# CVEs published 2025-03-15

44 CVEs were published on March 15, 2025: 2 critical, 20 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-2334](https://cve.now/CVE-2025-2334.md): 274056675 springboot-openai-chatgpt Chat History chat deleteChat access control (CVSS 5.3, 274056675 springboot-openai-chatgpt)
- [CVE-2025-27281](https://cve.now/CVE-2025-27281.md): WordPress All In Menu Plugin \<= 1.1.5 - SQL Injection vulnerability (CVSS 8.5, cookforweb All In Menu)
- [CVE-2025-26978](https://cve.now/CVE-2025-26978.md): WordPress FS Poster plugin \<= 6.5.8 - SQL Injection vulnerability (CVSS 8.5, fs-code FS Poster)
- [CVE-2025-26976](https://cve.now/CVE-2025-26976.md): WordPress PrivateContent plugin \<= 8.11.4 - SQL Injection vulnerability (CVSS 8.5, Aldo Latino PrivateContent)
- [CVE-2025-26972](https://cve.now/CVE-2025-26972.md): WordPress PrivateContent plugin \<= 8.11.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NotFound PrivateContent)
- [CVE-2025-26969](https://cve.now/CVE-2025-26969.md): WordPress PrivateContent plugin \<= 8.11.5 - Subscriber+ Site Wide Broken Access Control vulnerability (CVSS 8.3, Aldo Latino PrivateContent)
- [CVE-2025-26961](https://cve.now/CVE-2025-26961.md): WordPress Fresh Framework plugin \<= 1.70.0 - Unauthenticated Broken Access Control vulnerability (CVSS 8.6, FRESHFACE Fresh Framework)
- [CVE-2025-26940](https://cve.now/CVE-2025-26940.md): WordPress Pie Register Premium plugin \<= 3.8.3.2 - Path Traversal to Non-Arbitrary File Deletion vulnerability (CVSS 6.3, NotFound Pie Register Premium)
- [CVE-2025-26924](https://cve.now/CVE-2025-26924.md): WordPress Ohio Theme Extra plugin \<= 3.4.7 - Shortcode Injection vulnerability (CVSS 6.5, colabrio Ohio Extra)
- [CVE-2025-26921](https://cve.now/CVE-2025-26921.md): WordPress Booking and Rental Manager Plugin \<= 2.2.6 - PHP Object Injection vulnerability (CVSS 8.8, magepeopleteam Booking and Rental Manager)
- [CVE-2025-26899](https://cve.now/CVE-2025-26899.md): WordPress Recapture for WooCommerce Plugin \<= 1.0.43 - CSRF to Settings Change vulnerability (CVSS 6.5, Recapture Cart Recovery and Email Marketing Recapture for W…)
- [CVE-2025-26895](https://cve.now/CVE-2025-26895.md): WordPress m1.DownloadList plugin \<= 0.19 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, maennchen1.de m1.DownloadList)
- [CVE-2025-26886](https://cve.now/CVE-2025-26886.md): WordPress PublishPress Authors plugin \<= 4.7.3 - SQL Injection vulnerability (CVSS 7.6, PublishPress Authors)
- [CVE-2025-26875](https://cve.now/CVE-2025-26875.md): WordPress Multiple Shipping And Billing Address For Woocommerce Plugin \<= 1.3 - SQL Injection vulnerability (CVSS 9.3, silverplugins217 Multiple Shipping And Billing Address For…)
- [CVE-2025-26556](https://cve.now/CVE-2025-26556.md): WordPress WP AntiDDOS Plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, zzmaster WP AntiDDOS)
- [CVE-2025-26555](https://cve.now/CVE-2025-26555.md): WordPress Debug-Bar-Extender Plugin \<= 0.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Thorsten Ott Debug-Bar-Extender)
- [CVE-2025-26554](https://cve.now/CVE-2025-26554.md): WordPress WP Discord Post Plugin \<= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Nicola Mustone WP Discord Post)
- [CVE-2025-26553](https://cve.now/CVE-2025-26553.md): WordPress Pre Order Addon for WooCommerce plugin\<= 1.0.7 - Reflected Cross-Site Scripting (CVSS 7.1, Spring Devs Pre Order Addon for WooCommerce – Advance Order…)
- [CVE-2025-26548](https://cve.now/CVE-2025-26548.md): WordPress Random Image Selector plugin \<= 1.5.6 - Reflected Cross-Site Scripting vulnerability (CVSS 7.1, kdmurray Random Image Selector)
- [CVE-2025-23744](https://cve.now/CVE-2025-23744.md): WordPress Random Posts, Mp3 Player + ShareButton plugin \<= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, dvs11 Random Posts, Mp3 Player + ShareButton)
- [CVE-2025-25225](https://cve.now/CVE-2025-25225.md): Extension - hikashop.com - Privilege escalation vulnerability Hikashop component version 1.0.0 - 5.1.3 for Joomla (CVSS 6.5, hikashop.com Hikashop component for Joomla)
- [CVE-2025-2323](https://cve.now/CVE-2025-2323.md): 274056675 springboot-openai-chatgpt Number of Question questionCou updateQuestionCou behavioral workflow (CVSS 5.3, 274056675 springboot-openai-chatgpt)
- [CVE-2025-2322](https://cve.now/CVE-2025-2322.md): 274056675 springboot-openai-chatgpt OpenController.java hard-coded credentials (CVSS 6.9, 274056675 springboot-openai-chatgpt)
- [CVE-2025-2321](https://cve.now/CVE-2025-2321.md): 274056675 springboot-openai-chatgpt addData logic error (CVSS 5.3, 274056675 springboot-openai-chatgpt)
- [CVE-2025-1530](https://cve.now/CVE-2025-1530.md): Tripetto \<= 8.0.9 - Cross-Site Request Forgery to Arbitrary Results Deletion (CVSS 4.3, WordPress form builder plugin for contact forms, surveys an…)
- [CVE-2025-2025](https://cve.now/CVE-2025-2025.md): Give \<= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give\_reports\_earnings Function (CVSS 6.5, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2025-1057](https://cve.now/CVE-2025-1057.md): Keylime: keylime registrar dos due to incompatible database entry handling (CVSS 4.3, keylime · Red Hat Enterprise Linux)
- [CVE-2019-25222](https://cve.now/CVE-2019-25222.md): Thumbnail carousel slider \<= 1.0.4 - Authenticated (Admin+) SQL Injection (CVSS 4.9, nik00726 Thumbnail carousel slider)
- [CVE-2025-2325](https://cve.now/CVE-2025-2325.md): WP Test Email \<= 1.1.8 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, boopathi0001 WP Test Email)
- [CVE-2025-2157](https://cve.now/CVE-2025-2157.md): Foreman: disclosure of executed commands and outputs in foreman / red hat satellite (CVSS 3.3, Red Hat Satellite Server · Red Hat Satellite)
- [CVE-2024-13497](https://cve.now/CVE-2024-13497.md): WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto \<= 8.0.9 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, WordPress form builder plugin for contact forms, surveys an…)
- [CVE-2025-1771](https://cve.now/CVE-2025-1771.md): Traveler \<= 3.1.8 - Unauthenticated Local File Inclusion via hotel\_alone\_load\_more\_post (CVSS 9.8, ShineTheme Travel Booking WordPress Theme)
- [CVE-2025-1773](https://cve.now/CVE-2025-1773.md): Traveler \<= 3.1.8 - Reflected Cross-Site Scripting (CVSS 6.1, ShineTheme Travel Booking WordPress Theme)
- [CVE-2025-1668](https://cve.now/CVE-2025-1668.md): School Management System – WPSchoolPress \<= 2.2.16 - Missing Authorization to Arbitrary User Deletion (CVSS 4.3, jdsofttech School Management System – WPSchoolPress)
- [CVE-2025-1670](https://cve.now/CVE-2025-1670.md): School Management System – WPSchoolPress \<= 2.2.16 - Authenticated (Parent+) SQL Injection (CVSS 6.5, jdsofttech School Management System – WPSchoolPress)
- [CVE-2025-1667](https://cve.now/CVE-2025-1667.md): School Management System – WPSchoolPress \<= 2.2.16 - Missing Authorization to Privilege Escalation via Account Takeover (CVSS 8.8, jdsofttech School Management System – WPSchoolPress)
- [CVE-2024-12336](https://cve.now/CVE-2024-12336.md): WC Affiliate – A Complete WooCommerce Affiliate Plugin \<= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wf-export-all (CVSS 6.5, codexpert WC Affiliate – WooCommerce Affiliate Plugin)
- [CVE-2025-1669](https://cve.now/CVE-2025-1669.md): School Management System – WPSchoolPress \<= 2.2.17 - Authenticated (Teacher+) SQL Injection (CVSS 6.5, jdsofttech School Management System – WPSchoolPress)
- [CVE-2025-2267](https://cve.now/CVE-2025-2267.md): WP01 – Speed, Security, SEO consultant \<= 2.6.2 - Authenticated (Subscriber+) Arbitrary File Download (CVSS 6.5, wp01ru WP01 – Speed, Security, SEO consultant)
- [CVE-2025-2164](https://cve.now/CVE-2025-2164.md): pixelstats \<= 0.8.2 - Reflected Cross-Site Scripting (CVSS 6.1, pixelstats)
- [CVE-2025-2163](https://cve.now/CVE-2025-2163.md): Zoorum Comments \<= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, Zoorum Comments)
- [CVE-2025-1653](https://cve.now/CVE-2025-1653.md): Directory Listings WordPress plugin – uListing \<= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, stylemix Directory Listings WordPress plugin – uListing)
- [CVE-2025-1657](https://cve.now/CVE-2025-1657.md): Directory Listings WordPress plugin – uListing \<= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection (CVSS 8.8, stylemix Directory Listings WordPress plugin – uListing)
- [CVE-2025-30066](https://cve.now/CVE-2025-30066.md): tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (CVSS 8.6, KEV, tj-actions changed-files)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.