# CVEs published 2025-02-15

23 CVEs were published on February 15, 2025: 4 critical, 4 high. Days are UTC.

- [CVE-2024-13834](https://cve.now/CVE-2024-13834.md): Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme \<= 3.1.4 - Authenticated (Contributor+) Blind Server-Side Request Forgery via remote\_request (CVSS 5.4, cyberchimps Responsive Plus – Elementor Templates & Starter…)
- [CVE-2025-0822](https://cve.now/CVE-2025-0822.md): Bit Assist \<= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter (CVSS 6.5, bitpressadmin Chat Widget: Floating Customer Support Button…)
- [CVE-2024-13488](https://cve.now/CVE-2024-13488.md): LTL Freight Quotes – Estes Edition \<= 3.3.7 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology LTL Freight Quotes – Estes Edition)
- [CVE-2024-13500](https://cve.now/CVE-2024-13500.md): WP Project Manager \<= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter (CVSS 6.5, wedevs Project Manager – AI Powered Project Management, Tas…)
- [CVE-2024-13439](https://cve.now/CVE-2024-13439.md): Team – Team Members Showcase Plugin \<= 4.4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.3, techlabpro1 Team – Team Members Showcase Plugin)
- [CVE-2024-10581](https://cve.now/CVE-2024-10581.md): DirectoryPress Frontend \<= 2.7.9 - Cross-Site Request Forgery to Listing Status Update (CVSS 4.3, designinvento DirectoryPress Frontend)
- [CVE-2024-13752](https://cve.now/CVE-2024-13752.md): WP Project Manager \<= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update (CVSS 6.5, wedevs Project Manager – AI Powered Project Management, Tas…)
- [CVE-2024-12562](https://cve.now/CVE-2024-12562.md): s2Member Pro \<= 241216 - Unauthenticated PHP Object Injection (CVSS 9.8, WP Sharks s2Member Pro)
- [CVE-2025-1005](https://cve.now/CVE-2025-1005.md): ElementsKit Elementor addons \<= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget (CVSS 6.4, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…)
- [CVE-2024-13525](https://cve.now/CVE-2024-13525.md): Customer Email Verification for WooCommerce \<= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure (CVSS 6.5, wpcodefactory Customer Email Verification for WooCommerce)
- [CVE-2025-0935](https://cve.now/CVE-2025-0935.md): Media Library Folders \<= 8.3.0 - Missing Authorization to Plugin Settings Change (CVSS 4.3, maxfoundry Media Library Folders)
- [CVE-2024-13563](https://cve.now/CVE-2024-13563.md): Front End Users \<= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password Shortcode (CVSS 6.4, rustaurius Front End Users)
- [CVE-2025-22208](https://cve.now/CVE-2025-22208.md): Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla (CVSS 4.7, joomsky.com JS Jobs component for Joomla)
- [CVE-2025-22209](https://cve.now/CVE-2025-22209.md): Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla (CVSS 4.7, joomsky.com JS Jobs component for Joomla)
- [CVE-2024-13513](https://cve.now/CVE-2024-13513.md): Oliver POS – A WooCommerce Point of Sale (POS) \<= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation (CVSS 9.8, oliverpos Oliver POS – A WooCommerce Point of Sale)
- [CVE-2024-13306](https://cve.now/CVE-2024-13306.md): WP Google Map \< 1.9.4 - Admin+ Stored XSS (CVSS 4.3, Maps Plugin using Google Maps for WordPress)
- [CVE-2024-13208](https://cve.now/CVE-2024-13208.md): WP Google Map \< 1.9.4 - Admin+ Stored XSS (CVSS 4.3, Maps Plugin using Google Maps for WordPress)
- [CVE-2025-1302](https://cve.now/CVE-2025-1302.md): Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. (CVSS 9.3, jsonpath-plus)
- [CVE-2025-0997](https://cve.now/CVE-2025-0997.md): Use after free in Navigation in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.1, Google Chrome)
- [CVE-2025-0996](https://cve.now/CVE-2025-0996.md): Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the content (CVSS 5.4, Google Chrome)
- [CVE-2025-0995](https://cve.now/CVE-2025-0995.md): Use after free in V8 in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2024-5461](https://cve.now/CVE-2024-5461.md): Command or parameter injection via unique embedded switch SNMP commands. (CVSS 8.6, Brocade Fabric OS)
- [CVE-2025-26793](https://cve.now/CVE-2025-26793.md): The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (usern (CVSS 10.0, Hirsch Enterphone MESH)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.