CVEs published January 24, 2025
198 CVEs were published on January 24, 2025: 9 critical, 55 high.
- Published
- 198
- Critical
- 9
- High
- 55
- Medium
- 132
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- coollabsio coolify
- 9
- JoeyBling bootplus
- 9
- Element Invader ElementInvader Addons for Elementor
- 3
- AA Web Servant 12 Step Meeting List
- 2
- codepeople Form Builder CP
- 2
- Epsiloncool WP Fast Total Search
- 2
- GitLab
- 2
- HL7 fhir-ig-publisher · org.hl7.fhir.publisher:org.hl7.f… +1
- 2
- IBM Planning Analytics Local
- 2
- Listamester
- 2
Critical 9
- CVE-2025-24650WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerabilityThemefic Tourfic
- CVE-2025-22612Coolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE)coollabsio coolify
- CVE-2025-22611Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE)coollabsio coolify
- CVE-2025-22609Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE)coollabsio coolify
- CVE-2024-13545Bootstrap Ultimate <= 1.4.9 - Unauthenticated Limited Local File Inclusioneminozlem Bootstrap Ultimate
- CVE-2024-50694In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message, the underlying code does not
- CVE-2024-50695SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to stack-based buffer overflow when parsing MQTT messages, due to missing
- CVE-2024-50698SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow due to bounds checks of the MQTT message co
- CVE-2024-56404In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation.OneIdentity Identity Manager
High 55
- CVE-2025-0707Rise Group Rise Mode Temp CPU Startup CRYPTBASE.dll untrusted search pathRise Group Rise Mode Temp CPU
- CVE-2024-52807XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`HL7 fhir-ig-publisher · org.hl7.fhir.publisher:org.hl7.f… +1
- CVE-2025-24362CodeQL GitHub Action failed workflow writes GitHub PAT to debug artifactsgithub codeql-action
- CVE-2019-15690LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/LibVNCServer
- CVE-2025-24587WordPress Email Subscription Popup plugin <= 1.2.23 - SQL Injection vulnerabilityNks Email Subscription Popup
- CVE-2025-24756WordPress Roi Calculator plugin <= 1.0 - CSRF to Stored XSS vulnerabilitymgplugin Roi Calculator
- CVE-2025-24728WordPress Bug Library plugin <= 2.1.4 - SQL Injection vulnerabilityYannick Lefebvre Bug Library
- CVE-2025-24683WordPress RSVP and Event Management Plugin <= 2.7.14 - SQL Injection vulnerabilityWP Chill RSVP and Event Management
- CVE-2025-24669WordPress SERPed.net Plugin <= 4.4 - SQL Injection vulnerabilityserpednet SERPed.net
- CVE-2025-24672WordPress Form Builder CP Plugin <= 1.2.41 - SQL Injection vulnerabilitycodepeople Form Builder CP
- CVE-2025-24659WordPress Premium Packages – Sell Digital Products Securely plugin <= 5.9.6 - SQL Injection vulnerabilityShahjada WPDM – Premium Packages
- CVE-2025-24663WordPress Simple Download Monitor plugin <= 3.9.25 - SQL Injection vulnerabilitymra13 Simple Download Monitor
- CVE-2025-24636WordPress MachForm Shortcode plugin <= 1.4.1 - CSRF to Stored XSS vulnerabilityRick Laymance MachForm Shortcode
- CVE-2025-24562WordPress KBucket plugin <= 4.1.6 - CSRF to Stored Cross-Site Scripting vulnerabilityOptimal Access KBucket
- CVE-2025-24570WordPress Atarim plugin <= 4.0.8 - Cross Site Scripting (XSS) vulnerabilityVito Peleg Atarim
- CVE-2025-24561WordPress ReviewsTap plugin <= 1.1.2 - CSRF to Stored Cross-Site Scripting vulnerabilityawcode ReviewsTap
- CVE-2025-24555WordPress Subscription DNA plugin <= 2.1 - CSRF to Stored XSS vulnerabilitysubscriptiondna Subscription DNA
- CVE-2025-24359ASTEVAL Vulnerable to Maliciously Crafted Format Strings Leading to Sandbox Escapelmfit asteval · asteval
- CVE-2025-24355Updatecli may expose Maven credentials in console outputupdatecli · github.com/updatecli/updatecli
- CVE-2025-22606Coolify Command Injection Vulnerability in Project Namecoollabsio coolify
- CVE-2024-40693IBM Planning Analytics file uploadIBM Planning Analytics Local
- CVE-2024-25034IBM Planning Analytics file uploadIBM Planning Analytics Local
- CVE-2025-22605Coolify OS Command Injection Vulnerability in SSH Command Generationcoollabsio coolify
- CVE-2024-9499Uncontrolled search path can lead to DLL hijacking in USBXpress Win 98SE Dev Kit installersilabs.com USBXpress Win 98SE Dev Kit
- CVE-2024-9498Uncontrolled search path can lead to DLL hijacking in USBXpress SDK installersilabs.com USBXpress SDK
- CVE-2024-9497Uncontrolled search path can lead to DLL hijacking in USBXpress 4 SDK installersilabs.com USBXpress 4 SDK
- CVE-2024-9496Uncontrolled search path can lead to DLL hijacking in USBXpress Dev Kit installersilabs.com USBXpress Dev Kit
- CVE-2024-9495Uncontrolled search path can lead to DLL hijacking in CP210x VCP Windows installersilabs.com CP210x VCP Windows
- CVE-2024-9494Uncontrolled search path can lead to DLL hijacking in CP210 VCP Win 2k installersilabs.com CP210 VCP Win
- CVE-2024-9493Uncontrolled search path can lead to DLL hijacking in ToolStick installersilabs.com ToolStick
- CVE-2024-9492Uncontrolled search path can lead to DLL hijacking in Flash Programming Utility installersilabs.com Flash Programming Utility
- CVE-2024-9491Uncontrolled search path can lead to DLL hijacking in Configuration Wizard 2 installersilabs.com Configuration Wizard
- CVE-2024-9490Uncontrolled search path can lead to DLL hijacking in Silicon Labs IDE installersilabs.com Silicon Labs IDE
- CVE-2024-41739IBM Cognos Dashboards on Cloud Pak for Data privilege escalationIBM Cognos Dashboards on Cloud Pak for Data
- CVE-2024-13408Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusionwpwax Post Grid, Slider & Carousel Ultimate – with Shortcod…
- CVE-2024-13409Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via post_type_ajax_handler()wpwax Post Grid, Slider & Carousel Ultimate – with Shortcod…
- CVE-2025-22714WordPress MDJM Event Management Plugin <= 1.7.5.6 - Reflected Cross Site Scripting (XSS) vulnerabilityMDJM Mobile DJ Manager
- CVE-2025-23889WordPress FooGallery Captions Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilitytormorten FooGallery Captions
- CVE-2025-23888WordPress Custom Page Extensions Plugin <= 0.6 - Cross Site Scripting (XSS) vulnerabilityGrandSlambert Custom Page Extensions
- CVE-2025-23885WordPress MJ Contact us Plugin <= 5.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityanildhiman MJ Contact us
- CVE-2025-23839WordPress Sticky Button plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityAsif Shakeel Sticky Button
- CVE-2025-23838WordPress Bauernregeln Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityRally Vincent Bauernregeln
- CVE-2025-23837WordPress One Backend Language Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitymartinjuhasz One Backend Language
- CVE-2025-23737WordPress Network-Favorites plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitythobian Network-Favorites
- CVE-2025-23734WordPress Gigaom Sphinx plugin <= 0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityCasey Bisson Gigaom Sphinx
- CVE-2025-23711WordPress Quote me plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityQuincy Kwende Quote me
- CVE-2025-23622WordPress CBX Accounting & Bookkeeping plugin <= 1.3.14 - Reflected Cross Site Scripting (XSS) vulnerabilitySabuj Kundu CBX Accounting & Bookkeeping
- CVE-2025-23621WordPress Causes – Donation plugin <= 1.0.01 - Reflected Cross Site Scripting (XSS) vulnerabilityalgothemes Causes – Donation Plugin
- CVE-2025-23522WordPress HM Portfolio plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityMatthew Haines-Young HM Portfolio
- CVE-2025-23427WordPress Redux Converter plugin <= 1.1.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityDavid Anderson / Team Updraft Redux Converter
- CVE-2025-23422WordPress Store Locator plugin <= 3.98.10 - Local File Inclusion vulnerabilitymoaluko Store Locator
- CVE-2025-0314Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2022-47090GPAC MP4box 2.1-DEV-rev574-g9d5bb184b contains a buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c, check
- CVE-2024-50697In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when decrypting MQTT messages, the code that parses specific TLV fields does not ha
- CVE-2025-23222An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root.Deepin dde-api-proxy
Medium, low and unrated 134
- CVE-2025-21262Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2025-0710CampCodes School Management Software Notice Board Page notice-list cross site scriptingCampCodes School Management Software
- CVE-2025-0709Dcat-Admin Roles Page roles cross site scriptingDcat-Admin
- CVE-2025-0708fumiao opencms Add Model Management Page addOrUpdate cross site scriptingfumiao opencms
- CVE-2025-0706JoeyBling bootplus admin.html cross site scriptingJoeyBling bootplus
- CVE-2025-0705JoeyBling bootplus QrCodeController.java qrCode redirectJoeyBling bootplus
- CVE-2025-24363The HL7 FHIR IG publisher may potentially expose GitHub repo user and credential informationHL7 fhir-ig-publisher · org.hl7.fhir.publisher:org.hl7.f… +1
- CVE-2025-0704JoeyBling bootplus QrCodeController.java qrCode resource consumptionJoeyBling bootplus
- CVE-2025-0703JoeyBling bootplus SysFileController.java path traversalJoeyBling bootplus
- CVE-2025-0702JoeyBling bootplus SysFileController.java unrestricted uploadJoeyBling bootplus
- CVE-2024-35122IBM i denial of serviceIBM i
- CVE-2025-24736WordPress Post Duplicator plugin <= 2.35 - Broken Access Control vulnerabilitymetaphorcreations Post Duplicator
- CVE-2025-24746WordPress Popup Maker plugin <= 1.20.2 - Cross Site Scripting (XSS) vulnerabilityDaniel Iser Popup Maker
- CVE-2025-24755WordPress PDF Invoice Builder for WooCommerce plugin <= 4.6.0 - Cross Site Scripting (XSS) vulnerabilityadd-ons.org PDF Invoice Builder for WooCommerce
- CVE-2025-24753WordPress Kadence Blocks plugin <= 3.3.1 - Broken Access Control vulnerabilityStellarWP Gutenberg Blocks by Kadence Blocks
- CVE-2025-24751WordPress CoBlocks plugin <= 3.1.13 - Broken Access Control vulnerabilityGoDaddy CoBlocks
- CVE-2025-24750WordPress ExactMetrics plugin <= 8.1.0 - Broken Access Control vulnerabilitySyed Balkhi ExactMetrics
- CVE-2025-24729WordPress ElementInvader Addons for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityElement Invader ElementInvader Addons for Elementor
- CVE-2025-24721WordPress Easy YouTube Gallery plugin <= 1.0.4 - Stored Cross Site Scripting (XSS) vulnerabilityAleksandar Urošević Easy YouTube Gallery
- CVE-2025-24733WordPress Post Grid Master plugin <= 3.4.12 - Local File Inclusion vulnerabilityAkhtarujjaman Shuvo Post Grid Master
- CVE-2025-24726WordPress Contact Form 7 Widget plugin <= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerabilityHT Plugins HT Contact Form
- CVE-2025-24725WordPress Thim Elementor Kit Plugin <= 1.2.8 - Broken Access Control vulnerabilityThimPress Thim Elementor Kit
- CVE-2025-24730WordPress WP VR plugin <= 8.5.14 - Cross Site Scripting (XSS) vulnerabilityRexTheme WP VR
- CVE-2025-24738WordPress Call Now Button plugin <= 1.4.13 - Cross Site Request Forgery (CSRF) vulnerabilityJerry Rietveld Call Now Button
- CVE-2025-24723WordPress Booking Calendar Contact Form Plugin <= 1.2.55 - Stored Cross Site Scripting (XSS) vulnerabilitycodepeople Booking Calendar Contact Form
- CVE-2025-24719WordPress Widget Countdown plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerabilitywpdevart Widget Countdown
- CVE-2025-24731WordPress IP2Location Country Blocker plugin <= 2.38.3 - Cross Site Scripting (XSS) vulnerabilityDownload IP2Location Country Blocker
- CVE-2025-24732WordPress BookingPress Plugin <= 1.1.25 - Cross Site Scripting (XSS) vulnerabilityreputeinfosystems BookingPress
- CVE-2025-24724WordPress Side Menu Lite Plugin <= 5.3.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityWow-Company Side Menu Lite
- CVE-2025-24739WordPress FluentSMTP plugin <= 2.2.80 - Cross Site Request Forgery (CSRF) vulnerabilityShahjahan Jewel FluentSMTP
- CVE-2025-24716WordPress Herd Effects Plugin <= 6.2.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityWow-Company Herd Effects
- CVE-2025-24727WordPress Contact Form to Email Plugin <= 1.3.52 - Cross Site Scripting (XSS) vulnerabilitycodepeople Contact Form Email
- CVE-2025-24717WordPress Modal Window Plugin <= 6.1.4 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityWow-Company Modal Window
- CVE-2025-24703WordPress Comment Edit Core – Simple Comment Editing Plugin <= 3.0.33 - Server Side Request Forgery (SSRF) vulnerabilityRonald Huereca Comment Edit Core – Simple Comment Editing
- CVE-2025-24715WordPress Counter Box Plugin <= 2.0.5 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityWow-Company Counter Box
- CVE-2025-24713WordPress Button Generator – easily Button Builder Plugin <= 3.1.1 - Cross Site Request Forgery (CSRF) vulnerabilityWow-Company Button Generator – easily Button Builder
- CVE-2025-24722WordPress FAQ Builder AYS Plugin <= 1.7.3 - Cross Site Scripting (XSS) vulnerabilityAys Pro FAQ Builder AYS
- CVE-2025-24720WordPress Sticky Buttons Plugin <= 4.1.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityWow-Company Sticky Buttons
- CVE-2025-24696WordPress Gutenberg Blocks and Page Layouts Plugin <= 1.9.6 - Cross Site Request Forgery (CSRF) vulnerabilityShafaet Alam Attire Blocks
- CVE-2025-24706WordPress MultiVendorX plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerabilityMultiVendorX
- CVE-2025-24709WordPress Plethora Plugins Tabs + Accordions plugin <= 1.1.5 - Stored Cross Site Scripting (XSS) vulnerabilityPlethora Plugins Tabs + Accordions
- CVE-2025-24712WordPress Radius Blocks – WordPress Gutenberg Blocks Plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerabilityRadiusTheme Radius Blocks
- CVE-2025-24698WordPress Essential Real Estate plugin <= 5.1.8 - Cross Site Request Forgery (CSRF) vulnerabilityg5theme Essential Real Estate
- CVE-2025-24711WordPress Popup Box Plugin <= 3.2.4 - Cross Site Request Forgery (CSRF) vulnerabilityWow-Company Popup Box
- CVE-2025-24714WordPress Bubble Menu Plugin <= 4.0.2 - Cross Site Request Forgery (CSRF) vulnerabilityWow-Company Bubble Menu – circle floating menu
- CVE-2025-24705WordPress WooCommerce Quick View plugin <= 1.1.1 - Sensitive Data Exposure vulnerabilityArshid WooCommerce Quick View
- CVE-2025-24704WordPress Magic the Gathering Card Tooltips plugin <= 3.4.0 - Cross Site Scripting (XSS) vulnerabilitygrimdonkey Magic the Gathering Card Tooltips
- CVE-2025-24674WordPress ShMapper by Teplitsa Plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityDenis Cherniatev ShMapper by Teplitsa
- CVE-2025-24695WordPress Extensions For CF7 Plugin <= 3.2.0 - Server Side Request Forgery (SSRF) vulnerabilityHT Plugins Extensions For CF7
- CVE-2025-24701WordPress Chained Quiz Plugin <= 1.3.2.9 - Server Side Request Forgery (SSRF) vulnerabilityBob Chained Quiz
- CVE-2025-24691WordPress People Lists plugin <= 1.3.10 - Broken Access Control vulnerabilityctltwp People Lists
- CVE-2025-24693WordPress Advanced Notifications plugin <= 1.2.7 - Broken Access Control vulnerabilityYehi Advanced Notifications
- CVE-2025-24681WordPress Product Carousel Slider & Grid Ultimate for WooCommerce Plugin <= 1.10.0 - Cross Site Scripting (XSS) vulnerabilitywpWax Product Carousel Slider & Grid Ultimate for WooCommer…
- CVE-2025-24678WordPress Listamester Plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerabilityListamester
- CVE-2025-24682WordPress Super Block Slider plugin <= 2.7.9 - Broken Access Control vulnerabilityMichael Super Block Slider
- CVE-2025-24687WordPress Show/Hide Shortcode plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityLars Wallenborn Show/Hide Shortcode
- CVE-2025-24702WordPress Xagio SEO plugin <= 7.0.0.20 - Cross Site Scripting (XSS) vulnerabilityXagio SEO
- CVE-2025-24675WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 7.2 - Cross Site Scripting (XSS) vulnerabilityosama.esh WP Visitor Statistics
- CVE-2025-24666WordPress Hyve Lite plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerabilityThemeisle AI Chatbot for WordPress – Hyve Lite
- CVE-2025-24679WordPress Internal Links Manager plugin <= 2.5.2 - Broken Access Control vulnerabilitywebraketen Internal Links Manager
- CVE-2025-24673WordPress Ketchup Shortcodes Plugin <= 0.1.2 - Cross Site Scripting (XSS) vulnerabilityAyeCode Ketchup Shortcodes
- CVE-2025-24658WordPress Auction Nudge – Your eBay on Your Site plugin <= 7.2.0 - Cross Site Scripting (XSS) vulnerabilityJoe Auction Nudge – Your eBay on Your Site
- CVE-2025-24668WordPress PPOM for WooCommerce plugin <= 33.0.8 - Cross Site Scripting (XSS) vulnerabilityThemeisle PPOM for WooCommerce
- CVE-2025-24649WordPress Admin and Site Enhancements (ASE) Plugin <= 7.6.2 - Broken Access Control vulnerabilityBowo Admin and Site Enhancements
- CVE-2025-24657WordPress Wishlist for WooCommerce plugin <=2.1.2 - Cross Site Scripting (XSS) vulnerabilityWebToffee Wishlist for WooCommerce
- CVE-2025-24644WordPress WooCommerce PDF Invoices plugin <= 4.7.1 - Stored Cross Site Scripting (XSS) vulnerabilityWebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…
- CVE-2025-24647WordPress WooCommerce Cloak Affiliate Links plugin <= 1.0.35 - Cross Site Request Forgery (CSRF) vulnerabilitydatafeedr WooCommerce Cloak Affiliate Links
- CVE-2025-24625WordPress Taxonomy/Term and Role based Discounts for WooCommerce plugin <= 5.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityMarco Almeida | Webdados Taxonomy/Term and Role based Disco…
- CVE-2025-24623WordPress Really Simple Security plugin <= 9.1.4 - Cross Site Request Forgery (CSRF) vulnerabilityReally Simple Plugins Really Simple SSL
- CVE-2025-24638WordPress Create with Code plugin <= 1.4 - Cross Site Scripting (XSS) vulnerabilitypddring Create with Code
- CVE-2025-24627WordPress Blur Text Plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerabilityLinnea Huxford Blur Text
- CVE-2025-24652WordPress WP Duplicate plugin <= 1.1.6 - Broken Access Control vulnerabilityrevmakx WP Duplicate
- CVE-2025-24634WordPress Orbisius Simple Notice plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerabilitySvetoslav Marinov Orbisius Simple Notice
- CVE-2025-24613WordPress FV Thoughtful Comments plugin <= 0.3.5 - Broken Access Control vulnerabilityFolioVision FV Thoughtful Comments
- CVE-2025-24610WordPress Restrict Anonymous Access Plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityChristian Leuenberg Restrict Anonymous Access
- CVE-2025-24622WordPress Job Board Manager plugin <= 2.1.59 - Cross Site Request Forgery (CSRF) vulnerabilityPickPlugins Job Board Manager
- CVE-2025-24618WordPress ElementInvader Addons for Elementor Plugin <= 1.3.1 - Broken Access Control vulnerabilityElement Invader ElementInvader Addons for Elementor
- CVE-2025-24633WordPress Build Private Store For Woocommerce plugin <= 1.0 - Broken Access Control vulnerabilitysilverplugins217 Build Private Store For Woocommerce
- CVE-2025-24611WordPress Export All Posts, Products, Orders, Refunds & Users Plugin <= 2.9 - Arbitrary File Read vulnerabilitySmackcoders Inc., WP Ultimate Exporter
- CVE-2025-24596WordPress WooCommerce Product Table Lite plugin <= 3.8.7 - Broken Access Control vulnerabilityWC Product Table WooCommerce Product Table Lite
- CVE-2025-24604WordPress VForm plugin <= 3.0.5 - Broken Access Control vulnerabilityVikas Ratudi VPSUForm
- CVE-2025-24594WordPress Linet ERP-Woocommerce Integration plugin <= 3.5.7 - CSRF to Broken Access Control vulnerabilityaribhour Linet ERP-Woocommerce Integration
- CVE-2025-24595WordPress All Embed – Elementor Addons plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerabilitybPlugins All Embed – Elementor Addons
- CVE-2025-24572WordPress WP Fast Total Search plugin <= 1.78.258 - Cross Site Request Forgery (CSRF) vulnerabilityEpsiloncool WP Fast Total Search
- CVE-2025-24588WordPress Patreon WordPress plugin <= 1.9.1 - Broken Access Control vulnerabilityPatreon WordPress
- CVE-2025-24543WordPress Ultimate Coming Soon & Maintenance plugin <= 1.0.9 - Cross Site Request Forgery (CSRF) vulnerabilityRSTheme Ultimate Coming Soon & Maintenance
- CVE-2025-24573WordPress Pagelayer plugin <= 1.9.4 - Cross Site Scripting (XSS) vulnerabilitySoftaculous PageLayer
- CVE-2025-24547WordPress Caching Compatible Cookie Opt-In plugin <= 0.0.10 - Stored Cross Site Scripting (XSS) vulnerabilitymatthias.wagner Caching Compatible Cookie Opt-In and JavaSc…
- CVE-2025-24552WordPress Paytium plugin <= 4.4.11 - Full Path Disclosure (FPD) vulnerabilitypaytiumsupport Paytium
- CVE-2025-24579WordPress Nested pages plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerabilityKyle Phillips Nested Pages
- CVE-2025-24589WordPress JSM Show Post Metadata plugin <= 4.6.0 - Broken Access Control vulnerabilityJS Morisset JSM Show Post Metadata
- CVE-2025-24542WordPress Icegram Engage plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerabilityIcegram
- CVE-2025-24585WordPress Event post plugin <= 5.9.7 - Stored Cross Site Scripting (XSS) vulnerabilityBastien Ho Event post
- CVE-2025-24578WordPress ElementInvader Addons for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityElement Invader ElementInvader Addons for Elementor
- CVE-2025-24571WordPress WP Fast Total Search plugin <= 1.78.258 - Broken Access Control vulnerabilityEpsiloncool WP Fast Total Search
- CVE-2025-24591WordPress GDPR CCPA Compliance & Cookie Consent Banner plugin <= 2.7.1 - Broken Access Control vulnerabilityNinja Team GDPR CCPA Compliance Support
- CVE-2025-24546WordPress Ultimate Coming Soon & Maintenance plugin <= 1.0.9 - Cross Site Request Forgery (CSRF) vulnerabilityRSTheme Ultimate Coming Soon & Maintenance
- CVE-2025-24582WordPress 12 Step Meeting List plugin <= 3.16.5 - Sensitive Data Exposure vulnerabilityAA Web Servant 12 Step Meeting List
- CVE-2025-24580WordPress 12 Step Meeting List plugin <= 3.16.5 - Arbitrary Content Deletion vulnerabilityAA Web Servant 12 Step Meeting List
- CVE-2025-24575WordPress HelloAsso plugin <= 1.1.11 - Cross Site Scripting (XSS) vulnerabilityHelloAsso
- CVE-2025-24568WordPress Starter Templates plugin <= 4.4.9 - Cross Site Request Forgery (CSRF) vulnerabilityBrainstorm Force Starter Templates
- CVE-2025-0701JoeyBling bootplus list sql injectionJoeyBling bootplus
- CVE-2025-0700JoeyBling bootplus list sql injectionJoeyBling bootplus
- CVE-2025-24025Coolify Vulnerable to Reflected XSS on Tag Searchcoollabsio coolify
- CVE-2025-22610Coolify Vulnerable to OAuth Secrets Leakcoollabsio coolify
- CVE-2025-22608Coolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS)coollabsio coolify
- CVE-2025-22607Coolify Vulnerable to GitHub / GitLab OAuth Secrets Leakcoollabsio coolify
- CVE-2024-45077IBM Maximo Asset Management file uploadIBM Maximo Asset Management
- CVE-2025-23991WordPress Product Size Charts Plugin for WooCommerce plugin <= 2.4.5 - Broken Access Control vulnerabilityDotstore Product Size Charts Plugin for WooCommerce
- CVE-2025-0699JoeyBling bootplus list sql injectionJoeyBling bootplus
- CVE-2025-0698JoeyBling bootplus list sql injectionJoeyBling bootplus
- CVE-2024-13698Jobify - Job Board WordPress Theme <= 4.2.7 - Missing Authorization to Unauthenticated Server-Side Request Forgery, Arbitrary Image Upload, and Image GenerationAstoundify Jobify - Job Board WordPress Theme
- CVE-2024-40706IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2024-41757IBM Concert Software information disclosureIBM Concert Software
- CVE-2025-0697Telstra Smart Modem Gen 2 HTTP Header injectionTelstra Smart Modem Gen
- CVE-2024-10324RomethemeKit For Elementor <= 1.5.2 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templatesrometheme RTMKit
- CVE-2024-11913Activity Plus Reloaded for BuddyPress <= 1.1.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgerybuddydev Activity Plus Reloaded for BuddyPress
- CVE-2024-13354Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingcyberchimps Responsive Addons for Elementor – Free Elemento…
- CVE-2024-13335Sastra Essential Addons for Elementor – Free Elementor Addons, Widgets and Templates <= 1.0.14 - Missing Authorization to Spexo Theme Installtemplatescoderthemes Spexo Addons for Elementor – Elementor…
- CVE-2024-13542WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingpagup WP Google Street View (with 360° virtual tour) & Goog…
- CVE-2024-13594Simple Downloads List <= 1.4.2 - Authenticated (Contributor+) SQL Injectionneofix Simple Downloads List
- CVE-2024-13572Precious Metals Charts and Widgets for WordPress <= 1.2.8 - Authenticated (Contributor+) Stored Cross-site Scriptingnfusionsolutions Precious Metals Charts and Widgets for Wor…
- CVE-2024-12494BMLT Meeting Map <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingotrok7 BMLT Meeting Map
- CVE-2024-13583Simple Gallery with Filter <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingjitendra742744 Simple Gallery with Filter
- CVE-2024-13683Automate Hub Free by Sperse.IO <= 1.7.0 - Cross-Site Request Forgery to Activation Status UpdateAutomate Hub Free by Sperse.IO
- CVE-2024-13680Form Builder CP <= 1.2.41 - Authenticated (Contributor+) SQL Injectioncodepeople Form Builder CP
- CVE-2024-13659Listamester <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingListamester
- CVE-2024-11931Insufficient Granularity of Access Control in GitLabGitLab
- CVE-2024-50690SunGrow WiNet-SV200.001.00.P027 and earlier versions contains a hardcoded password that can be used to decrypt all firmware updates.
- CVE-2024-50692SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands t
- CVE-2024-57041A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' senodebb
- CVE-2024-57095SQL injection vulnerability in Go-CMS v.1.1.10 allows a remote attacker to execute arbitrary code via a crafted payload.
- CVE-2024-57184An issue was discovered in GPAC v0.8.0, as demonstrated by MP4Box.
- CVE-2024-57277InnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload.