# CVEs published 2025-02-22

34 CVEs were published on February 22, 2025: 2 critical, 18 high. Days are UTC.

- [CVE-2022-28339](https://cve.now/CVE-2022-28339.md): Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulnerability that could al (CVSS 7.3, Trend Micro HouseCall for Home Networks)
- [CVE-2025-26776](https://cve.now/CVE-2025-26776.md): WordPress Chaty Pro Plugin \<= 3.3.3 - Arbitrary File Upload vulnerability (CVSS 10.0, NotFound Chaty Pro)
- [CVE-2025-26774](https://cve.now/CVE-2025-26774.md): WordPress Responsive Modal Builder for High Conversion – Easy Popups plugin \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rock Solid Responsive Modal Builder for High Conversion – E…)
- [CVE-2025-26764](https://cve.now/CVE-2025-26764.md): WordPress Distance Based Shipping Calculator plugin \<= 2.0.22 - Settings Change vulnerability (CVSS 6.5, enituretechnology Distance Based Shipping Calculator)
- [CVE-2025-26763](https://cve.now/CVE-2025-26763.md): WordPress Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider Plugin \<= 3.94.0 - PHP Object Injection vulnerability (CVSS 9.8, Responsive Slider by MetaSlider)
- [CVE-2025-26760](https://cve.now/CVE-2025-26760.md): WordPress Calculator Builder plugin \<= 1.6.2 - Local File Inclusion vulnerability (CVSS 7.5, Wow-Company Calculator Builder)
- [CVE-2025-26757](https://cve.now/CVE-2025-26757.md): WordPress FULL – Cliente plugin \<= 3.1.26 - Local File Inclusion vulnerability (CVSS 7.5, FULL SERVICES FULL Customer)
- [CVE-2025-27012](https://cve.now/CVE-2025-27012.md): WordPress A1POST.BG Shipping for Woo plugin \<= 1.5 - CSRF to Privilege Escalation vulnerability (CVSS 8.8, A1POST.BG Shipping for Woo)
- [CVE-2025-26973](https://cve.now/CVE-2025-26973.md): WordPress Social Warfare Plugin \<= 4.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WarfarePlugins Social Warfare)
- [CVE-2025-26756](https://cve.now/CVE-2025-26756.md): WordPress Magic the Gathering Card Tooltips plugin \<= 3.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, grimdonkey Magic the Gathering Card Tooltips)
- [CVE-2025-26750](https://cve.now/CVE-2025-26750.md): WordPress Vitepos Plugin \<= 3.1.3 - Broken Access Control vulnerability (CVSS 6.5, appsbd Vitepos)
- [CVE-2024-12577](https://cve.now/CVE-2024-12577.md): GPU DDK - rgxfw\_pcset\_ungrab OOB write via psFWMemContext-\>uiPageCatBaseRegSet (CVSS 7.3, Imagination Technologies Graphics DDK)
- [CVE-2024-52939](https://cve.now/CVE-2024-52939.md): GPU DDK - RGXFWIF\_HWPERF\_CTL\_BLK.uiNumCounters OOB write (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2024-47896](https://cve.now/CVE-2024-47896.md): GPU DDK - rgxfw\_hwr\_log\_info OOB write via psHWRInfoBuf-\>ui32WriteIndex (CVSS 3.3, Imagination Technologies Graphics DDK)
- [CVE-2024-46975](https://cve.now/CVE-2024-46975.md): GPU DDK - rgxfw\_write\_robustness\_buffer allows arbitrary catreg set mapping (CVSS 7.9, Imagination Technologies Graphics DDK)
- [CVE-2025-0957](https://cve.now/CVE-2025-0957.md): Vulnerability: SMTP for Amazon SES \<= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs (CVSS 7.2, yaycommerce SMTP for Amazon SES – YaySMTP)
- [CVE-2025-1557](https://cve.now/CVE-2025-1557.md): OFCMS cross-site request forgery (CVSS 5.3, OFCMS)
- [CVE-2025-0953](https://cve.now/CVE-2025-0953.md): SMTP for Sendinblue – YaySMTP \<= 1.2 - Unauthenticated Stored Cross-Site Scripting via Email Logs (CVSS 7.2, yaycommerce SMTP for Sendinblue – YaySMTP)
- [CVE-2025-0918](https://cve.now/CVE-2025-0918.md): SMTP for SendGrid – YaySMTP \<= 1.4 - Unauthenticated Stored Cross-Site Scripting via Email Logs (CVSS 7.2, yaycommerce SMTP for SendGrid – YaySMTP)
- [CVE-2024-13869](https://cve.now/CVE-2024-13869.md): Migration, Backup, Staging – WPvivid \<= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid\_upload\_file (CVSS 7.2, wpvividplugins WPvivid — Backup, Migration & Staging)
- [CVE-2025-1556](https://cve.now/CVE-2025-1556.md): westboy CicadasCMS Template Management system deserialization (CVSS 5.1, westboy CicadasCMS)
- [CVE-2025-21704](https://cve.now/CVE-2025-21704.md): usb: cdc-acm: Check control transfer buffer size before access (no CVSS, Linux)
- [CVE-2025-1553](https://cve.now/CVE-2025-1553.md): pankajindevops scale project cross site scripting (CVSS 5.1, pankajindevops scale)
- [CVE-2025-1361](https://cve.now/CVE-2025-1361.md): IP2Location Country Blocker \<= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin\_init Function (CVSS 7.5, IP2Location Country Blocker)
- [CVE-2024-13564](https://cve.now/CVE-2024-13564.md): Rife Elementor Extensions & Templates \<= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Shortcode (CVSS 6.4, apollo13themes Rife Extensions & Templates for Elementor)
- [CVE-2024-12038](https://cve.now/CVE-2024-12038.md): Frontend Content Forms for User Submissions (UGC) \<= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms\_nav' Shortcode (CVSS 6.4, themekraft Post Form – Registration Form – Profile Form for…)
- [CVE-2024-12467](https://cve.now/CVE-2024-12467.md): Pago por Redsys \<= 1.0.12 - Reflected Cross-Site Scripting (CVSS 6.1, grafreak Pago por Redsys)
- [CVE-2024-13798](https://cve.now/CVE-2024-13798.md): Post Grid and Gutenberg Blocks – ComboBlocks \<= 2.3.5 - Unauthenticated Paid Order Creation (CVSS 5.3, pickplugins Post Grid)
- [CVE-2024-13474](https://cve.now/CVE-2024-13474.md): LTL Freight Quotes – Purolator Edition \<= 2.2.3 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology LTL Freight Quotes – Purolator Edition)
- [CVE-2024-13899](https://cve.now/CVE-2024-13899.md): Mambo Importer \<= 1.0 - Authenticated (Administrator+) PHP Object Injection (CVSS 7.2, misterpah Mambo Importer)
- [CVE-2025-1510](https://cve.now/CVE-2025-1510.md): Custom Post Type Date Archives \<= 2.7.1 - Missing Authorization to Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, keesiemeijer Custom Post Type Date Archives)
- [CVE-2025-1509](https://cve.now/CVE-2025-1509.md): Show Me The Cookies \<= 1.0 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, versluis Show Me The Cookies)
- [CVE-2024-13873](https://cve.now/CVE-2024-13873.md): WP Job Portal \<= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection (CVSS 4.3, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2024-22341](https://cve.now/CVE-2024-22341.md): IBM Watson Query on Cloud Pak for Data information disclosure (CVSS 5.3, IBM Watson Query on Cloud Pak for Data)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.