# CVEs published 2025-01-24

198 CVEs were published on January 24, 2025: 9 critical, 55 high. Days are UTC.

- [CVE-2025-21262](https://cve.now/CVE-2025-21262.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2025-0710](https://cve.now/CVE-2025-0710.md): CampCodes School Management Software Notice Board Page notice-list cross site scripting (CVSS 5.3, CampCodes School Management Software)
- [CVE-2025-0709](https://cve.now/CVE-2025-0709.md): Dcat-Admin Roles Page roles cross site scripting (CVSS 5.1, Dcat-Admin)
- [CVE-2025-0708](https://cve.now/CVE-2025-0708.md): fumiao opencms Add Model Management Page addOrUpdate cross site scripting (CVSS 5.3, fumiao opencms)
- [CVE-2025-0707](https://cve.now/CVE-2025-0707.md): Rise Group Rise Mode Temp CPU Startup CRYPTBASE.dll untrusted search path (CVSS 8.5, Rise Group Rise Mode Temp CPU)
- [CVE-2025-0706](https://cve.now/CVE-2025-0706.md): JoeyBling bootplus admin.html cross site scripting (CVSS 5.1, JoeyBling bootplus)
- [CVE-2025-0705](https://cve.now/CVE-2025-0705.md): JoeyBling bootplus QrCodeController.java qrCode redirect (CVSS 6.9, JoeyBling bootplus)
- [CVE-2025-24363](https://cve.now/CVE-2025-24363.md): The HL7 FHIR IG publisher may potentially expose GitHub repo user and credential information (CVSS 4.2, HL7 fhir-ig-publisher · org.hl7.fhir.publisher:org.hl7.f… +1)
- [CVE-2024-52807](https://cve.now/CVE-2024-52807.md): XXE vulnerability in XSLT parsing in \`org.hl7.fhir.publisher\` (CVSS 8.6, HL7 fhir-ig-publisher · org.hl7.fhir.publisher:org.hl7.f… +1)
- [CVE-2025-0704](https://cve.now/CVE-2025-0704.md): JoeyBling bootplus QrCodeController.java qrCode resource consumption (CVSS 6.9, JoeyBling bootplus)
- [CVE-2025-0703](https://cve.now/CVE-2025-0703.md): JoeyBling bootplus SysFileController.java path traversal (CVSS 5.3, JoeyBling bootplus)
- [CVE-2025-24362](https://cve.now/CVE-2025-24362.md): CodeQL GitHub Action failed workflow writes GitHub PAT to debug artifacts (CVSS 7.1, github codeql-action)
- [CVE-2025-0702](https://cve.now/CVE-2025-0702.md): JoeyBling bootplus SysFileController.java unrestricted upload (CVSS 5.3, JoeyBling bootplus)
- [CVE-2019-15690](https://cve.now/CVE-2019-15690.md): LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/ (CVSS 8.8, LibVNCServer)
- [CVE-2025-24587](https://cve.now/CVE-2025-24587.md): WordPress Email Subscription Popup plugin \<= 1.2.23 - SQL Injection vulnerability (CVSS 7.6, Nks Email Subscription Popup)
- [CVE-2024-35122](https://cve.now/CVE-2024-35122.md): IBM i denial of service (CVSS 2.8, IBM i)
- [CVE-2025-24736](https://cve.now/CVE-2025-24736.md): WordPress Post Duplicator plugin \<= 2.35 - Broken Access Control vulnerability (CVSS 4.3, metaphorcreations Post Duplicator)
- [CVE-2025-24746](https://cve.now/CVE-2025-24746.md): WordPress Popup Maker plugin \<= 1.20.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Daniel Iser Popup Maker)
- [CVE-2025-24755](https://cve.now/CVE-2025-24755.md): WordPress PDF Invoice Builder for WooCommerce plugin \<= 4.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, add-ons.org PDF Invoice Builder for WooCommerce)
- [CVE-2025-24753](https://cve.now/CVE-2025-24753.md): WordPress Kadence Blocks plugin \<= 3.3.1 - Broken Access Control vulnerability (CVSS 4.3, StellarWP Gutenberg Blocks by Kadence Blocks)
- [CVE-2025-24751](https://cve.now/CVE-2025-24751.md): WordPress CoBlocks plugin \<= 3.1.13 - Broken Access Control vulnerability (CVSS 4.3, GoDaddy CoBlocks)
- [CVE-2025-24750](https://cve.now/CVE-2025-24750.md): WordPress ExactMetrics plugin \<= 8.1.0 - Broken Access Control vulnerability (CVSS 5.4, Syed Balkhi ExactMetrics)
- [CVE-2025-24756](https://cve.now/CVE-2025-24756.md): WordPress Roi Calculator plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, mgplugin Roi Calculator)
- [CVE-2025-24729](https://cve.now/CVE-2025-24729.md): WordPress ElementInvader Addons for Elementor plugin \<= 1.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Element Invader ElementInvader Addons for Elementor)
- [CVE-2025-24721](https://cve.now/CVE-2025-24721.md): WordPress Easy YouTube Gallery plugin \<= 1.0.4 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Aleksandar Urošević Easy YouTube Gallery)
- [CVE-2025-24733](https://cve.now/CVE-2025-24733.md): WordPress Post Grid Master plugin \<= 3.4.12 - Local File Inclusion vulnerability (CVSS 6.5, Akhtarujjaman Shuvo Post Grid Master)
- [CVE-2025-24726](https://cve.now/CVE-2025-24726.md): WordPress Contact Form 7 Widget plugin \<= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, HT Plugins HT Contact Form)
- [CVE-2025-24725](https://cve.now/CVE-2025-24725.md): WordPress Thim Elementor Kit Plugin \<= 1.2.8 - Broken Access Control vulnerability (CVSS 4.3, ThimPress Thim Elementor Kit)
- [CVE-2025-24730](https://cve.now/CVE-2025-24730.md): WordPress WP VR plugin \<= 8.5.14 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RexTheme WP VR)
- [CVE-2025-24738](https://cve.now/CVE-2025-24738.md): WordPress Call Now Button plugin \<= 1.4.13 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Jerry Rietveld Call Now Button)
- [CVE-2025-24728](https://cve.now/CVE-2025-24728.md): WordPress Bug Library plugin \<= 2.1.4 - SQL Injection vulnerability (CVSS 8.5, Yannick Lefebvre Bug Library)
- [CVE-2025-24723](https://cve.now/CVE-2025-24723.md): WordPress Booking Calendar Contact Form Plugin \<= 1.2.55 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9, codepeople Booking Calendar Contact Form)
- [CVE-2025-24719](https://cve.now/CVE-2025-24719.md): WordPress Widget Countdown plugin \<= 2.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpdevart Widget Countdown)
- [CVE-2025-24731](https://cve.now/CVE-2025-24731.md): WordPress IP2Location Country Blocker plugin \<= 2.38.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Download IP2Location Country Blocker)
- [CVE-2025-24732](https://cve.now/CVE-2025-24732.md): WordPress BookingPress Plugin \<= 1.1.25 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, reputeinfosystems BookingPress)
- [CVE-2025-24724](https://cve.now/CVE-2025-24724.md): WordPress Side Menu Lite Plugin \<= 5.3.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 5.4, Wow-Company Side Menu Lite)
- [CVE-2025-24739](https://cve.now/CVE-2025-24739.md): WordPress FluentSMTP plugin \<= 2.2.80 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Shahjahan Jewel FluentSMTP)
- [CVE-2025-24716](https://cve.now/CVE-2025-24716.md): WordPress Herd Effects Plugin \<= 6.2.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 5.4, Wow-Company Herd Effects)
- [CVE-2025-24727](https://cve.now/CVE-2025-24727.md): WordPress Contact Form to Email Plugin \<= 1.3.52 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, codepeople Contact Form Email)
- [CVE-2025-24717](https://cve.now/CVE-2025-24717.md): WordPress Modal Window Plugin \<= 6.1.4 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 5.4, Wow-Company Modal Window)
- [CVE-2025-24703](https://cve.now/CVE-2025-24703.md): WordPress Comment Edit Core – Simple Comment Editing Plugin \<= 3.0.33 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, Ronald Huereca Comment Edit Core – Simple Comment Editing)
- [CVE-2025-24715](https://cve.now/CVE-2025-24715.md): WordPress Counter Box Plugin \<= 2.0.5 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 5.4, Wow-Company Counter Box)
- [CVE-2025-24713](https://cve.now/CVE-2025-24713.md): WordPress Button Generator – easily Button Builder Plugin \<= 3.1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Wow-Company Button Generator – easily Button Builder)
- [CVE-2025-24722](https://cve.now/CVE-2025-24722.md): WordPress FAQ Builder AYS Plugin \<= 1.7.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Ays Pro FAQ Builder AYS)
- [CVE-2025-24720](https://cve.now/CVE-2025-24720.md): WordPress Sticky Buttons Plugin \<= 4.1.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 5.4, Wow-Company Sticky Buttons)
- [CVE-2025-24696](https://cve.now/CVE-2025-24696.md): WordPress Gutenberg Blocks and Page Layouts Plugin \<= 1.9.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Shafaet Alam Attire Blocks)
- [CVE-2025-24706](https://cve.now/CVE-2025-24706.md): WordPress MultiVendorX plugin \<= 4.2.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MultiVendorX)
- [CVE-2025-24709](https://cve.now/CVE-2025-24709.md): WordPress Plethora Plugins Tabs + Accordions plugin \<= 1.1.5 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Plethora Plugins Tabs + Accordions)
- [CVE-2025-24712](https://cve.now/CVE-2025-24712.md): WordPress Radius Blocks – WordPress Gutenberg Blocks Plugin \<= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, RadiusTheme Radius Blocks)
- [CVE-2025-24698](https://cve.now/CVE-2025-24698.md): WordPress Essential Real Estate plugin \<= 5.1.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, g5theme Essential Real Estate)
- [CVE-2025-24711](https://cve.now/CVE-2025-24711.md): WordPress Popup Box Plugin \<= 3.2.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Wow-Company Popup Box)
- [CVE-2025-24714](https://cve.now/CVE-2025-24714.md): WordPress Bubble Menu Plugin \<= 4.0.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Wow-Company Bubble Menu – circle floating menu)
- [CVE-2025-24705](https://cve.now/CVE-2025-24705.md): WordPress WooCommerce Quick View plugin \<= 1.1.1 - Sensitive Data Exposure vulnerability (CVSS 5.3, Arshid WooCommerce Quick View)
- [CVE-2025-24704](https://cve.now/CVE-2025-24704.md): WordPress Magic the Gathering Card Tooltips plugin \<= 3.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, grimdonkey Magic the Gathering Card Tooltips)
- [CVE-2025-24674](https://cve.now/CVE-2025-24674.md): WordPress ShMapper by Teplitsa Plugin \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Denis Cherniatev ShMapper by Teplitsa)
- [CVE-2025-24683](https://cve.now/CVE-2025-24683.md): WordPress RSVP and Event Management Plugin \<= 2.7.14 - SQL Injection vulnerability (CVSS 7.6, WP Chill RSVP and Event Management)
- [CVE-2025-24695](https://cve.now/CVE-2025-24695.md): WordPress Extensions For CF7 Plugin \<= 3.2.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, HT Plugins Extensions For CF7)
- [CVE-2025-24701](https://cve.now/CVE-2025-24701.md): WordPress Chained Quiz Plugin \<= 1.3.2.9 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, Bob Chained Quiz)
- [CVE-2025-24691](https://cve.now/CVE-2025-24691.md): WordPress People Lists plugin \<= 1.3.10 - Broken Access Control vulnerability (CVSS 4.3, ctltwp People Lists)
- [CVE-2025-24693](https://cve.now/CVE-2025-24693.md): WordPress Advanced Notifications plugin \<= 1.2.7 - Broken Access Control vulnerability (CVSS 4.3, Yehi Advanced Notifications)
- [CVE-2025-24681](https://cve.now/CVE-2025-24681.md): WordPress Product Carousel Slider & Grid Ultimate for WooCommerce Plugin \<= 1.10.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, wpWax Product Carousel Slider & Grid Ultimate for WooCommer…)
- [CVE-2025-24678](https://cve.now/CVE-2025-24678.md): WordPress Listamester Plugin \<= 2.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Listamester)
- [CVE-2025-24682](https://cve.now/CVE-2025-24682.md): WordPress Super Block Slider plugin \<= 2.7.9 - Broken Access Control vulnerability (CVSS 4.3, Michael Super Block Slider)
- [CVE-2025-24687](https://cve.now/CVE-2025-24687.md): WordPress Show/Hide Shortcode plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Lars Wallenborn Show/Hide Shortcode)
- [CVE-2025-24702](https://cve.now/CVE-2025-24702.md): WordPress Xagio SEO plugin \<= 7.0.0.20 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Xagio SEO)
- [CVE-2025-24675](https://cve.now/CVE-2025-24675.md): WordPress WP Visitor Statistics (Real Time Traffic) plugin \<= 7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, osama.esh WP Visitor Statistics)
- [CVE-2025-24666](https://cve.now/CVE-2025-24666.md): WordPress Hyve Lite plugin \<= 1.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Themeisle AI Chatbot for WordPress – Hyve Lite)
- [CVE-2025-24679](https://cve.now/CVE-2025-24679.md): WordPress Internal Links Manager plugin \<= 2.5.2 - Broken Access Control vulnerability (CVSS 4.3, webraketen Internal Links Manager)
- [CVE-2025-24673](https://cve.now/CVE-2025-24673.md): WordPress Ketchup Shortcodes Plugin \<= 0.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, AyeCode Ketchup Shortcodes)
- [CVE-2025-24669](https://cve.now/CVE-2025-24669.md): WordPress SERPed.net Plugin \<= 4.4 - SQL Injection vulnerability (CVSS 8.5, serpednet SERPed.net)
- [CVE-2025-24658](https://cve.now/CVE-2025-24658.md): WordPress Auction Nudge – Your eBay on Your Site plugin \<= 7.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Joe Auction Nudge – Your eBay on Your Site)
- [CVE-2025-24672](https://cve.now/CVE-2025-24672.md): WordPress Form Builder CP Plugin \<= 1.2.41 - SQL Injection vulnerability (CVSS 8.5, codepeople Form Builder CP)
- [CVE-2025-24668](https://cve.now/CVE-2025-24668.md): WordPress PPOM for WooCommerce plugin \<= 33.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Themeisle PPOM for WooCommerce)
- [CVE-2025-24659](https://cve.now/CVE-2025-24659.md): WordPress Premium Packages – Sell Digital Products Securely plugin \<= 5.9.6 - SQL Injection vulnerability (CVSS 7.6, Shahjada WPDM – Premium Packages)
- [CVE-2025-24649](https://cve.now/CVE-2025-24649.md): WordPress Admin and Site Enhancements (ASE) Plugin \<= 7.6.2 - Broken Access Control vulnerability (CVSS 4.3, Bowo Admin and Site Enhancements)
- [CVE-2025-24663](https://cve.now/CVE-2025-24663.md): WordPress Simple Download Monitor plugin \<= 3.9.25 - SQL Injection vulnerability (CVSS 7.6, mra13 Simple Download Monitor)
- [CVE-2025-24657](https://cve.now/CVE-2025-24657.md): WordPress Wishlist for WooCommerce plugin \<=2.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WebToffee Wishlist for WooCommerce)
- [CVE-2025-24644](https://cve.now/CVE-2025-24644.md): WordPress WooCommerce PDF Invoices plugin \<= 4.7.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…)
- [CVE-2025-24647](https://cve.now/CVE-2025-24647.md): WordPress WooCommerce Cloak Affiliate Links plugin \<= 1.0.35 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, datafeedr WooCommerce Cloak Affiliate Links)
- [CVE-2025-24650](https://cve.now/CVE-2025-24650.md): WordPress Tourfic plugin \<= 2.15.3 - Arbitrary File Upload vulnerability (CVSS 9.1, Themefic Tourfic)
- [CVE-2025-24625](https://cve.now/CVE-2025-24625.md): WordPress Taxonomy/Term and Role based Discounts for WooCommerce plugin \<= 5.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, Marco Almeida | Webdados Taxonomy/Term and Role based Disco…)
- [CVE-2025-24623](https://cve.now/CVE-2025-24623.md): WordPress Really Simple Security plugin \<= 9.1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Really Simple Plugins Really Simple SSL)
- [CVE-2025-24638](https://cve.now/CVE-2025-24638.md): WordPress Create with Code plugin \<= 1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, pddring Create with Code)
- [CVE-2025-24627](https://cve.now/CVE-2025-24627.md): WordPress Blur Text Plugin \<= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Linnea Huxford Blur Text)
- [CVE-2025-24652](https://cve.now/CVE-2025-24652.md): WordPress WP Duplicate plugin \<= 1.1.6 - Broken Access Control vulnerability (CVSS 5.4, revmakx WP Duplicate)
- [CVE-2025-24634](https://cve.now/CVE-2025-24634.md): WordPress Orbisius Simple Notice plugin \<= 1.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Svetoslav Marinov Orbisius Simple Notice)
- [CVE-2025-24613](https://cve.now/CVE-2025-24613.md): WordPress FV Thoughtful Comments plugin \<= 0.3.5 - Broken Access Control vulnerability (CVSS 4.3, FolioVision FV Thoughtful Comments)
- [CVE-2025-24610](https://cve.now/CVE-2025-24610.md): WordPress Restrict Anonymous Access Plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Christian Leuenberg Restrict Anonymous Access)
- [CVE-2025-24622](https://cve.now/CVE-2025-24622.md): WordPress Job Board Manager plugin \<= 2.1.59 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, PickPlugins Job Board Manager)
- [CVE-2025-24618](https://cve.now/CVE-2025-24618.md): WordPress ElementInvader Addons for Elementor Plugin \<= 1.3.1 - Broken Access Control vulnerability (CVSS 4.3, Element Invader ElementInvader Addons for Elementor)
- [CVE-2025-24636](https://cve.now/CVE-2025-24636.md): WordPress MachForm Shortcode plugin \<= 1.4.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Rick Laymance MachForm Shortcode)
- [CVE-2025-24633](https://cve.now/CVE-2025-24633.md): WordPress Build Private Store For Woocommerce plugin \<= 1.0 - Broken Access Control vulnerability (CVSS 5.3, silverplugins217 Build Private Store For Woocommerce)
- [CVE-2025-24611](https://cve.now/CVE-2025-24611.md): WordPress Export All Posts, Products, Orders, Refunds & Users Plugin \<= 2.9 - Arbitrary File Read vulnerability (CVSS 4.9, Smackcoders Inc., WP Ultimate Exporter)
- [CVE-2025-24596](https://cve.now/CVE-2025-24596.md): WordPress WooCommerce Product Table Lite plugin \<= 3.8.7 - Broken Access Control vulnerability (CVSS 5.3, WC Product Table WooCommerce Product Table Lite)
- [CVE-2025-24604](https://cve.now/CVE-2025-24604.md): WordPress VForm plugin \<= 3.0.5 - Broken Access Control vulnerability (CVSS 5.4, Vikas Ratudi VPSUForm)
- [CVE-2025-24594](https://cve.now/CVE-2025-24594.md): WordPress Linet ERP-Woocommerce Integration plugin \<= 3.5.7 - CSRF to Broken Access Control vulnerability (CVSS 6.5, aribhour Linet ERP-Woocommerce Integration)
- [CVE-2025-24562](https://cve.now/CVE-2025-24562.md): WordPress KBucket plugin \<= 4.1.6 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, Optimal Access KBucket)
- [CVE-2025-24595](https://cve.now/CVE-2025-24595.md): WordPress All Embed – Elementor Addons plugin \<= 1.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins All Embed – Elementor Addons)
- [CVE-2025-24572](https://cve.now/CVE-2025-24572.md): WordPress WP Fast Total Search plugin \<= 1.78.258 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, Epsiloncool WP Fast Total Search)
- [CVE-2025-24588](https://cve.now/CVE-2025-24588.md): WordPress Patreon WordPress plugin \<= 1.9.1 - Broken Access Control vulnerability (CVSS 6.5, Patreon WordPress)
- [CVE-2025-24543](https://cve.now/CVE-2025-24543.md): WordPress Ultimate Coming Soon & Maintenance plugin \<= 1.0.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, RSTheme Ultimate Coming Soon & Maintenance)
- [CVE-2025-24573](https://cve.now/CVE-2025-24573.md): WordPress Pagelayer plugin \<= 1.9.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Softaculous PageLayer)
- [CVE-2025-24547](https://cve.now/CVE-2025-24547.md): WordPress Caching Compatible Cookie Opt-In plugin \<= 0.0.10 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, matthias.wagner Caching Compatible Cookie Opt-In and JavaSc…)
- [CVE-2025-24552](https://cve.now/CVE-2025-24552.md): WordPress Paytium plugin \<= 4.4.11 - Full Path Disclosure (FPD) vulnerability (CVSS 5.3, paytiumsupport Paytium)
- [CVE-2025-24570](https://cve.now/CVE-2025-24570.md): WordPress Atarim plugin \<= 4.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Vito Peleg Atarim)
- [CVE-2025-24579](https://cve.now/CVE-2025-24579.md): WordPress Nested pages plugin \<= 3.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Kyle Phillips Nested Pages)
- [CVE-2025-24589](https://cve.now/CVE-2025-24589.md): WordPress JSM Show Post Metadata plugin \<= 4.6.0 - Broken Access Control vulnerability (CVSS 4.3, JS Morisset JSM Show Post Metadata)
- [CVE-2025-24542](https://cve.now/CVE-2025-24542.md): WordPress Icegram Engage plugin \<= 3.1.31 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Icegram)
- [CVE-2025-24585](https://cve.now/CVE-2025-24585.md): WordPress Event post plugin \<= 5.9.7 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Bastien Ho Event post)
- [CVE-2025-24578](https://cve.now/CVE-2025-24578.md): WordPress ElementInvader Addons for Elementor plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Element Invader ElementInvader Addons for Elementor)
- [CVE-2025-24571](https://cve.now/CVE-2025-24571.md): WordPress WP Fast Total Search plugin \<= 1.78.258 - Broken Access Control vulnerability (CVSS 5.4, Epsiloncool WP Fast Total Search)
- [CVE-2025-24591](https://cve.now/CVE-2025-24591.md): WordPress GDPR CCPA Compliance & Cookie Consent Banner plugin \<= 2.7.1 - Broken Access Control vulnerability (CVSS 4.3, Ninja Team GDPR CCPA Compliance Support)
- [CVE-2025-24546](https://cve.now/CVE-2025-24546.md): WordPress Ultimate Coming Soon & Maintenance plugin \<= 1.0.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, RSTheme Ultimate Coming Soon & Maintenance)
- [CVE-2025-24582](https://cve.now/CVE-2025-24582.md): WordPress 12 Step Meeting List plugin \<= 3.16.5 - Sensitive Data Exposure vulnerability (CVSS 5.3, AA Web Servant 12 Step Meeting List)
- [CVE-2025-24561](https://cve.now/CVE-2025-24561.md): WordPress ReviewsTap plugin \<= 1.1.2 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, awcode ReviewsTap)
- [CVE-2025-24580](https://cve.now/CVE-2025-24580.md): WordPress 12 Step Meeting List plugin \<= 3.16.5 - Arbitrary Content Deletion vulnerability (CVSS 6.5, AA Web Servant 12 Step Meeting List)
- [CVE-2025-24575](https://cve.now/CVE-2025-24575.md): WordPress HelloAsso plugin \<= 1.1.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, HelloAsso)
- [CVE-2025-24568](https://cve.now/CVE-2025-24568.md): WordPress Starter Templates plugin \<= 4.4.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Brainstorm Force Starter Templates)
- [CVE-2025-24555](https://cve.now/CVE-2025-24555.md): WordPress Subscription DNA plugin \<= 2.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, subscriptiondna Subscription DNA)
- [CVE-2025-0701](https://cve.now/CVE-2025-0701.md): JoeyBling bootplus list sql injection (CVSS 5.3, JoeyBling bootplus)
- [CVE-2025-0700](https://cve.now/CVE-2025-0700.md): JoeyBling bootplus list sql injection (CVSS 5.3, JoeyBling bootplus)
- [CVE-2025-24359](https://cve.now/CVE-2025-24359.md): ASTEVAL Vulnerable to Maliciously Crafted Format Strings Leading to Sandbox Escape (CVSS 8.4, lmfit asteval · asteval)
- [CVE-2025-24355](https://cve.now/CVE-2025-24355.md): Updatecli may expose Maven credentials in console output (CVSS 7.1, updatecli · github.com/updatecli/updatecli)
- [CVE-2025-24025](https://cve.now/CVE-2025-24025.md): Coolify Vulnerable to Reflected XSS on Tag Search (CVSS 1.3, coollabsio coolify)
- [CVE-2025-22612](https://cve.now/CVE-2025-22612.md): Coolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE) (CVSS 10.0, coollabsio coolify)
- [CVE-2025-22611](https://cve.now/CVE-2025-22611.md): Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE) (CVSS 10.0, coollabsio coolify)
- [CVE-2025-22610](https://cve.now/CVE-2025-22610.md): Coolify Vulnerable to OAuth Secrets Leak (CVSS 5.7, coollabsio coolify)
- [CVE-2025-22609](https://cve.now/CVE-2025-22609.md): Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE) (CVSS 10.0, coollabsio coolify)
- [CVE-2025-22608](https://cve.now/CVE-2025-22608.md): Coolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS) (CVSS 6.5, coollabsio coolify)
- [CVE-2025-22607](https://cve.now/CVE-2025-22607.md): Coolify Vulnerable to GitHub / GitLab OAuth Secrets Leak (CVSS 4.7, coollabsio coolify)
- [CVE-2025-22606](https://cve.now/CVE-2025-22606.md): Coolify Command Injection Vulnerability in Project Name (CVSS 8.5, coollabsio coolify)
- [CVE-2024-45077](https://cve.now/CVE-2024-45077.md): IBM Maximo Asset Management file upload (CVSS 6.5, IBM Maximo Asset Management)
- [CVE-2025-23991](https://cve.now/CVE-2025-23991.md): WordPress Product Size Charts Plugin for WooCommerce plugin \<= 2.4.5 - Broken Access Control vulnerability (CVSS 4.3, Dotstore Product Size Charts Plugin for WooCommerce)
- [CVE-2025-0699](https://cve.now/CVE-2025-0699.md): JoeyBling bootplus list sql injection (CVSS 5.3, JoeyBling bootplus)
- [CVE-2025-0698](https://cve.now/CVE-2025-0698.md): JoeyBling bootplus list sql injection (CVSS 5.3, JoeyBling bootplus)
- [CVE-2024-40693](https://cve.now/CVE-2024-40693.md): IBM Planning Analytics file upload (CVSS 8.0, IBM Planning Analytics Local)
- [CVE-2024-25034](https://cve.now/CVE-2024-25034.md): IBM Planning Analytics file upload (CVSS 8.0, IBM Planning Analytics Local)
- [CVE-2024-13698](https://cve.now/CVE-2024-13698.md): Jobify - Job Board WordPress Theme \<= 4.2.7 - Missing Authorization to Unauthenticated Server-Side Request Forgery, Arbitrary Image Upload, and Image Generation (CVSS 6.5, Astoundify Jobify - Job Board WordPress Theme)
- [CVE-2024-40706](https://cve.now/CVE-2024-40706.md): IBM InfoSphere Information Server information disclosure (CVSS 5.3, IBM InfoSphere Information Server)
- [CVE-2024-41757](https://cve.now/CVE-2024-41757.md): IBM Concert Software information disclosure (CVSS 5.9, IBM Concert Software)
- [CVE-2025-0697](https://cve.now/CVE-2025-0697.md): Telstra Smart Modem Gen 2 HTTP Header injection (CVSS 6.9, Telstra Smart Modem Gen)
- [CVE-2025-22605](https://cve.now/CVE-2025-22605.md): Coolify OS Command Injection Vulnerability in SSH Command Generation (CVSS 8.5, coollabsio coolify)
- [CVE-2024-9499](https://cve.now/CVE-2024-9499.md): Uncontrolled search path can lead to DLL hijacking in USBXpress Win 98SE Dev Kit installer (CVSS 8.6, silabs.com USBXpress Win 98SE Dev Kit)
- [CVE-2024-9498](https://cve.now/CVE-2024-9498.md): Uncontrolled search path can lead to DLL hijacking in USBXpress SDK installer (CVSS 8.6, silabs.com USBXpress SDK)
- [CVE-2024-9497](https://cve.now/CVE-2024-9497.md): Uncontrolled search path can lead to DLL hijacking in USBXpress 4 SDK installer (CVSS 8.6, silabs.com USBXpress 4 SDK)
- [CVE-2024-9496](https://cve.now/CVE-2024-9496.md): Uncontrolled search path can lead to DLL hijacking in USBXpress Dev Kit installer (CVSS 8.6, silabs.com USBXpress Dev Kit)
- [CVE-2024-9495](https://cve.now/CVE-2024-9495.md): Uncontrolled search path can lead to DLL hijacking in CP210x VCP Windows installer (CVSS 8.6, silabs.com CP210x VCP Windows)
- [CVE-2024-9494](https://cve.now/CVE-2024-9494.md): Uncontrolled search path can lead to DLL hijacking in CP210 VCP Win 2k installer (CVSS 8.6, silabs.com CP210 VCP Win)
- [CVE-2024-9493](https://cve.now/CVE-2024-9493.md): Uncontrolled search path can lead to DLL hijacking in ToolStick installer (CVSS 8.6, silabs.com ToolStick)
- [CVE-2024-9492](https://cve.now/CVE-2024-9492.md): Uncontrolled search path can lead to DLL hijacking in Flash Programming Utility installer (CVSS 8.6, silabs.com Flash Programming Utility)
- [CVE-2024-9491](https://cve.now/CVE-2024-9491.md): Uncontrolled search path can lead to DLL hijacking in Configuration Wizard 2 installer (CVSS 8.6, silabs.com Configuration Wizard)
- [CVE-2024-9490](https://cve.now/CVE-2024-9490.md): Uncontrolled search path can lead to DLL hijacking in Silicon Labs IDE installer (CVSS 8.6, silabs.com Silicon Labs IDE)
- [CVE-2024-10324](https://cve.now/CVE-2024-10324.md): RomethemeKit For Elementor \<= 1.5.2 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates (CVSS 4.3, rometheme RTMKit)
- [CVE-2024-11913](https://cve.now/CVE-2024-11913.md): Activity Plus Reloaded for BuddyPress \<= 1.1.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery (CVSS 5.4, buddydev Activity Plus Reloaded for BuddyPress)
- [CVE-2024-41739](https://cve.now/CVE-2024-41739.md): IBM Cognos Dashboards on Cloud Pak for Data privilege escalation (CVSS 8.8, IBM Cognos Dashboards on Cloud Pak for Data)
- [CVE-2024-13408](https://cve.now/CVE-2024-13408.md): Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget \<= 1.6.10 - Authenticated (Contributor+) Local File Inclusion (CVSS 7.5, wpwax Post Grid, Slider & Carousel Ultimate – with Shortcod…)
- [CVE-2024-13354](https://cve.now/CVE-2024-13354.md): Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates \<= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, cyberchimps Responsive Addons for Elementor – Free Elemento…)
- [CVE-2024-13335](https://cve.now/CVE-2024-13335.md): Sastra Essential Addons for Elementor – Free Elementor Addons, Widgets and Templates \<= 1.0.14 - Missing Authorization to Spexo Theme Install (CVSS 4.3, templatescoderthemes Spexo Addons for Elementor – Elementor…)
- [CVE-2024-13542](https://cve.now/CVE-2024-13542.md): WP Google Street View (with 360° virtual tour) & Google maps + Local SEO \<= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, pagup WP Google Street View (with 360° virtual tour) & Goog…)
- [CVE-2024-13594](https://cve.now/CVE-2024-13594.md): Simple Downloads List \<= 1.4.2 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, neofix Simple Downloads List)
- [CVE-2024-13572](https://cve.now/CVE-2024-13572.md): Precious Metals Charts and Widgets for WordPress \<= 1.2.8 - Authenticated (Contributor+) Stored Cross-site Scripting (CVSS 6.4, nfusionsolutions Precious Metals Charts and Widgets for Wor…)
- [CVE-2024-13409](https://cve.now/CVE-2024-13409.md): Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget \<= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via post\_type\_ajax\_handler() (CVSS 7.5, wpwax Post Grid, Slider & Carousel Ultimate – with Shortcod…)
- [CVE-2025-22714](https://cve.now/CVE-2025-22714.md): WordPress MDJM Event Management Plugin \<= 1.7.5.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, MDJM Mobile DJ Manager)
- [CVE-2025-23889](https://cve.now/CVE-2025-23889.md): WordPress FooGallery Captions Plugin \<= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tormorten FooGallery Captions)
- [CVE-2025-23888](https://cve.now/CVE-2025-23888.md): WordPress Custom Page Extensions Plugin \<= 0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, GrandSlambert Custom Page Extensions)
- [CVE-2025-23885](https://cve.now/CVE-2025-23885.md): WordPress MJ Contact us Plugin \<= 5.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, anildhiman MJ Contact us)
- [CVE-2025-23839](https://cve.now/CVE-2025-23839.md): WordPress Sticky Button plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Asif Shakeel Sticky Button)
- [CVE-2025-23838](https://cve.now/CVE-2025-23838.md): WordPress Bauernregeln Plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rally Vincent Bauernregeln)
- [CVE-2025-23837](https://cve.now/CVE-2025-23837.md): WordPress One Backend Language Plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, martinjuhasz One Backend Language)
- [CVE-2025-23737](https://cve.now/CVE-2025-23737.md): WordPress Network-Favorites plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, thobian Network-Favorites)
- [CVE-2025-23734](https://cve.now/CVE-2025-23734.md): WordPress Gigaom Sphinx plugin \<= 0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Casey Bisson Gigaom Sphinx)
- [CVE-2025-23711](https://cve.now/CVE-2025-23711.md): WordPress Quote me plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Quincy Kwende Quote me)
- [CVE-2025-23622](https://cve.now/CVE-2025-23622.md): WordPress CBX Accounting & Bookkeeping plugin \<= 1.3.14 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sabuj Kundu CBX Accounting & Bookkeeping)
- [CVE-2025-23621](https://cve.now/CVE-2025-23621.md): WordPress Causes – Donation plugin \<= 1.0.01 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, algothemes Causes – Donation Plugin)
- [CVE-2025-23522](https://cve.now/CVE-2025-23522.md): WordPress HM Portfolio plugin \<= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Matthew Haines-Young HM Portfolio)
- [CVE-2025-23427](https://cve.now/CVE-2025-23427.md): WordPress Redux Converter plugin \<= 1.1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, David Anderson / Team Updraft Redux Converter)
- [CVE-2025-23422](https://cve.now/CVE-2025-23422.md): WordPress Store Locator plugin \<= 3.98.10 - Local File Inclusion vulnerability (CVSS 7.5, moaluko Store Locator)
- [CVE-2024-12494](https://cve.now/CVE-2024-12494.md): BMLT Meeting Map \<= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, otrok7 BMLT Meeting Map)
- [CVE-2024-13583](https://cve.now/CVE-2024-13583.md): Simple Gallery with Filter \<= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, jitendra742744 Simple Gallery with Filter)
- [CVE-2024-13545](https://cve.now/CVE-2024-13545.md): Bootstrap Ultimate \<= 1.4.9 - Unauthenticated Limited Local File Inclusion (CVSS 9.8, eminozlem Bootstrap Ultimate)
- [CVE-2024-13683](https://cve.now/CVE-2024-13683.md): Automate Hub Free by Sperse.IO \<= 1.7.0 - Cross-Site Request Forgery to Activation Status Update (CVSS 4.3, Automate Hub Free by Sperse.IO)
- [CVE-2024-13680](https://cve.now/CVE-2024-13680.md): Form Builder CP \<= 1.2.41 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, codepeople Form Builder CP)
- [CVE-2024-13659](https://cve.now/CVE-2024-13659.md): Listamester \<= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Listamester)
- [CVE-2024-11931](https://cve.now/CVE-2024-11931.md): Insufficient Granularity of Access Control in GitLab (CVSS 6.4, GitLab)
- [CVE-2025-0314](https://cve.now/CVE-2025-0314.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2022-47090](https://cve.now/CVE-2022-47090.md): GPAC MP4box 2.1-DEV-rev574-g9d5bb184b contains a buffer overflow in gf\_vvc\_read\_pps\_bs\_internal function of media\_tools/av\_parsers.c, check (CVSS 7.8)
- [CVE-2024-50690](https://cve.now/CVE-2024-50690.md): SunGrow WiNet-SV200.001.00.P027 and earlier versions contains a hardcoded password that can be used to decrypt all firmware updates. (CVSS 6.5)
- [CVE-2024-50692](https://cve.now/CVE-2024-50692.md): SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands t (CVSS 5.4)
- [CVE-2024-50694](https://cve.now/CVE-2024-50694.md): In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message, the underlying code does not (CVSS 9.8)
- [CVE-2024-50695](https://cve.now/CVE-2024-50695.md): SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to stack-based buffer overflow when parsing MQTT messages, due to missing (CVSS 9.8)
- [CVE-2024-50697](https://cve.now/CVE-2024-50697.md): In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when decrypting MQTT messages, the code that parses specific TLV fields does not ha (CVSS 8.1)
- [CVE-2024-50698](https://cve.now/CVE-2024-50698.md): SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow due to bounds checks of the MQTT message co (CVSS 9.8)
- [CVE-2024-56404](https://cve.now/CVE-2024-56404.md): In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation. (CVSS 9.9, OneIdentity Identity Manager)
- [CVE-2024-57041](https://cve.now/CVE-2024-57041.md): A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' se (CVSS 4.6, nodebb)
- [CVE-2024-57095](https://cve.now/CVE-2024-57095.md): SQL injection vulnerability in Go-CMS v.1.1.10 allows a remote attacker to execute arbitrary code via a crafted payload. (CVSS 6.8)
- [CVE-2024-57184](https://cve.now/CVE-2024-57184.md): An issue was discovered in GPAC v0.8.0, as demonstrated by MP4Box. (CVSS 5.5)
- [CVE-2024-57277](https://cve.now/CVE-2024-57277.md): InnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload. (CVSS 5.7)
- [CVE-2025-23222](https://cve.now/CVE-2025-23222.md): An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. (CVSS 8.4, Deepin dde-api-proxy)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.