# CVEs published 2025-03-26

168 CVEs were published on March 26, 2025: 18 critical, 86 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-20230](https://cve.now/CVE-2025-20230.md): Missing Access Control and Incorrect Ownership of Data in App Key Value Store (KVStore) collections in the Splunk Secure Gateway App (CVSS 4.3, Splunk Enterprise · Splunk Secure Gateway)
- [CVE-2025-20233](https://cve.now/CVE-2025-20233.md): Incorrect permissions set by the “chmod“ and “makedirs“ Python functions in Splunk App for Lookup File Editing (CVSS 2.5, Splunk App for Lookup File Editing)
- [CVE-2025-20232](https://cve.now/CVE-2025-20232.md): Risky Command Safeguards Bypass in “/app/search/search“ endpoint through “s“ parameter in Splunk Enterprise (CVSS 5.7, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2025-20229](https://cve.now/CVE-2025-20229.md): Remote Code Execution through file upload to “$SPLUNK\_HOME/var/run/splunk/apptemp“ directory in Splunk Enterprise (CVSS 8.0, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2025-20228](https://cve.now/CVE-2025-20228.md): Maintenance mode state change of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise (CVSS 6.5, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2025-20227](https://cve.now/CVE-2025-20227.md): Information Disclosure through external content warning modal dialog box bypass in Splunk Enterprise Dashboard Studio (CVSS 4.3, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2025-20226](https://cve.now/CVE-2025-20226.md): Risky command safeguards bypass in “/services/streams/search“ endpoint through “q“ parameter in Splunk Enterprise (CVSS 5.7, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2025-20231](https://cve.now/CVE-2025-20231.md): Sensitive Information Disclosure in Splunk Secure Gateway App (CVSS 7.1, Splunk Enterprise · Splunk Secure Gateway)
- [CVE-2025-30407](https://cve.now/CVE-2025-30407.md): Local privilege escalation due to a binary hijacking vulnerability. (CVSS 6.3, Acronis Cyber Protect Cloud Agent)
- [CVE-2025-2838](https://cve.now/CVE-2025-2838.md): Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability (CVSS 6.5, Silicon Labs Gecko OS)
- [CVE-2025-2837](https://cve.now/CVE-2025-2837.md): Silicon Labs Gecko OS HTTP Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, Silicon Labs Gecko OS)
- [CVE-2025-2787](https://cve.now/CVE-2025-2787.md): Ingress-nginx vulnerability in KNIME Business Hub (CVSS 8.7, KNIME Business Hub)
- [CVE-2025-2600](https://cve.now/CVE-2025-2600.md): Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the EL (CVSS 6.8, Devolutions Remote Desktop Manager)
- [CVE-2025-30353](https://cve.now/CVE-2025-30353.md): Directus's webhook trigger flows can leak sensitive data (CVSS 8.6, directus)
- [CVE-2025-2562](https://cve.now/CVE-2025-2562.md): Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored (CVSS 5.4, Devolutions Remote Desktop Manager)
- [CVE-2025-2528](https://cve.now/CVE-2025-2528.md): Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use (CVSS 3.6, Devolutions Remote Desktop Manager)
- [CVE-2025-30352](https://cve.now/CVE-2025-30352.md): Directus \`search\` query parameter allows enumeration of non permitted fields (CVSS 5.3, directus)
- [CVE-2025-2499](https://cve.now/CVE-2025-2499.md): Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. (CVSS 5.4, Devolutions Remote Desktop Manager)
- [CVE-2025-30351](https://cve.now/CVE-2025-30351.md): Suspended Directus user can continue to use session token to access API (CVSS 3.5, directus · @directus/api +1)
- [CVE-2025-30350](https://cve.now/CVE-2025-30350.md): Directus's S3 assets become unavailable after a burst of HEAD requests (CVSS 5.3, directus · @directus/storage-driver-s3)
- [CVE-2025-30225](https://cve.now/CVE-2025-30225.md): Directus's S3 assets become unavailable after a burst of malformed transformations (CVSS 5.3, directus · @directus/storage-driver-s3)
- [CVE-2025-30217](https://cve.now/CVE-2025-30217.md): Frappe has possibility of SQL injection due to improper validations (CVSS 6.6, frappe)
- [CVE-2025-30164](https://cve.now/CVE-2025-30164.md): Icinga Web 2 has open redirect on login page (CVSS 4.1, icingaweb2)
- [CVE-2025-27609](https://cve.now/CVE-2025-27609.md): Icinga Web 2 Vulnerable to Reflected XSS (CVSS 1.1, icingaweb2)
- [CVE-2025-2783](https://cve.now/CVE-2025-2783.md): Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker (CVSS 8.3, KEV, Google Chrome)
- [CVE-2025-27406](https://cve.now/CVE-2025-27406.md): Icinga Reporting Stored XSS leads to SSRF (CVSS 7.7, icingaweb2-module-reporting)
- [CVE-2025-2098](https://cve.now/CVE-2025-2098.md): Dylib Hijacking in Fast CAD Reader (CVSS 8.4, Beijing Honghu Yuntu Technology Fast CAD Reader)
- [CVE-2025-27405](https://cve.now/CVE-2025-27405.md): Icinga Web 2 has XSS in embedded content (CVSS 7.7, icingaweb2)
- [CVE-2025-26739](https://cve.now/CVE-2025-26739.md): WordPress newseqo theme \<= 2.1.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, themefunction newseqo)
- [CVE-2025-2820](https://cve.now/CVE-2025-2820.md): Denial of Service (CVSS 6.5, Bizerba SE & Co. KG Product family GLx and CWx)
- [CVE-2025-26747](https://cve.now/CVE-2025-26747.md): WordPress RainbowNews theme \<= 1.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, 99colorthemes RainbowNews)
- [CVE-2025-2819](https://cve.now/CVE-2025-2819.md): Unrestricted Fileupload (CVSS 6.6, Bizerba SE & Co. KG GT-SoftControl)
- [CVE-2025-26869](https://cve.now/CVE-2025-26869.md): WordPress Build theme \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Build)
- [CVE-2025-26922](https://cve.now/CVE-2025-26922.md): WordPress AuraMart theme \<= 2.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, techthemes AuraMart)
- [CVE-2025-26923](https://cve.now/CVE-2025-26923.md): WordPress Event post plugin \<= 5.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Bastien Ho Event post)
- [CVE-2025-26929](https://cve.now/CVE-2025-26929.md): WordPress Accounting for WooCommerce plugin \<= 1.6.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Bastien Ho Accounting for WooCommerce)
- [CVE-2025-26941](https://cve.now/CVE-2025-26941.md): WordPress Church Admin plugin \<= 5.0.18 - SQL Injection vulnerability (CVSS 9.3, andy\_moyle Church Admin)
- [CVE-2025-26986](https://cve.now/CVE-2025-26986.md): WordPress Pearl Theme \< 3.4.8 - Local File Inclusion vulnerability (CVSS 8.1, StylemixThemes Pearl - Corporate Business)
- [CVE-2025-27014](https://cve.now/CVE-2025-27014.md): WordPress Hostiko Theme \< 30.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, designingmedia Hostiko)
- [CVE-2025-27015](https://cve.now/CVE-2025-27015.md): WordPress Hostiko Theme \< 30.1 - Local File Inclusion vulnerability (CVSS 7.5, designingmedia Hostiko)
- [CVE-2025-30524](https://cve.now/CVE-2025-30524.md): WordPress Product Catalog plugin \<= 1.0.4 - SQL Injection vulnerability (CVSS 9.3, origincode Product Catalog)
- [CVE-2025-28942](https://cve.now/CVE-2025-28942.md): WordPress Trust Payments Gateway for WooCommerce plugin \<= 1.1.4 - SQL Injection vulnerability (CVSS 9.3, Trust Payments Gateway for WooCommerce)
- [CVE-2025-28939](https://cve.now/CVE-2025-28939.md): WordPress WP Google Calendar Manager plugin \<= 2.1 - SQL Injection vulnerability (CVSS 8.5, EuroCizia WP Google Calendar Manager)
- [CVE-2025-28935](https://cve.now/CVE-2025-28935.md): WordPress Fancybox Plus plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, puzich Fancybox Plus)
- [CVE-2025-28934](https://cve.now/CVE-2025-28934.md): WordPress Simple Post Series plugin \<= 2.4.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, chaozh Simple Post Series)
- [CVE-2025-28928](https://cve.now/CVE-2025-28928.md): WordPress Are you robot google recaptcha for Wordpress plugin \<= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sureshdsk Are you robot google recaptcha for wordpress)
- [CVE-2025-28924](https://cve.now/CVE-2025-28924.md): WordPress ZenphotoPress plugin \<= 1.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Simbul ZenphotoPress)
- [CVE-2025-28921](https://cve.now/CVE-2025-28921.md): WordPress SpatialMatch IDX plugin \<= 3.0.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, homejunction SpatialMatch IDX)
- [CVE-2025-28917](https://cve.now/CVE-2025-28917.md): WordPress Custom Smilies plugin \<= 2.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, crazyloong Custom Smilies)
- [CVE-2025-28916](https://cve.now/CVE-2025-28916.md): WordPress Docpro plugin \<= 2.0.1 - Local File Inclusion vulnerability (CVSS 9.8, Rashid Docpro)
- [CVE-2025-28911](https://cve.now/CVE-2025-28911.md): WordPress Gravity 2 PDF plugin \<= 3.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, gravity2pdf Gravity 2 PDF)
- [CVE-2025-28903](https://cve.now/CVE-2025-28903.md): WordPress Driving Directions plugin \<= 1.4.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, hectorgarrofe Driving Directions)
- [CVE-2025-28899](https://cve.now/CVE-2025-28899.md): WordPress WP Event Ticketing plugin \<= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, toddhuish WP Event Ticketing)
- [CVE-2025-28898](https://cve.now/CVE-2025-28898.md): WordPress WP Multistore Locator plugin \<= 2.5.2 - SQL Injection vulnerability (CVSS 9.3, WPExperts.io WP Multistore Locator)
- [CVE-2025-28893](https://cve.now/CVE-2025-28893.md): WordPress Visual Text Editor plugin \<= 1.2.1 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, Govind Visual Text Editor)
- [CVE-2025-28890](https://cve.now/CVE-2025-28890.md): WordPress Lightview Plus plugin \<= 3.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, puzich Lightview Plus)
- [CVE-2025-28889](https://cve.now/CVE-2025-28889.md): WordPress Custom Product Stickers for Woocommerce plugin \<= 1.9.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, starblank Custom Product Stickers for Woocommerce)
- [CVE-2025-28885](https://cve.now/CVE-2025-28885.md): WordPress Fiverr.com Official Search Box plugin \<= 1.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, fiverraffiliates Fiverr.com Official Search Box)
- [CVE-2025-28882](https://cve.now/CVE-2025-28882.md): WordPress Omnify plugin \<= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Omnify)
- [CVE-2025-28880](https://cve.now/CVE-2025-28880.md): WordPress Blue Captcha plugin \<= 1.7.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jotis Blue Captcha)
- [CVE-2025-28877](https://cve.now/CVE-2025-28877.md): WordPress Key4ce osTicket Bridge plugin \<= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, m.tiggelaar Key4ce osTicket Bridge)
- [CVE-2025-28873](https://cve.now/CVE-2025-28873.md): WordPress Shuffle plugin \<= 0.5 - SQL Injection vulnerability (CVSS 8.5, Scott Taylor Shuffle)
- [CVE-2025-28869](https://cve.now/CVE-2025-28869.md): WordPress NextGEN Gallery Voting plugin \<= 2.7.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, shauno NextGEN Gallery Voting)
- [CVE-2025-28865](https://cve.now/CVE-2025-28865.md): WordPress WP Colorful Tag Cloud plugin \<= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, lionelroux WP Colorful Tag Cloud)
- [CVE-2025-28858](https://cve.now/CVE-2025-28858.md): WordPress Arrow Maps plugin \<= 1.0.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Arrow Plugins Arrow Maps)
- [CVE-2025-28855](https://cve.now/CVE-2025-28855.md): WordPress Teleport plugin \<= 1.2.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, srcoley Teleport)
- [CVE-2025-27267](https://cve.now/CVE-2025-27267.md): WordPress Random Quotes Plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, srcoley Random Quotes)
- [CVE-2025-26584](https://cve.now/CVE-2025-26584.md): WordPress TBTestimonials Plugin \<= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Travis Ballard TBTestimonials)
- [CVE-2025-26583](https://cve.now/CVE-2025-26583.md): WordPress Video Share VOD plugin \<= 2.7.9 - Reflected Cross-Site Scripting vulnerability (CVSS 7.1, videowhisper Video Share VOD)
- [CVE-2025-26581](https://cve.now/CVE-2025-26581.md): WordPress Picture Gallery plugin \<= 1.6.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, videowhisper Picture Gallery)
- [CVE-2025-26579](https://cve.now/CVE-2025-26579.md): WordPress MicroPayments Paid Membership plugin \<= 3.2.4 - Reflected Cross-Site Scripting vulnerability (CVSS 7.1, videowhisper MicroPayments)
- [CVE-2025-26576](https://cve.now/CVE-2025-26576.md): WordPress WP Simple Slideshow Plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, takumin WP Simple Slideshow)
- [CVE-2025-26575](https://cve.now/CVE-2025-26575.md): WordPress Display Post Meta plugin \<= 1.5- Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kyle Maurer Display Post Meta)
- [CVE-2025-26573](https://cve.now/CVE-2025-26573.md): WordPress Rizzi Guestbook plugin \<= 4.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, JamRizzi Technologies Rizzi Guestbook)
- [CVE-2025-26566](https://cve.now/CVE-2025-26566.md): WordPress In Stock Mailer for WooCommerce Plugin \<= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Frank In Stock Mailer for WooCommerce)
- [CVE-2025-26565](https://cve.now/CVE-2025-26565.md): WordPress GNUPress Plugin \<= 0.2.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kagla GNUPress)
- [CVE-2025-26564](https://cve.now/CVE-2025-26564.md): WordPress GNUCommerce Plugin \<= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kagla GNUCommerce)
- [CVE-2025-26560](https://cve.now/CVE-2025-26560.md): WordPress WP Contact Form III Plugin \<= 1.6.2d - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, KKWangen WP Contact Form III)
- [CVE-2025-26559](https://cve.now/CVE-2025-26559.md): WordPress Secure Invites plugin \<= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Chris Taylor Secure Invites)
- [CVE-2025-26546](https://cve.now/CVE-2025-26546.md): WordPress Cookies Pro plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Pixelpro Cookies Pro)
- [CVE-2025-26544](https://cve.now/CVE-2025-26544.md): WordPressUTM tags + Landing page plugin \<= 1.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, Max K UTM tags tracking for Contact Form)
- [CVE-2025-26542](https://cve.now/CVE-2025-26542.md): WordPress Zalo Live Chat Plugin \<= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dang Ngoc Binh Zalo Live Chat)
- [CVE-2025-26541](https://cve.now/CVE-2025-26541.md): WordPress Bitcoin / AltCoin Payment Gateway for WooCommerce plugin \<= 1.7.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce)
- [CVE-2025-26537](https://cve.now/CVE-2025-26537.md): WordPress GDPR Tools plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, rolomak GDPR Tools)
- [CVE-2025-26536](https://cve.now/CVE-2025-26536.md): WordPress Another Events Calendar Plugin \<= 1.7.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Yendif Player Another Events Calendar)
- [CVE-2025-25134](https://cve.now/CVE-2025-25134.md): WordPress Theme Demo Bar Plugin \<= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, zenverse Theme Demo Bar)
- [CVE-2025-24690](https://cve.now/CVE-2025-24690.md): WordPress Formality Plugin \<= 1.5.7 - Local File Inclusion vulnerability (CVSS 8.1, Michele Giorgi Formality)
- [CVE-2025-23964](https://cve.now/CVE-2025-23964.md): WordPress Google Plus Plugin \<= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ajitae Google Plus)
- [CVE-2025-23952](https://cve.now/CVE-2025-23952.md): WordPress Custom Field List Widget Plugin \<= 1.5.1 - Local File Inclusion vulnerability (CVSS 8.1, ntm custom-field-list-widget)
- [CVE-2025-23937](https://cve.now/CVE-2025-23937.md): WordPress LinkedIn Lite Plugin \<= 1.0 - Local File Inclusion vulnerability (CVSS 8.1, Alex Furr LinkedIn Lite)
- [CVE-2025-23735](https://cve.now/CVE-2025-23735.md): WordPress Infugrator plugin \<= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Cosmin Schiopu Infugrator)
- [CVE-2025-23728](https://cve.now/CVE-2025-23728.md): WordPress AuMenu plugin \<= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, atelierhyper AuMenu)
- [CVE-2025-23714](https://cve.now/CVE-2025-23714.md): WordPress AppReview plugin \<= 0.2.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, podspod AppReview)
- [CVE-2025-23704](https://cve.now/CVE-2025-23704.md): WordPress Your Lightbox plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Reuven Karasik Your Lightbox)
- [CVE-2025-23680](https://cve.now/CVE-2025-23680.md): WordPress Narnoo Operator plugin \<= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Narnoo Operator)
- [CVE-2025-23666](https://cve.now/CVE-2025-23666.md): WordPress Management-screen-droptiles plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, cxc-sawa Management-screen-droptiles)
- [CVE-2025-23638](https://cve.now/CVE-2025-23638.md): WordPress Frontend Post Submission plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Umesh Ghimire Frontend Post Submission)
- [CVE-2025-23633](https://cve.now/CVE-2025-23633.md): WordPress WP Database Audit plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, khanhtruong WP Database Audit)
- [CVE-2025-23632](https://cve.now/CVE-2025-23632.md): WordPress CG Button plugin \<= 1.0.5.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rhizome Networks CG Button)
- [CVE-2025-23612](https://cve.now/CVE-2025-23612.md): WordPress Pixobe Cartography plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pixobe Cartography)
- [CVE-2025-23546](https://cve.now/CVE-2025-23546.md): WordPress RDP inGroups+ plugin \<= 1.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Robert D Payne RDP inGroups+)
- [CVE-2025-23543](https://cve.now/CVE-2025-23543.md): WordPress FOMO Pay Chinese Payment Solution plugin \<= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fomopay FOMO Pay Chinese Payment Solution)
- [CVE-2025-23542](https://cve.now/CVE-2025-23542.md): WordPress RDP Linkedin Login plugin \<= 1.7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Robert D Payne RDP Linkedin Login)
- [CVE-2025-23466](https://cve.now/CVE-2025-23466.md): WordPress Site Editor Google Map plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpsiteeditor Site Editor Google Map)
- [CVE-2025-23460](https://cve.now/CVE-2025-23460.md): WordPress RWS Enquiry And Lead Follow-up plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, rhizomaticweb RWS Enquiry And Lead Follow-up)
- [CVE-2025-23459](https://cve.now/CVE-2025-23459.md): WordPress NS Simple Intro Loader plugin \<= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NsThemes NS Simple Intro Loader)
- [CVE-2025-22283](https://cve.now/CVE-2025-22283.md): WordPress GetSocial Plugin \<= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Riyaz GetSocial)
- [CVE-2025-27404](https://cve.now/CVE-2025-27404.md): Icinga Web 2 DOM-based XSS vulnerability (CVSS 7.7, icingaweb2)
- [CVE-2025-24972](https://cve.now/CVE-2025-24972.md): Discourse may bypass user preference when adding users to chat groups (CVSS 4.3, discourse)
- [CVE-2025-24808](https://cve.now/CVE-2025-24808.md): Discourse has race condition when adding users to a group DM (CVSS 4.3, discourse)
- [CVE-2022-39163](https://cve.now/CVE-2022-39163.md): IBM Cognos Controller HTTP response smuggling (CVSS 4.7, IBM Cognos Controller · IBM Controller)
- [CVE-2025-23203](https://cve.now/CVE-2025-23203.md): Icinga has rest API endpoints accessible to restricted users (CVSS 5.5, icingaweb2-module-director)
- [CVE-2024-45351](https://cve.now/CVE-2024-45351.md): Game center application has code execution Vulnerability (CVSS 7.8, Xiaomi Game center application)
- [CVE-2025-2228](https://cve.now/CVE-2025-2228.md): Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates \<= 1.6.8 - Authenticated (Contributor+) Sensitive Information Exposure (CVSS 5.7, cyberchimps Responsive Addons for Elementor – Free Elemento…)
- [CVE-2025-1913](https://cve.now/CVE-2025-1913.md): Product Import Export for WooCommerce \<= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form\_data Parameter (CVSS 7.2, webtoffee Product Import Export for WooCommerce – Import Ex…)
- [CVE-2025-1911](https://cve.now/CVE-2025-1911.md): Product Import Export for WooCommerce \<= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin\_log\_page Function (CVSS 2.7, webtoffee Product Import Export for WooCommerce – Import Ex…)
- [CVE-2025-1912](https://cve.now/CVE-2025-1912.md): Product Import Export for WooCommerce \<= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate\_file Function (CVSS 7.6, webtoffee Product Import Export for WooCommerce – Import Ex…)
- [CVE-2025-1312](https://cve.now/CVE-2025-1312.md): Ultimate Blocks – WordPress Blocks Plugin \<= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ultimateblocks Ultimate Blocks – 25+ Gutenberg Blocks for B…)
- [CVE-2024-13411](https://cve.now/CVE-2024-13411.md): Zapier for WordPress \<= 1.5.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via updated\_user Function (CVSS 6.4, Zapier for WordPress)
- [CVE-2024-13889](https://cve.now/CVE-2024-13889.md): WordPress Importer \<= 0.8.3 - Authenticated (Administrator+) PHP Object Injection (CVSS 7.2, wordpressdotorg WordPress Importer)
- [CVE-2025-1769](https://cve.now/CVE-2025-1769.md): Product Import Export for WooCommerce \<= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download\_file Function (CVSS 4.9, webtoffee Product Import Export for WooCommerce – Import Ex…)
- [CVE-2025-2110](https://cve.now/CVE-2025-2110.md): WP Compress \<= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions (CVSS 8.8, aresit WP Compress – Instant Performance & Speed Optimizati…)
- [CVE-2025-27552](https://cve.now/CVE-2025-27552.md): DBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Crypt/Eksblowfish/Bcrypt.pm (CVSS 4.0, WREIS DBIx::Class::EncodedColumn)
- [CVE-2025-27551](https://cve.now/CVE-2025-27551.md): DBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Digest.pm (CVSS 4.0, WREIS DBIx::Class::EncodedColumn)
- [CVE-2025-1542](https://cve.now/CVE-2025-1542.md): Improper permission control in OXARI ServiceDesk (CVSS 9.3, Infonet Projekt SA OXARI ServiceDesk)
- [CVE-2025-2596](https://cve.now/CVE-2025-2596.md): Session logout can be overwritten by long lasting request (CVSS 2.3, Checkmk)
- [CVE-2025-1440](https://cve.now/CVE-2025-1440.md): Advanced iFrame \<= 2024.5 - Unauthenticated Settings Update (CVSS 5.3, mdempfle Advanced iFrame)
- [CVE-2025-1703](https://cve.now/CVE-2025-1703.md): Ultimate Blocks \<= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter (CVSS 6.4, ultimateblocks Ultimate Blocks – 25+ Gutenberg Blocks for B…)
- [CVE-2025-1437](https://cve.now/CVE-2025-1437.md): Advanced iFrame \<= 2025.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mdempfle Advanced iFrame)
- [CVE-2025-1439](https://cve.now/CVE-2025-1439.md): Advanced iFrame \<= 2024.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Host Header (CVSS 6.4, mdempfle Advanced iFrame)
- [CVE-2025-1310](https://cve.now/CVE-2025-1310.md): Jobs for WordPress \<= 2.7.11 - Authenticated (Subscriber+) Arbitrary File Read (CVSS 6.5, blueglassch Job Postings)
- [CVE-2024-13702](https://cve.now/CVE-2024-13702.md): CRM and Lead Management by vcita \<= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, CRM and Lead Management by vcita)
- [CVE-2024-13801](https://cve.now/CVE-2024-13801.md): BWL Advanced FAQ Manager \<= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update (CVSS 8.1, xenioushk BWL Advanced FAQ Manager)
- [CVE-2025-1514](https://cve.now/CVE-2025-1514.md): Active Products Tables for WooCommerce \<= 1.0.6.7 - Unauthenticated Arbitrary Filter Call (CVSS 7.3, realmag777 Active Products Tables for WooCommerce. Use cons…)
- [CVE-2025-2009](https://cve.now/CVE-2025-2009.md): Newsletters \<= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, contrid Newsletters)
- [CVE-2025-2167](https://cve.now/CVE-2025-2167.md): Event post \<= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, bastho Event post)
- [CVE-2025-2257](https://cve.now/CVE-2025-2257.md): Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid \<= 1.16.10 - Authenticated (Admin+) Command Injection (CVSS 7.2, Total Upkeep – WordPress Backup Plugin plus Restore & Migra…)
- [CVE-2024-30155](https://cve.now/CVE-2024-30155.md): HCL SX is susceptible to cookie with Insecure, Improper, or Missing SameSite attribute vulnerability (CVSS 5.5, HCL Software HCL SX)
- [CVE-2023-52972](https://cve.now/CVE-2023-52972.md): Huawei PCs have a vulnerability that allows low-privilege users to bypass SDDL permission checks . (CVSS 5.5, Huawei YutuFZ-5651S1)
- [CVE-2024-13146](https://cve.now/CVE-2024-13146.md): Booknetic \< 4.1.5 - Staff Creation via CSRF (CVSS 8.8, Booknetic)
- [CVE-2024-12683](https://cve.now/CVE-2024-12683.md): Smart Maintenance Mode \< 1.5.2 - Admin+ Stored XSS (CVSS 3.5, Smart Maintenance Mode)
- [CVE-2024-11847](https://cve.now/CVE-2024-11847.md): WP SVG Upload \<= 1.0.0 - Author+ Stored XSS via SVG (CVSS 4.8, wp-svg-upload · digimix/wp-svg-upload)
- [CVE-2025-1784](https://cve.now/CVE-2025-1784.md): Spectra – WordPress Gutenberg Blocks \<= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, brainstormforce Spectra Gutenberg Blocks – Website Builder…)
- [CVE-2025-1490](https://cve.now/CVE-2025-1490.md): Smart Maintenance Mode \<= 1.5.2 - Reflected Cross-Site Scripting via setstatus Parameter (CVSS 6.1, brijeshk89 Smart Maintenance Mode)
- [CVE-2025-2165](https://cve.now/CVE-2025-2165.md): SH Email Alert \<= 1.0 - Reflected Cross-Site Scripting (CVSS 6.1, samhoamt SH Email Alert)
- [CVE-2025-2573](https://cve.now/CVE-2025-2573.md): Amazing service box Addons For WPBakery Page Builder \<= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, zia420 Amazing service box Addons For WPBakery Page Builder)
- [CVE-2025-2576](https://cve.now/CVE-2025-2576.md): Ayyash Studio \<= 1.0.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, themerox Ayyash Studio — The kick-start kit)
- [CVE-2024-41643](https://cve.now/CVE-2024-41643.md): An issue in Arris NVG443B 9.3.0h3d36 allows a physically proximate attacker to execute arbitrary code via the cshell login component. (CVSS 6.8)
- [CVE-2024-55963](https://cve.now/CVE-2024-55963.md): An issue was discovered in Appsmith before 1.51. (CVSS 6.5)
- [CVE-2024-55964](https://cve.now/CVE-2024-55964.md): An issue was discovered in Appsmith before 1.52. (CVSS 9.8)
- [CVE-2024-55965](https://cve.now/CVE-2024-55965.md): An issue was discovered in Appsmith before 1.51. (CVSS 6.5)
- [CVE-2025-25535](https://cve.now/CVE-2025-25535.md): HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request. (CVSS 9.8)
- [CVE-2025-26001](https://cve.now/CVE-2025-26001.md): Telesquare TLR-2005KSH 1.1.4 is vulnerable to Information Disclosure via the parameter getUserNamePassword. (CVSS 7.5)
- [CVE-2025-26002](https://cve.now/CVE-2025-26002.md): Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setSyn (CVSS 9.8)
- [CVE-2025-26003](https://cve.now/CVE-2025-26003.md): Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized command execution vulnerability when requesting the admin.cgi parameter with set (CVSS 9.8)
- [CVE-2025-26004](https://cve.now/CVE-2025-26004.md): Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack buffer overflow vulnerability when requesting admin.cgi parameter with setD (CVSS 9.8)
- [CVE-2025-26005](https://cve.now/CVE-2025-26005.md): Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack overflow vulnerability when requesting admin.cgi parameter with setNtp. (CVSS 9.8)
- [CVE-2025-26006](https://cve.now/CVE-2025-26006.md): Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setAutorest. (CVSS 9.8)
- [CVE-2025-26007](https://cve.now/CVE-2025-26007.md): Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability in the login interface when requesting systemtil.cgi. (CVSS 9.8)
- [CVE-2025-26008](https://cve.now/CVE-2025-26008.md): In Telesquare TLR-2005KSH 1.1.4, an unauthorized stack overflow vulnerability exists when requesting admin.cgi parameter with setSyncTimeHos (CVSS 9.8)
- [CVE-2025-26009](https://cve.now/CVE-2025-26009.md): Telesquare TLR-2005KSH 1.1.4 has an Information Disclosure vulnerability when requesting systemutilit.cgi. (CVSS 7.5)
- [CVE-2025-26010](https://cve.now/CVE-2025-26010.md): Telesquare TLR-2005KSH 1.1.4 allows unauthorized password modification when requesting the admin.cgi parameter with setUserNamePassword. (CVSS 9.8)
- [CVE-2025-26011](https://cve.now/CVE-2025-26011.md): Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setUsernamePasswo (CVSS 9.8)
- [CVE-2025-28361](https://cve.now/CVE-2025-28361.md): Unauthorized stack overflow vulnerability in Telesquare TLR-2005KSH v.1.1.4 allows a remote attacker to obtain sensitive information via the (CVSS 7.5)
- [CVE-2025-29322](https://cve.now/CVE-2025-29322.md): A cross-site scripting (XSS) vulnerability in ScriptCase before v1.0.003 - Build 3 allows attackers to execute arbitrary code via a crafted (CVSS 4.6)
- [CVE-2025-30073](https://cve.now/CVE-2025-30073.md): An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0. (CVSS 7.5)
- [CVE-2025-30742](https://cve.now/CVE-2025-30742.md): httpd.c in atophttpd 2.8.0 has an off-by-one error and resultant out-of-bounds read because a certain 1024-character req string would not ha (CVSS 5.3, pizhenwei atophttpd)
- [CVE-2025-31160](https://cve.now/CVE-2025-31160.md): atop through 2.11.0 allows local users to cause a denial of service (e.g., assertion failure and application exit) or possibly have unspecif (CVSS 2.9, atop project atop)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.