responsivity) - [CVE-2025-23535](https://cve.now/CVE-2025-23535.md): WordPress REAL WordPress Sidebar plugin \<= 0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, martin\_ziegert REAL WordPress Sidebar) - [CVE-2025-23512](https://cve.now/CVE-2025-23512.md): WordPress Team 118GROUP Agent plugin \<= 1.6.0 - Arbitrary Content Deletion vulnerability (CVSS 7.5, Team 118GROUP Agent) - [CVE-2025-23509](https://cve.now/CVE-2025-23509.md): WordPress HyperComments plugin \<= 0.9.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, siteheart HyperComments) - [CVE-2025-23507](https://cve.now/CVE-2025-23507.md): WordPress Blrt WP Embed plugin \<= 1.6.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Blrt WP Embed) - [CVE-2025-23503](https://cve.now/CVE-2025-23503.md): WordPress Customizable Captcha and Contact us plugin \<= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, osolwordpress Customizable Captcha and Contact Us) - [CVE-2025-23500](https://cve.now/CVE-2025-23500.md): WordPress Simple Custom post type custom field plugin \<= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, faaiq Simple Custom post type custom field) - [CVE-2025-23498](https://cve.now/CVE-2025-23498.md): WordPress Translation.Pro plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ContentLocalized Translation.Pro) - [CVE-2025-23495](https://cve.now/CVE-2025-23495.md): WordPress WooCommerce Order Search plugin \<= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Chetan Khandla WooCommerce Order Search) - [CVE-2025-24027](https://cve.now/CVE-2025-24027.md): ps\_contactinfo has potential XSS due to usage of the nofilter tag in template (CVSS 6.2, PrestaShop ps\_contactinfo · prestashop/ps\_contactinfo) - [CVE-2025-0395](https://cve.now/CVE-2025-0395.md): When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure mes (CVSS 6.2, The GNU C Library glibc) - [CVE-2024-13496](https://cve.now/CVE-2024-13496.md): GamiPress \<= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter (CVSS 7.5, rubengc GamiPress – Gamification plugin to reward points, a…) - [CVE-2024-13447](https://cve.now/CVE-2024-13447.md): WP Hotel Booking \<= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval (CVSS 4.3, thimpress WP Hotel Booking) - [CVE-2024-13499](https://cve.now/CVE-2024-13499.md): GamiPress \<= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress\_do\_shortcode() Function (CVSS 7.3, rubengc GamiPress – Gamification plugin to reward points, a…) - [CVE-2024-13495](https://cve.now/CVE-2024-13495.md): GamiPress \<= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress\_ajax\_get\_logs Function (CVSS 7.3, rubengc GamiPress – Gamification plugin to reward points, a…) - [CVE-2022-23439](https://cve.now/CVE-2022-23439.md): A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafte (CVSS 4.1, Fortinet FortiTester · Fortinet FortiOS +15) - [CVE-2025-0429](https://cve.now/CVE-2025-0429.md): AI Power: Complete AI Pack \<= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg\_export\_ai\_forms (CVSS 7.2, senols AI Puffer – Your AI engine for WordPress) - [CVE-2024-13319](https://cve.now/CVE-2024-13319.md): Themify Builder \<= 7.6.5 - Reflected Cross-Site Scripting (CVSS 6.1, themifyme Themify Builder) - [CVE-2025-0428](https://cve.now/CVE-2025-0428.md): AI Power: Complete AI Pack \<= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg\_export\_prompts (CVSS 7.2, senols AI Puffer – Your AI engine for WordPress) - [CVE-2024-13360](https://cve.now/CVE-2024-13360.md): AI Power: Complete AI Pack \<= 1.8.96 - Authenticated (Subscriber+) Server-Side Request Forgery (CVSS 5.4, senols AI Puffer – Your AI engine for WordPress) - [CVE-2024-13361](https://cve.now/CVE-2024-13361.md): AI Power: Complete AI Pack \<= 1.8.96 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 6.3, senols AI Puffer – Your AI engine for WordPress) - [CVE-2024-12117](https://cve.now/CVE-2024-12117.md): Stackable – Page Builder Gutenberg Blocks \<= 3.13.11 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bfintal Stackable – Page Builder Gutenberg Blocks) - [CVE-2024-12857](https://cve.now/CVE-2024-12857.md): AdForest \<= 5.1.8 - Authentication Bypass (CVSS 9.8, scriptsbundle AdForest) - [CVE-2024-13406](https://cve.now/CVE-2024-13406.md): XML for Google Merchant Center \<= 3.0.11 - Reflected Cross-Site Scripting (CVSS 6.1, icopydoc XML for Google Merchant Center) - [CVE-2025-23237](https://cve.now/CVE-2025-23237.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008\_SE a (CVSS 6.6, I-O DATA DEVICE UD-LT2) - [CVE-2025-22450](https://cve.now/CVE-2025-22450.md): Inclusion of undocumented features issue exists in UD-LT2 firmware Ver.1.00.008\_SE and earlier. (CVSS 7.5, I-O DATA DEVICE UD-LT2) - [CVE-2025-20617](https://cve.now/CVE-2025-20617.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008\_SE a (CVSS 7.2, I-O DATA DEVICE UD-LT2) - [CVE-2024-12879](https://cve.now/CVE-2024-12879.md): WPBot Pro Wordpress Chatbot \<= 13.5.5 - Missing Authorization to Authenticated (Subscriber+) Simple Text Response Creation (CVSS 4.3, QuantumCloud WPBot Pro Wordpress Chatbot) - [CVE-2024-11218](https://cve.now/CVE-2024-11218.md): Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile (CVSS 8.6, buildah · Red Hat Enterprise Linux +2) - [CVE-2024-13590](https://cve.now/CVE-2024-13590.md): Ketchup Shortcodes \<= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ayecode Ketchup Shortcodes) - [CVE-2024-13584](https://cve.now/CVE-2024-13584.md): Picture Gallery – Frontend Image Uploads, AJAX Photo List \<= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, videowhisper Picture Gallery – Frontend Image Uploads, AJAX…) - [CVE-2024-13426](https://cve.now/CVE-2024-13426.md): WP-Polls \<= 2.77.2 - Unauthenticated SQL Injection to Stored Cross-Site Scripting (CVSS 5.4, gamerz WP-Polls) - [CVE-2025-23083](https://cve.now/CVE-2025-23083.md): With the aid of the diagnostics\_channel utility, an event can be hooked into whenever a worker thread is created. (CVSS 7.7, NodeJS Node) - [CVE-2025-0625](https://cve.now/CVE-2025-0625.md): CampCodes School Management Software Attachment resource injection (CVSS 2.3, CampCodes School Management Software) - [CVE-2023-36998](https://cve.now/CVE-2023-36998.md): The NextEPC MME \<= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in (CVSS 8.9) - [CVE-2023-37002](https://cve.now/CVE-2023-37002.md): Open5GS MME versions \<= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 5.3) - [CVE-2023-37003](https://cve.now/CVE-2023-37003.md): Open5GS MME versions \<= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 5.3) - [CVE-2023-37004](https://cve.now/CVE-2023-37004.md): Open5GS MME versions \<= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 5.3) - [CVE-2023-37005](https://cve.now/CVE-2023-37005.md): Open5GS MME versions \<= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 5.3) - [CVE-2023-37006](https://cve.now/CVE-2023-37006.md): Open5GS MME versions \<= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 5.3) - [CVE-2023-37007](https://cve.now/CVE-2023-37007.md): Open5GS MME versions \<= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 5.3) - [CVE-2023-37008](https://cve.now/CVE-2023-37008.md): Open5GS MME versions \<= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler. (CVSS 5.3) - [CVE-2023-37009](https://cve.now/CVE-2023-37009.md): Open5GS MME versions \<= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 6.3) - [CVE-2023-37010](https://cve.now/CVE-2023-37010.md): Open5GS MME versions \<= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 6.3) - [CVE-2023-37011](https://cve.now/CVE-2023-37011.md): Open5GS MME versions \<= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 6.3) - [CVE-2023-37012](https://cve.now/CVE-2023-37012.md): Open5GS MME versions \<= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 5.3) - [CVE-2023-37013](https://cve.now/CVE-2023-37013.md): Open5GS MME versions \<= 2.6.4 contains an assertion that can be remotely triggered via a sufficiently large ASN.1 packet over the S1AP inter (CVSS 7.3) - [CVE-2023-37014](https://cve.now/CVE-2023-37014.md): Open5GS MME versions \<= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 7.5) - [CVE-2023-37015](https://cve.now/CVE-2023-37015.md): Open5GS MME versions \<= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 8.6) - [CVE-2023-37016](https://cve.now/CVE-2023-37016.md): Open5GS MME versions \<= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 8.6) - [CVE-2023-37017](https://cve.now/CVE-2023-37017.md): Open5GS MME versions \<= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 8.6) - [CVE-2023-37018](https://cve.now/CVE-2023-37018.md): Open5GS MME versions \<= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 8.6) - [CVE-2023-37019](https://cve.now/CVE-2023-37019.md): Open5GS MME versions \<= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 8.6) - [CVE-2023-37020](https://cve.now/CVE-2023-37020.md): Open5GS MME versions \<= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 8.6) - [CVE-2023-37021](https://cve.now/CVE-2023-37021.md): Open5GS MME version \<= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 8.6) - [CVE-2023-37022](https://cve.now/CVE-2023-37022.md): Open5GS MME versions \<= 2.6.4 contain a reachable assertion in the \`UE Context Release Request\` packet handler. (CVSS 7.5) - [CVE-2023-37023](https://cve.now/CVE-2023-37023.md): Open5GS MME versions \<= 2.6.4 contain a reachable assertion in the \`Uplink NAS Transport\` packet handler. (CVSS 8.6) - [CVE-2023-37777](https://cve.now/CVE-2023-37777.md): A SQL injection vulnerability exists in Synnefo Internet Management Software (IMS) version 2023 and earlier. (CVSS 9.8) - [CVE-2024-24429](https://cve.now/CVE-2024-24429.md): A reachable assertion in the nas\_eps\_send\_emm\_to\_esm function of Open5GS \<= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a (CVSS 8.6) - [CVE-2024-24430](https://cve.now/CVE-2024-24430.md): A reachable assertion in the mme\_ue\_find\_by\_imsi function of Open5GS \<= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a craf (CVSS 7.5) - [CVE-2024-24432](https://cve.now/CVE-2024-24432.md): A reachable assertion in the ogs\_kdf\_hash\_mme function of Open5GS \<= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted (CVSS 5.3) - [CVE-2024-34235](https://cve.now/CVE-2024-34235.md): Open5GS MME versions \<= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. (CVSS 8.6) - [CVE-2024-42012](https://cve.now/CVE-2024-42012.md): GRAU DATA Blocky before 3.1 stores passwords encrypted rather than hashed. (CVSS 5.7) - [CVE-2024-42013](https://cve.now/CVE-2024-42013.md): In GRAU DATA Blocky before 3.1, Blocky-Gui has a Client-Side Enforcement of Server-Side Security vulnerability. (CVSS 6.4) - [CVE-2024-55488](https://cve.now/CVE-2024-55488.md): A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a cra (CVSS 6.5) - [CVE-2024-55957](https://cve.now/CVE-2024-55957.md): In Thermo Fisher Scientific Xcalibur before 4.7 SP1 and Thermo Foundation Instrument Control Software (ICSW) before 3.1 SP10, the driver pac (CVSS 7.8) - [CVE-2024-56914](https://cve.now/CVE-2024-56914.md): D-Link DSL-3782 v1.01 is vulnerable to Buffer Overflow in /New\_GUI/ParentalControl.asp. (CVSS 5.7) - [CVE-2024-56923](https://cve.now/CVE-2024-56923.md): Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 \<= 6 (CVSS 5.4, org.silverpeas.core:silverpeas-core) - [CVE-2024-56924](https://cve.now/CVE-2024-56924.md): A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary J (CVSS 7.3) - [CVE-2025-22980](https://cve.now/CVE-2025-22980.md): A SQL Injection vulnerability exists in Senayan Library Management System SLiMS 9 Bulian 9.6.1 via the tempLoanID parameter in the loan form (CVSS 6.7) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-01-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.