CVEs published March 8, 2025
39 CVEs were published on March 8, 2025: 1 critical, 8 high.
- Published
- 39
- Critical
- 1
- High
- 8
- Medium
- 30
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- MariaDB
- 4
- wppost WP-Recall – Registration, Profile, Commerce & More
- 4
- CodeRevolution Aiomatic - Automatic AI Content Writer & Edi…
- 2
- Email Keep
- 2
- fooplugins Gallery by FooGallery
- 2
- amans2k SlingBlocks – Gutenberg Blocks by FunnelKit
- 1
- andyexeter Post Lockdown
- 1
- bestweblayout SMTP by BestWebSoft
- 1
- cyberlord92 miniOrange Social Login and Register
- 1
- devitemsllc HT Mega Addons for Elementor – Elementor Widget…
- 1
Critical 1
High 8
- CVE-2024-11640VikRentCar Car Rental Management System <= 1.4.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Uploade4jvikwp VikRentCar Car Rental Management System
- CVE-2025-1323WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injectionwppost WP-Recall – Registration, Profile, Commerce & More
- CVE-2024-13359Product Input Fields for WooCommerce <= 1.12.0 - Unauthenticated Limited File Uploadtychesoftwares Product Input Fields for WooCommerce
- CVE-2024-13882Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary File UploadCodeRevolution Aiomatic - Automatic AI Content Writer & Edi…
- CVE-2024-11087miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon <= 200.3.9 - Authentication Bypasscyberlord92 miniOrange Social Login and Register
- CVE-2024-13908SMTP by BestWebSoft <= 1.1.9 - Authenticated (Administrator+) Arbitrary File Uploadbestweblayout SMTP by BestWebSoft
- CVE-2024-13835Post Meta Data Manager <= 1.4.4 - Authentciated (Admin+) Multisite Privilege Escalationgandhihitesh9 Post Meta Data Manager
- CVE-2024-13890Allow PHP Execute <= 1.0 - Authenticated (Editor+) PHP Code Injectionsksdev Allow PHP Execute
Medium, low and unrated 30
- CVE-2025-2112user-xiangpeng yaoqishan MediaInfoService.java getMediaLisByFilter sql injectionuser-xiangpeng yaoqishan
- CVE-2024-13924Starter Templates by FancyWP <= 2.0.0 - Unauthenticated Blind Server-Side Request ForgeryStarter Templates by FancyWP
- CVE-2024-10326RomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgetsrometheme RTMKit
- CVE-2024-13675SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingamans2k SlingBlocks – Gutenberg Blocks by FunnelKit
- CVE-2025-1664Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2024-13649140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingXpro Addons — 140+ Widgets for Elementor
- CVE-2025-1783Gallery Styles <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingkometschuh Gallery Styles
- CVE-2025-1322WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Protected Post Disclosurewppost WP-Recall – Registration, Profile, Commerce & More
- CVE-2025-1325WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Exeuctionwppost WP-Recall – Registration, Profile, Commerce & More
- CVE-2025-1324WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewppost WP-Recall – Registration, Profile, Commerce & More
- CVE-2025-1287The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetsposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2024-13816Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator ActionsCodeRevolution Aiomatic - Automatic AI Content Writer & Edi…
- CVE-2024-10321All-in-One Addons for Elementor – WidgetKit <= 2.5.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templatesshamsbd71 All-in-One Addons for Elementor – WidgetKit
- CVE-2024-13826Email Keep <= 1.1 - Email Deletion via CSRFEmail Keep
- CVE-2024-13825Email Keep <= 1.1 - Reflected XSSEmail Keep
- CVE-2024-12114FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updatesfooplugins Gallery by FooGallery
- CVE-2024-12119FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title Sizefooplugins Gallery by FooGallery
- CVE-2024-13844Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parametersaadiqbal Post SMTP – Complete Email Deliverability and SMT…
- CVE-2024-13640Print Invoice & Delivery Notes for WooCommerce <= 5.4.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directorytychesoftwares Print Invoice & Delivery Notes for WooCommer…
- CVE-2024-13774Wishlist for WooCommerce: Multi Wishlists Per Customer <= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Namewpcodefactory Wishlist for WooCommerce: Multi Wishlists Per…
- CVE-2024-13895Code Snippets CPT <= 2.1.0 - Authenticated (Subscriber+) Arbitrary Shortcode Executionjtsternberg Code Snippets CPT
- CVE-2025-1504Post Lockdown <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Post Disclosureandyexeter Post Lockdown
- CVE-2024-12460Years Since – Timeless <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scriptinglaurencebahiirwa Years Since – Timeless Texts
- CVE-2025-1481Shortcode Cleaner Lite <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Exportmandooox Shortcode Cleaner Lite
- CVE-2025-1261HT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widgetdevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2023-52968MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.MariaDB
- CVE-2023-52969MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, and 11.0 through 11.0.* can sometimes crash with an empty bacMariaDB
- CVE-2023-52970MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11.4.* crashes in Item_MariaDB
- CVE-2023-52971MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan.MariaDB
- CVE-2025-27840Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).Espressif ESP32