# CVEs published 2025-02-01

39 CVEs were published on February 1, 2025: 0 critical, 5 high. Days are UTC.

- [CVE-2025-0961](https://cve.now/CVE-2025-0961.md): code-projects Job Recruitment load\_job-details.php cross site scripting (CVSS 5.1, code-projects Job Recruitment)
- [CVE-2025-0950](https://cve.now/CVE-2025-0950.md): itsourcecode Tailoring Management System staffview.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2025-0949](https://cve.now/CVE-2025-0949.md): itsourcecode Tailoring Management System partview.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2025-0948](https://cve.now/CVE-2025-0948.md): itsourcecode Tailoring Management System incview.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2025-0947](https://cve.now/CVE-2025-0947.md): itsourcecode Tailoring Management System expview.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2025-0946](https://cve.now/CVE-2025-0946.md): itsourcecode Tailoring Management System templatedelete.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2025-0945](https://cve.now/CVE-2025-0945.md): itsourcecode Tailoring Management System typedelete.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2025-0944](https://cve.now/CVE-2025-0944.md): itsourcecode Tailoring Management System customerview.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2024-13775](https://cve.now/CVE-2024-13775.md): WooCommerce Support Ticket System \<= 17.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Information Exposure (CVSS 5.4, vanquish WooCommerce Support Ticket System)
- [CVE-2024-13612](https://cve.now/CVE-2024-13612.md): Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss \<= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wordplus Better Messages – Live Chat, Chat Rooms, Real-Time…)
- [CVE-2025-0943](https://cve.now/CVE-2025-0943.md): itsourcecode Tailoring Management System deldoc.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2024-13372](https://cve.now/CVE-2024-13372.md): WP Job Portal \<= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Arbitrary Resume Download (CVSS 5.3, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2024-13371](https://cve.now/CVE-2024-13371.md): WP Job Portal \<= 2.2.6 - Missing Authorization to Unauthenticated Arbitrary Email Sending (CVSS 5.3, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2024-13428](https://cve.now/CVE-2024-13428.md): WP Job Portal \<= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Company Logo Deletion (CVSS 5.3, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2024-13425](https://cve.now/CVE-2024-13425.md): WP Job Portal \<= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion (CVSS 4.3, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2024-13429](https://cve.now/CVE-2024-13429.md): WP Job Portal \<= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Job Deletion (CVSS 4.3, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2024-12825](https://cve.now/CVE-2024-12825.md): Custom Related Posts \<= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Private Post Search and Relation Updates (CVSS 5.4, brechtvds Custom Related Posts)
- [CVE-2025-23091](https://cve.now/CVE-2025-23091.md): An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man- (CVSS 5.9, Ubiquiti UDM · Ubiquiti UDM-Pro +9)
- [CVE-2024-11829](https://cve.now/CVE-2024-11829.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 6.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2025-0939](https://cve.now/CVE-2025-0939.md): MagicForm - WordPress Form Builder \<= 1.6.2 - Missing Authorization (CVSS 6.3, dcooperman MagicForm)
- [CVE-2024-13341](https://cve.now/CVE-2024-13341.md): MultiLoca - WooCommerce Multi Locations Inventory Management \<= 4.1.11 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, Techspawn MultiLoca - WooCommerce Multi Locations Inventory…)
- [CVE-2024-13099](https://cve.now/CVE-2024-13099.md): Widget4call \<= 1.0.7 - Reflected XSS (CVSS 5.4, Widget4Call)
- [CVE-2024-13098](https://cve.now/CVE-2024-13098.md): WP Email Newsletter \<= 1.1 - Reflected XSS (CVSS 5.4, WordPress Email Newsletter)
- [CVE-2024-13097](https://cve.now/CVE-2024-13097.md): WP Finance \<= 1.3.6 - Reflected XSS (CVSS 5.4, WP Finance)
- [CVE-2024-13096](https://cve.now/CVE-2024-13096.md): WP Finance \<= 1.3.6 - Stored XSS via CSRF (CVSS 4.6, WP Finance)
- [CVE-2024-12768](https://cve.now/CVE-2024-12768.md): Responsive iframe \<= 1.2.0 - Contributor+ Stored XSS (CVSS 5.4, Responsive iframe)
- [CVE-2025-0365](https://cve.now/CVE-2025-0365.md): Jupiterx Core \<= 4.8.7 - Authenticated (Contributor+) Arbitrary File Read (CVSS 6.5, artbees Jupiter X Core)
- [CVE-2025-0366](https://cve.now/CVE-2025-0366.md): Jupiter X Core \<= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution) (CVSS 8.8, artbees Jupiter X Core)
- [CVE-2024-12041](https://cve.now/CVE-2024-12041.md): Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings \<= 8.0.12 - Unauthenticated User Information Exposure (CVSS 5.3, wpwax Directorist: AI-Powered Business Directory, Listings…)
- [CVE-2024-53295](https://cve.now/CVE-2024-53295.md): Dell PowerProtect DD versions prior to 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain an improper access control vulnerability. (CVSS 7.8, Dell PowerProtect DD)
- [CVE-2024-51534](https://cve.now/CVE-2024-51534.md): Dell PowerProtect DD versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain a path traversal vulnerability. (CVSS 7.1, Dell PowerProtect DD)
- [CVE-2024-53296](https://cve.now/CVE-2024-53296.md): Dell PowerProtect DD versions prior to 7.10.1.50 and 7.13.1.20 contain a Stack-based Buffer Overflow vulnerability in the RestAPI. (CVSS 2.7, Dell PowerProtect DD)
- [CVE-2024-12171](https://cve.now/CVE-2024-12171.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.2.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, elextensions ELEX WordPress HelpDesk & Customer Ticketing S…)
- [CVE-2024-13651](https://cve.now/CVE-2024-13651.md): RapidLoad – Optimize Web Vitals Automatically \<= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Limited Setting Reset (CVSS 4.3, shakee93 RapidLoad AI – Optimize Web Vitals Automatically)
- [CVE-2024-12620](https://cve.now/CVE-2024-12620.md): AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations \<= 1.4.23 - Missing Authorization to Unauthenticated Settings Update (CVSS 5.3, creativeinteractivemedia AnimateGL Animations for WordPress…)
- [CVE-2024-12184](https://cve.now/CVE-2024-12184.md): WordPress Contact Forms by Cimatti \<= 1.9.4 - Missing Authorization to Unauthenticated Form Submission Download (CVSS 5.3, Contact Forms by Cimatti)
- [CVE-2024-11780](https://cve.now/CVE-2024-11780.md): Site Search 360 \<= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, dsky Site Search)
- [CVE-2024-13547](https://cve.now/CVE-2024-13547.md): aThemes Addons for Elementor \<= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, smub aThemes Addons for Elementor)
- [CVE-2024-13343](https://cve.now/CVE-2024-13343.md): WooCommerce Customers Manager \<= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, Vanquish WooCommerce Customers Manager)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.