# CVEs published 2025-03-08

39 CVEs were published on March 8, 2025: 1 critical, 8 high. Days are UTC.

- [CVE-2025-2112](https://cve.now/CVE-2025-2112.md): user-xiangpeng yaoqishan MediaInfoService.java getMediaLisByFilter sql injection (CVSS 5.3, user-xiangpeng yaoqishan)
- [CVE-2024-13924](https://cve.now/CVE-2024-13924.md): Starter Templates by FancyWP \<= 2.0.0 - Unauthenticated Blind Server-Side Request Forgery (CVSS 5.3, Starter Templates by FancyWP)
- [CVE-2024-10326](https://cve.now/CVE-2024-10326.md): RomethemeKit For Elementor \<= 1.5.3 - Missing Authorization in save\_options and reset\_widgets (CVSS 4.3, rometheme RTMKit)
- [CVE-2024-13675](https://cve.now/CVE-2024-13675.md): SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) \<= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, amans2k SlingBlocks – Gutenberg Blocks by FunnelKit)
- [CVE-2025-1664](https://cve.now/CVE-2025-1664.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2024-11640](https://cve.now/CVE-2024-11640.md): VikRentCar Car Rental Management System \<= 1.4.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, e4jvikwp VikRentCar Car Rental Management System)
- [CVE-2024-13649](https://cve.now/CVE-2024-13649.md): 140+ Widgets | Xpro Addons For Elementor – FREE \<= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2025-1783](https://cve.now/CVE-2025-1783.md): Gallery Styles \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, kometschuh Gallery Styles)
- [CVE-2025-1322](https://cve.now/CVE-2025-1322.md): WP-Recall – Registration, Profile, Commerce & More \<= 16.26.10 - Authenticated (Contributor+) Protected Post Disclosure (CVSS 4.3, wppost WP-Recall – Registration, Profile, Commerce & More)
- [CVE-2025-1323](https://cve.now/CVE-2025-1323.md): WP-Recall – Registration, Profile, Commerce & More \<= 16.26.10 - Unauthenticated SQL Injection (CVSS 7.5, wppost WP-Recall – Registration, Profile, Commerce & More)
- [CVE-2025-1325](https://cve.now/CVE-2025-1325.md): WP-Recall – Registration, Profile, Commerce & More \<= 16.26.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Exeuction (CVSS 6.3, wppost WP-Recall – Registration, Profile, Commerce & More)
- [CVE-2024-13359](https://cve.now/CVE-2024-13359.md): Product Input Fields for WooCommerce \<= 1.12.0 - Unauthenticated Limited File Upload (CVSS 8.1, tychesoftwares Product Input Fields for WooCommerce)
- [CVE-2025-1324](https://cve.now/CVE-2025-1324.md): WP-Recall – Registration, Profile, Commerce & More \<= 16.26.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wppost WP-Recall – Registration, Profile, Commerce & More)
- [CVE-2025-1287](https://cve.now/CVE-2025-1287.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2025-0177](https://cve.now/CVE-2025-0177.md): Javo Core \<= 3.0.0.080 - Unauthenticated Privilege Escalation in ajax\_signup (CVSS 9.8, javothemes Javo Core)
- [CVE-2024-13882](https://cve.now/CVE-2024-13882.md): Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit \<= 2.3.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, CodeRevolution Aiomatic - Automatic AI Content Writer & Edi…)
- [CVE-2024-13816](https://cve.now/CVE-2024-13816.md): Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit \<= 2.3.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions (CVSS 5.4, CodeRevolution Aiomatic - Automatic AI Content Writer & Edi…)
- [CVE-2024-10321](https://cve.now/CVE-2024-10321.md): All-in-One Addons for Elementor – WidgetKit \<= 2.5.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates (CVSS 4.3, shamsbd71 All-in-One Addons for Elementor – WidgetKit)
- [CVE-2024-11087](https://cve.now/CVE-2024-11087.md): miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon \<= 200.3.9 - Authentication Bypass (CVSS 8.1, cyberlord92 miniOrange Social Login and Register)
- [CVE-2024-13908](https://cve.now/CVE-2024-13908.md): SMTP by BestWebSoft \<= 1.1.9 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2, bestweblayout SMTP by BestWebSoft)
- [CVE-2024-13826](https://cve.now/CVE-2024-13826.md): Email Keep \<= 1.1 - Email Deletion via CSRF (CVSS 5.4, Email Keep)
- [CVE-2024-13825](https://cve.now/CVE-2024-13825.md): Email Keep \<= 1.1 - Reflected XSS (CVSS 6.1, Email Keep)
- [CVE-2024-12114](https://cve.now/CVE-2024-12114.md): FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel \<= 2.4.29 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updates (CVSS 4.3, fooplugins Gallery by FooGallery)
- [CVE-2024-12119](https://cve.now/CVE-2024-12119.md): FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel \<= 2.4.29 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title Size (CVSS 6.4, fooplugins Gallery by FooGallery)
- [CVE-2024-13844](https://cve.now/CVE-2024-13844.md): Post SMTP \<= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter (CVSS 4.9, saadiqbal Post SMTP – Complete Email Deliverability and SMT…)
- [CVE-2024-13640](https://cve.now/CVE-2024-13640.md): Print Invoice & Delivery Notes for WooCommerce \<= 5.4.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 5.9, tychesoftwares Print Invoice & Delivery Notes for WooCommer…)
- [CVE-2024-13774](https://cve.now/CVE-2024-13774.md): Wishlist for WooCommerce: Multi Wishlists Per Customer \<= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name (CVSS 6.1, wpcodefactory Wishlist for WooCommerce: Multi Wishlists Per…)
- [CVE-2024-13895](https://cve.now/CVE-2024-13895.md): Code Snippets CPT \<= 2.1.0 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 4.3, jtsternberg Code Snippets CPT)
- [CVE-2024-13835](https://cve.now/CVE-2024-13835.md): Post Meta Data Manager \<= 1.4.4 - Authentciated (Admin+) Multisite Privilege Escalation (CVSS 7.2, gandhihitesh9 Post Meta Data Manager)
- [CVE-2025-1504](https://cve.now/CVE-2025-1504.md): Post Lockdown \<= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Post Disclosure (CVSS 4.3, andyexeter Post Lockdown)
- [CVE-2024-13890](https://cve.now/CVE-2024-13890.md): Allow PHP Execute \<= 1.0 - Authenticated (Editor+) PHP Code Injection (CVSS 7.2, sksdev Allow PHP Execute)
- [CVE-2024-12460](https://cve.now/CVE-2024-12460.md): Years Since – Timeless \<= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, laurencebahiirwa Years Since – Timeless Texts)
- [CVE-2025-1481](https://cve.now/CVE-2025-1481.md): Shortcode Cleaner Lite \<= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Export (CVSS 6.5, mandooox Shortcode Cleaner Lite)
- [CVE-2025-1261](https://cve.now/CVE-2025-1261.md): HT Mega – Absolute Addons For Elementor \<= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2023-52968](https://cve.now/CVE-2023-52968.md): MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11. (CVSS 4.9, MariaDB)
- [CVE-2023-52969](https://cve.now/CVE-2023-52969.md): MariaDB Server 10.4 through 10.5.\*, 10.6 through 10.6.\*, 10.7 through 10.11.\*, and 11.0 through 11.0.\* can sometimes crash with an empty bac (CVSS 4.9, MariaDB)
- [CVE-2023-52970](https://cve.now/CVE-2023-52970.md): MariaDB Server 10.4 through 10.5.\*, 10.6 through 10.6.\*, 10.7 through 10.11.\*, 11.0 through 11.0.\*, and 11.1 through 11.4.\* crashes in Item\_ (CVSS 4.9, MariaDB)
- [CVE-2023-52971](https://cve.now/CVE-2023-52971.md): MariaDB Server 10.10 through 10.11.\* and 11.0 through 11.4.\* crashes in JOIN::fix\_all\_splittings\_in\_plan. (CVSS 4.9, MariaDB)
- [CVE-2025-27840](https://cve.now/CVE-2025-27840.md): Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory). (CVSS 6.8, Espressif ESP32)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.