CVEs published February 22, 2025
34 CVEs were published on February 22, 2025: 2 critical, 18 high.
- Published
- 34
- Critical
- 2
- High
- 18
- Medium
- 12
- Low
- 1
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Imagination Technologies Graphics DDK
- 4
- A1POST.BG Shipping for Woo
- 1
- apollo13themes Rife Extensions & Templates for Elementor
- 1
- appsbd Vitepos
- 1
- enituretechnology Distance Based Shipping Calculator
- 1
- enituretechnology LTL Freight Quotes – Purolator Edition
- 1
- FULL SERVICES FULL Customer
- 1
- grafreak Pago por Redsys
- 1
- grimdonkey Magic the Gathering Card Tooltips
- 1
- IBM Watson Query on Cloud Pak for Data
- 1
Critical 2
High 18
- CVE-2022-28339Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulnerability that could alTrend Micro HouseCall for Home Networks
- CVE-2025-26774WordPress Responsive Modal Builder for High Conversion – Easy Popups plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityRock Solid Responsive Modal Builder for High Conversion – E…
- CVE-2025-26760WordPress Calculator Builder plugin <= 1.6.2 - Local File Inclusion vulnerabilityWow-Company Calculator Builder
- CVE-2025-26757WordPress FULL – Cliente plugin <= 3.1.26 - Local File Inclusion vulnerabilityFULL SERVICES FULL Customer
- CVE-2025-27012WordPress A1POST.BG Shipping for Woo plugin <= 1.5 - CSRF to Privilege Escalation vulnerabilityA1POST.BG Shipping for Woo
- CVE-2025-26756WordPress Magic the Gathering Card Tooltips plugin <= 3.5.0 - Cross Site Scripting (XSS) vulnerabilitygrimdonkey Magic the Gathering Card Tooltips
- CVE-2024-12577GPU DDK - rgxfw_pcset_ungrab OOB write via psFWMemContext->uiPageCatBaseRegSetImagination Technologies Graphics DDK
- CVE-2024-52939GPU DDK - RGXFWIF_HWPERF_CTL_BLK.uiNumCounters OOB writeImagination Technologies Graphics DDK
- CVE-2024-46975GPU DDK - rgxfw_write_robustness_buffer allows arbitrary catreg set mappingImagination Technologies Graphics DDK
- CVE-2025-0957Vulnerability: SMTP for Amazon SES <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logsyaycommerce SMTP for Amazon SES – YaySMTP
- CVE-2025-0953SMTP for Sendinblue – YaySMTP <= 1.2 - Unauthenticated Stored Cross-Site Scripting via Email Logsyaycommerce SMTP for Sendinblue – YaySMTP
- CVE-2025-0918SMTP for SendGrid – YaySMTP <= 1.4 - Unauthenticated Stored Cross-Site Scripting via Email Logsyaycommerce SMTP for SendGrid – YaySMTP
- CVE-2024-13869Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_filewpvividplugins WPvivid — Backup, Migration & Staging
- CVE-2025-1361IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init FunctionIP2Location Country Blocker
- CVE-2024-13474LTL Freight Quotes – Purolator Edition <= 2.2.3 - Unauthenticated SQL Injectionenituretechnology LTL Freight Quotes – Purolator Edition
- CVE-2024-13899Mambo Importer <= 1.0 - Authenticated (Administrator+) PHP Object Injectionmisterpah Mambo Importer
- CVE-2025-1510Custom Post Type Date Archives <= 2.7.1 - Missing Authorization to Unauthenticated Arbitrary Shortcode Executionkeesiemeijer Custom Post Type Date Archives
- CVE-2025-1509Show Me The Cookies <= 1.0 - Unauthenticated Arbitrary Shortcode Executionversluis Show Me The Cookies
Medium, low and unrated 14
- CVE-2025-26764WordPress Distance Based Shipping Calculator plugin <= 2.0.22 - Settings Change vulnerabilityenituretechnology Distance Based Shipping Calculator
- CVE-2025-26973WordPress Social Warfare Plugin <= 4.5.5 - Cross Site Scripting (XSS) vulnerabilityWarfarePlugins Social Warfare
- CVE-2025-26750WordPress Vitepos Plugin <= 3.1.3 - Broken Access Control vulnerabilityappsbd Vitepos
- CVE-2024-47896GPU DDK - rgxfw_hwr_log_info OOB write via psHWRInfoBuf->ui32WriteIndexImagination Technologies Graphics DDK
- CVE-2025-1557OFCMS cross-site request forgeryOFCMS
- CVE-2025-1556westboy CicadasCMS Template Management system deserializationwestboy CicadasCMS
- CVE-2025-21704usb: cdc-acm: Check control transfer buffer size before accessLinux
- CVE-2025-1553pankajindevops scale project cross site scriptingpankajindevops scale
- CVE-2024-13564Rife Elementor Extensions & Templates <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Shortcodeapollo13themes Rife Extensions & Templates for Elementor
- CVE-2024-12038Frontend Content Forms for User Submissions (UGC) <= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcodethemekraft Post Form – Registration Form – Profile Form for…
- CVE-2024-12467Pago por Redsys <= 1.0.12 - Reflected Cross-Site Scriptinggrafreak Pago por Redsys
- CVE-2024-13798Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.5 - Unauthenticated Paid Order Creationpickplugins Post Grid
- CVE-2024-13873WP Job Portal <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnectionwpjobportal WP Job Portal – AI-Powered Recruitment System f…
- CVE-2024-22341IBM Watson Query on Cloud Pak for Data information disclosureIBM Watson Query on Cloud Pak for Data