# CVEs published 2025-01-25

50 CVEs were published on January 25, 2025: 1 critical, 7 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-0543](https://cve.now/CVE-2025-0543.md): G DATA Security Client Local privilege escalation (CVSS 8.5, G DATA CyberDefense AG G DATA Security Client)
- [CVE-2025-0542](https://cve.now/CVE-2025-0542.md): G DATA Management Server Local privilege escalation (CVSS 7.8, G DATA CyberDefense AG G DATA Management Server)
- [CVE-2024-35150](https://cve.now/CVE-2024-35150.md): IBM Maximo Application Suite log manipulation (CVSS 5.3, IBM Maximo Application Suite)
- [CVE-2024-35148](https://cve.now/CVE-2024-35148.md): IBM Maximo Application Suite SQL injection (CVSS 6.3, IBM Maximo Application Suite)
- [CVE-2024-35144](https://cve.now/CVE-2024-35144.md): IBM Maximo Application Suite information disclosure (CVSS 5.3, IBM Maximo Application Suite)
- [CVE-2024-35145](https://cve.now/CVE-2024-35145.md): IBM Maximo Application Suite cross-site scripting (CVSS 6.1, IBM Maximo Application Suite)
- [CVE-2024-35134](https://cve.now/CVE-2024-35134.md): IBM Analytics Content Hub information disclosure (CVSS 5.3, IBM Analytics Content Hub)
- [CVE-2024-39750](https://cve.now/CVE-2024-39750.md): IBM Analytics Content Hub buffer overflow (CVSS 8.8, IBM Analytics Content Hub)
- [CVE-2023-38271](https://cve.now/CVE-2023-38271.md): IBM Cloud Pak System information disclosure (CVSS 4.3, IBM Cloud Pak System)
- [CVE-2023-38713](https://cve.now/CVE-2023-38713.md): IBM Cloud Pak System information disclosure (CVSS 5.3, IBM Cloud Pak System)
- [CVE-2023-38714](https://cve.now/CVE-2023-38714.md): IBM Cloud Pak System information disclosure (CVSS 5.3, IBM Cloud Pak System)
- [CVE-2023-38013](https://cve.now/CVE-2023-38013.md): IBM Cloud Pak System information disclosure (CVSS 5.3, IBM Cloud Pak System)
- [CVE-2023-38012](https://cve.now/CVE-2023-38012.md): IBM Cloud Pak System directory traversal (CVSS 5.3, IBM Cloud Pak System)
- [CVE-2023-38716](https://cve.now/CVE-2023-38716.md): IBM Cloud Pak System information disclosure (CVSS 5.3, IBM Cloud Pak System)
- [CVE-2024-35114](https://cve.now/CVE-2024-35114.md): IBM Control Center information disclosure (CVSS 5.3, IBM Control Center)
- [CVE-2024-35113](https://cve.now/CVE-2024-35113.md): IBM Control Center information disclosure (CVSS 4.3, IBM Control Center)
- [CVE-2024-35112](https://cve.now/CVE-2024-35112.md): IBM Control Center cross-site scripting (CVSS 5.4, IBM Control Center)
- [CVE-2024-35111](https://cve.now/CVE-2024-35111.md): IBM Control Center information disclosure (CVSS 4.3, IBM Control Center)
- [CVE-2024-13562](https://cve.now/CVE-2024-13562.md): Import WP – Export and Import CSV and XML files to WordPress \<= 2.14.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 7.5, jcollings Import WP – Export and Import CSV and XML files t…)
- [CVE-2025-0350](https://cve.now/CVE-2025-0350.md): Divi Carousel Lite \<= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Logo Carousel Widgets (CVSS 6.4, badhonrocks Divi Carousel Free)
- [CVE-2024-13450](https://cve.now/CVE-2024-13450.md): Contact Form by Bit Form \<= 2.17.4 - Authenticated (Administrator+) Server-Side Request Forgery (CVSS 3.8, bitpressadmin Bit Form – Custom Contact Form, Multi Step, C…)
- [CVE-2024-13449](https://cve.now/CVE-2024-13449.md): Boom Fest \<= 2.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update (CVSS 4.3, ibsofts Boom Fest)
- [CVE-2024-12826](https://cve.now/CVE-2024-12826.md): GoHero Store Customizer for WooCommerce \<= 3.5 - Missing Authorization to Unuthenticated Settings Update (CVSS 4.3, nmedia GoHero Store Customizer for WooCommerce)
- [CVE-2024-13370](https://cve.now/CVE-2024-13370.md): Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress \<= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (save\_addon\_key\_license) (CVSS 6.5, Youzify – BuddyPress Community, User Profile, Social Networ…)
- [CVE-2024-13550](https://cve.now/CVE-2024-13550.md): ABC Notation \<= 6.1.3 - Authenticated (Contributor+) Arbitrary File Read (CVSS 6.5, paulrosen ABC Notation)
- [CVE-2024-13551](https://cve.now/CVE-2024-13551.md): ABC Notation \<= 6.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, paulrosen ABC Notation)
- [CVE-2024-13441](https://cve.now/CVE-2024-13441.md): Bilingual Linker \<= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, jackdewey Bilingual Linker)
- [CVE-2024-12817](https://cve.now/CVE-2024-12817.md): Etsy Importer \<= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, coreymcollins Etsy Importer)
- [CVE-2024-13586](https://cve.now/CVE-2024-13586.md): Masy Gallery \<= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, imdr Masy Gallery)
- [CVE-2024-13467](https://cve.now/CVE-2024-13467.md): WP Contact Form7 Email Spam Blocker \<= 1.0.0 - Reflected Cross-Site Scripting (CVSS 6.1, hk1993 WP Contact Form7 Email Spam Blocker)
- [CVE-2024-11825](https://cve.now/CVE-2024-11825.md): Broadstreet \<= 1.51.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via zone Parameter (CVSS 6.4, broadstreetads Broadstreet)
- [CVE-2024-13368](https://cve.now/CVE-2024-13368.md): Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress \<= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (CVSS 4.3, Youzify – BuddyPress Community, User Profile, Social Networ…)
- [CVE-2024-12113](https://cve.now/CVE-2024-12113.md): Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress By KaineLabs \<= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Review Deletion (CVSS 4.3, Youzify – BuddyPress Community, User Profile, Social Networ…)
- [CVE-2024-13458](https://cve.now/CVE-2024-13458.md): WordPress SEO Friendly Accordion FAQ with AI assisted content generation \<= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, qchantelnotice WordPress SEO Friendly Accordion FAQ with AI…)
- [CVE-2024-13599](https://cve.now/CVE-2024-13599.md): LearnPress – WordPress LMS Plugin \<= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name (CVSS 6.4, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2024-13548](https://cve.now/CVE-2024-13548.md): Power Ups for Elementor \<= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, dotrex Power Ups for Elementor)
- [CVE-2024-12885](https://cve.now/CVE-2024-12885.md): Connections Business Directory \<= 10.4.66 - Authenticated (Admin+) Arbitrary Directory Deletion (CVSS 6.5, shazahm1hotmailcom Connections Business Directory)
- [CVE-2024-12529](https://cve.now/CVE-2024-12529.md): brodos.net Onlineshop Plugin \<= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, brodosnet brodos.net Onlineshop Plugin)
- [CVE-2024-12076](https://cve.now/CVE-2024-12076.md): Target Video Easy Publish \<= 3.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, nebojsadabic Target Video Easy Publish)
- [CVE-2024-12512](https://cve.now/CVE-2024-12512.md): Ask Me Anything (Anonymously) \<= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, arunbasillal Ask Me Anything)
- [CVE-2024-12816](https://cve.now/CVE-2024-12816.md): NOTICE BOARD BY TOWKIR \<= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mastowkir NOTICE BOARD BY TOWKIR)
- [CVE-2024-12600](https://cve.now/CVE-2024-12600.md): Custom Product Tabs Lite for WooCommerce \<= 1.9.0 - Authenticated (Shop Manager+) PHP Object Injection (CVSS 7.2, skyverge Custom Product Tabs Lite for WooCommerce)
- [CVE-2024-10552](https://cve.now/CVE-2024-10552.md): Flexmls® IDX Plugin \<= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters (CVSS 6.4, Flexmls® IDX Plugin)
- [CVE-2024-13721](https://cve.now/CVE-2024-13721.md): Plethora Plugins Tabs + Accordions \<= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor (CVSS 6.4, plethoraplugins Plethora Plugins Tabs + Accordions)
- [CVE-2025-0682](https://cve.now/CVE-2025-0682.md): ThemeREX Addons \<= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode (CVSS 8.8, ThemeREX Addons)
- [CVE-2025-0411](https://cve.now/CVE-2025-0411.md): 7-Zip Mark-of-the-Web Bypass Vulnerability (CVSS 7.0, KEV, 7-Zip)
- [CVE-2024-13709](https://cve.now/CVE-2024-13709.md): Linear \<= 2.8.1 - Cross-Site Request Forgery to Cache Reset (CVSS 4.3, linearoy Linear)
- [CVE-2025-0357](https://cve.now/CVE-2025-0357.md): WPBookit \<= 1.6.9 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Iqonic Design WPBookit)
- [CVE-2025-24361](https://cve.now/CVE-2025-24361.md): Opening a malicious website while running a Nuxt dev server could allow read-only access to code (CVSS 5.3, nuxt · @nuxt/webpack-builder +1)
- [CVE-2025-24360](https://cve.now/CVE-2025-24360.md): Opening a malicious website while running a Nuxt dev server could allow read-only access to code (CVSS 5.3, nuxt · @nuxt/vite-builder)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.