# CVEs published 2025-03-29

9 CVEs were published on March 29, 2025: 1 critical, 3 high. Days are UTC.

- [CVE-2024-55895](https://cve.now/CVE-2024-55895.md): IBM InfoSphere Information Server information disclosure (CVSS 2.7, IBM InfoSphere Information Server)
- [CVE-2024-11180](https://cve.now/CVE-2024-11180.md): ElementsKit Elementor addons \<= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…)
- [CVE-2025-2249](https://cve.now/CVE-2025-2249.md): SoJ Soundslides \<= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, sojweb SoJ SoundSlides)
- [CVE-2024-13557](https://cve.now/CVE-2024-13557.md): Shortcodes by United Themes \<= 5.1.6 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5, Shortcodes by United Themes)
- [CVE-2025-2006](https://cve.now/CVE-2025-2006.md): Inline Image Upload for BBPress \<= 1.1.19 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, berrypress Inline Image Upload for BBPress)
- [CVE-2025-2266](https://cve.now/CVE-2025-2266.md): Checkout Mestres do WP for WooCommerce 8.6.5 - 8.7.5 - Unauthenticated Arbitrary Options Update (CVSS 9.8, mestresdowp Checkout Mestres do WP for WooCommerce)
- [CVE-2025-2803](https://cve.now/CVE-2025-2803.md): So-Called Air Quotes \<= 0.1 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, davemacd So-Called Air Quotes)
- [CVE-2025-2840](https://cve.now/CVE-2025-2840.md): DAP to Autoresponders Email Syncing \<= 1.0 - Unauthenticated Information Exposure (CVSS 5.3, bhuvnesh DAP to Autoresponders Email Syncing)
- [CVE-2025-1217](https://cve.now/CVE-2025-1217.md): Header parser of http stream wrapper does not handle folded headers (CVSS 6.3, PHP Group PHP)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.