CVEs published February 15, 2025
23 CVEs were published on February 15, 2025: 4 critical, 4 high.
- Published
- 23
- Critical
- 4
- High
- 4
- Medium
- 15
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Google Chrome
- 3
- joomsky.com JS Jobs component for Joomla
- 2
- Maps Plugin using Google Maps for WordPress
- 2
- wedevs Project Manager – AI Powered Project Management, Tas…
- 2
- bitpressadmin Chat Widget: Floating Customer Support Button…
- 1
- Brocade Fabric OS
- 1
- cyberchimps Responsive Plus – Elementor Templates & Starter…
- 1
- designinvento DirectoryPress Frontend
- 1
- enituretechnology LTL Freight Quotes – Estes Edition
- 1
- Hirsch Enterphone MESH
- 1
Critical 4
- CVE-2024-12562s2Member Pro <= 241216 - Unauthenticated PHP Object InjectionWP Sharks s2Member Pro
- CVE-2024-13513Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalationoliverpos Oliver POS – A WooCommerce Point of Sale
- CVE-2025-1302Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization.jsonpath-plus
- CVE-2025-26793The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (usernHirsch Enterphone MESH
High 4
- CVE-2024-13488LTL Freight Quotes – Estes Edition <= 3.3.7 - Unauthenticated SQL Injectionenituretechnology LTL Freight Quotes – Estes Edition
- CVE-2025-0997Use after free in Navigation in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2025-0995Use after free in V8 in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2024-5461Command or parameter injection via unique embedded switch SNMP commands.Brocade Fabric OS
Medium, low and unrated 15
- CVE-2024-13834Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme <= 3.1.4 - Authenticated (Contributor+) Blind Server-Side Request Forgery via remote_requestcyberchimps Responsive Plus – Elementor Templates & Starter…
- CVE-2025-0822Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameterbitpressadmin Chat Widget: Floating Customer Support Button…
- CVE-2024-13500WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameterwedevs Project Manager – AI Powered Project Management, Tas…
- CVE-2024-13439Team – Team Members Showcase Plugin <= 4.4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Updatetechlabpro1 Team – Team Members Showcase Plugin
- CVE-2024-10581DirectoryPress Frontend <= 2.7.9 - Cross-Site Request Forgery to Listing Status Updatedesigninvento DirectoryPress Frontend
- CVE-2024-13752WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Updatewedevs Project Manager – AI Powered Project Management, Tas…
- CVE-2025-1005ElementsKit Elementor addons <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widgetroxnor ElementsKit Elementor Addons – Advanced Widgets & Te…
- CVE-2024-13525Customer Email Verification for WooCommerce <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposurewpcodefactory Customer Email Verification for WooCommerce
- CVE-2025-0935Media Library Folders <= 8.3.0 - Missing Authorization to Plugin Settings Changemaxfoundry Media Library Folders
- CVE-2024-13563Front End Users <= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password Shortcoderustaurius Front End Users
- CVE-2025-22208Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomlajoomsky.com JS Jobs component for Joomla
- CVE-2025-22209Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomlajoomsky.com JS Jobs component for Joomla
- CVE-2024-13306WP Google Map < 1.9.4 - Admin+ Stored XSSMaps Plugin using Google Maps for WordPress
- CVE-2024-13208WP Google Map < 1.9.4 - Admin+ Stored XSSMaps Plugin using Google Maps for WordPress
- CVE-2025-0996Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the contentGoogle Chrome