CVEs published March 15, 2025
44 CVEs were published on March 15, 2025: 2 critical, 20 high. 1 is now in CISA KEV.
- Published
- 44
- Critical
- 2
- High
- 20
- Medium
- 21
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 2
Most affected products
- 274056675 springboot-openai-chatgpt
- 4
- jdsofttech School Management System – WPSchoolPress
- 4
- Aldo Latino PrivateContent
- 2
- ShineTheme Travel Booking WordPress Theme
- 2
- stylemix Directory Listings WordPress plugin – uListing
- 2
- WordPress form builder plugin for contact forms, surveys an…
- 2
- boopathi0001 WP Test Email
- 1
- codexpert WC Affiliate – WooCommerce Affiliate Plugin
- 1
- colabrio Ohio Extra
- 1
- cookforweb All In Menu
- 1
Critical 2
- CVE-2025-26875WordPress Multiple Shipping And Billing Address For Woocommerce Plugin <= 1.3 - SQL Injection vulnerabilitysilverplugins217 Multiple Shipping And Billing Address For…
- CVE-2025-1771Traveler <= 3.1.8 - Unauthenticated Local File Inclusion via hotel_alone_load_more_postShineTheme Travel Booking WordPress Theme
High 20
- CVE-2025-27281WordPress All In Menu Plugin <= 1.1.5 - SQL Injection vulnerabilitycookforweb All In Menu
- CVE-2025-26978WordPress FS Poster plugin <= 6.5.8 - SQL Injection vulnerabilityfs-code FS Poster
- CVE-2025-26976WordPress PrivateContent plugin <= 8.11.4 - SQL Injection vulnerabilityAldo Latino PrivateContent
- CVE-2025-26972WordPress PrivateContent plugin <= 8.11.5 - Reflected Cross Site Scripting (XSS) vulnerabilityNotFound PrivateContent
- CVE-2025-26969WordPress PrivateContent plugin <= 8.11.5 - Subscriber+ Site Wide Broken Access Control vulnerabilityAldo Latino PrivateContent
- CVE-2025-26961WordPress Fresh Framework plugin <= 1.70.0 - Unauthenticated Broken Access Control vulnerabilityFRESHFACE Fresh Framework
- CVE-2025-26921WordPress Booking and Rental Manager Plugin <= 2.2.6 - PHP Object Injection vulnerabilitymagepeopleteam Booking and Rental Manager
- CVE-2025-26886WordPress PublishPress Authors plugin <= 4.7.3 - SQL Injection vulnerabilityPublishPress Authors
- CVE-2025-26556WordPress WP AntiDDOS Plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityzzmaster WP AntiDDOS
- CVE-2025-26555WordPress Debug-Bar-Extender Plugin <= 0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityThorsten Ott Debug-Bar-Extender
- CVE-2025-26554WordPress WP Discord Post Plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityNicola Mustone WP Discord Post
- CVE-2025-26553WordPress Pre Order Addon for WooCommerce plugin<= 1.0.7 - Reflected Cross-Site ScriptingSpring Devs Pre Order Addon for WooCommerce – Advance Order…
- CVE-2025-26548WordPress Random Image Selector plugin <= 1.5.6 - Reflected Cross-Site Scripting vulnerabilitykdmurray Random Image Selector
- CVE-2025-23744WordPress Random Posts, Mp3 Player + ShareButton plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilitydvs11 Random Posts, Mp3 Player + ShareButton
- CVE-2025-2325WP Test Email <= 1.1.8 - Unauthenticated Stored Cross-Site Scriptingboopathi0001 WP Test Email
- CVE-2024-13497WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto <= 8.0.9 - Unauthenticated Stored Cross-Site ScriptingWordPress form builder plugin for contact forms, surveys an…
- CVE-2025-1667School Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Privilege Escalation via Account Takeoverjdsofttech School Management System – WPSchoolPress
- CVE-2025-1653Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalationstylemix Directory Listings WordPress plugin – uListing
- CVE-2025-1657Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injectionstylemix Directory Listings WordPress plugin – uListing
- CVE-2025-30066tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs.tj-actions changed-files
Medium, low and unrated 22
- CVE-2025-2334274056675 springboot-openai-chatgpt Chat History chat deleteChat access control274056675 springboot-openai-chatgpt
- CVE-2025-26940WordPress Pie Register Premium plugin <= 3.8.3.2 - Path Traversal to Non-Arbitrary File Deletion vulnerabilityNotFound Pie Register Premium
- CVE-2025-26924WordPress Ohio Theme Extra plugin <= 3.4.7 - Shortcode Injection vulnerabilitycolabrio Ohio Extra
- CVE-2025-26899WordPress Recapture for WooCommerce Plugin <= 1.0.43 - CSRF to Settings Change vulnerabilityRecapture Cart Recovery and Email Marketing Recapture for W…
- CVE-2025-26895WordPress m1.DownloadList plugin <= 0.19 - Cross Site Scripting (XSS) vulnerabilitymaennchen1.de m1.DownloadList
- CVE-2025-25225Extension - hikashop.com - Privilege escalation vulnerability Hikashop component version 1.0.0 - 5.1.3 for Joomlahikashop.com Hikashop component for Joomla
- CVE-2025-2323274056675 springboot-openai-chatgpt Number of Question questionCou updateQuestionCou behavioral workflow274056675 springboot-openai-chatgpt
- CVE-2025-2322274056675 springboot-openai-chatgpt OpenController.java hard-coded credentials274056675 springboot-openai-chatgpt
- CVE-2025-2321274056675 springboot-openai-chatgpt addData logic error274056675 springboot-openai-chatgpt
- CVE-2025-1530Tripetto <= 8.0.9 - Cross-Site Request Forgery to Arbitrary Results DeletionWordPress form builder plugin for contact forms, surveys an…
- CVE-2025-2025Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Functionstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2025-1057Keylime: keylime registrar dos due to incompatible database entry handlingkeylime · Red Hat Enterprise Linux
- CVE-2019-25222Thumbnail carousel slider <= 1.0.4 - Authenticated (Admin+) SQL Injectionnik00726 Thumbnail carousel slider
- CVE-2025-2157Foreman: disclosure of executed commands and outputs in foreman / red hat satelliteRed Hat Satellite Server · Red Hat Satellite
- CVE-2025-1773Traveler <= 3.1.8 - Reflected Cross-Site ScriptingShineTheme Travel Booking WordPress Theme
- CVE-2025-1668School Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Arbitrary User Deletionjdsofttech School Management System – WPSchoolPress
- CVE-2025-1670School Management System – WPSchoolPress <= 2.2.16 - Authenticated (Parent+) SQL Injectionjdsofttech School Management System – WPSchoolPress
- CVE-2024-12336WC Affiliate – A Complete WooCommerce Affiliate Plugin <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wf-export-allcodexpert WC Affiliate – WooCommerce Affiliate Plugin
- CVE-2025-1669School Management System – WPSchoolPress <= 2.2.17 - Authenticated (Teacher+) SQL Injectionjdsofttech School Management System – WPSchoolPress
- CVE-2025-2267WP01 – Speed, Security, SEO consultant <= 2.6.2 - Authenticated (Subscriber+) Arbitrary File Downloadwp01ru WP01 – Speed, Security, SEO consultant
- CVE-2025-2164pixelstats <= 0.8.2 - Reflected Cross-Site Scriptingpixelstats
- CVE-2025-2163Zoorum Comments <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site ScriptingZoorum Comments