# CVEs published 2025-04-01

429 CVEs were published on April 1, 2025: 26 critical, 151 high. Days are UTC.

- [CVE-2025-30356](https://cve.now/CVE-2025-30356.md): Heap Buffer Overflow via Incomplete Length Check in \`Crypto\_TC\_ApplySecurity\` (CVSS 9.3, nasa CryptoLib)
- [CVE-2025-31135](https://cve.now/CVE-2025-31135.md): Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times (CVSS 5.3, phires go-guerrilla · github.com/phires/go-guerrilla)
- [CVE-2024-13941](https://cve.now/CVE-2024-13941.md): ouch-org ouch zip.rs convert\_zip\_date\_time memory corruption (CVSS 4.8, ouch-org ouch · ouch)
- [CVE-2025-31889](https://cve.now/CVE-2025-31889.md): WordPress Extensions for Elementor plugin \<= 2.0.40 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, petesheppard84 Extensions for Elementor)
- [CVE-2025-31819](https://cve.now/CVE-2025-31819.md): WordPress Nova Blocks by Pixelgrade plugin \<= 2.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, pixelgrade Nova Blocks)
- [CVE-2025-31628](https://cve.now/CVE-2025-31628.md): WordPress Sliced Invoices plugin \<= 3.10.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, SlicedInvoices Sliced Invoices)
- [CVE-2025-31619](https://cve.now/CVE-2025-31619.md): WordPress Actionwear products sync plugin \<= 2.3.3 - SQL Injection vulnerability (CVSS 8.5, marcoingraiti Actionwear products sync)
- [CVE-2025-31612](https://cve.now/CVE-2025-31612.md): WordPress CBX Poll plugin \<= 2.0.4 - PHP Object Injection vulnerability (CVSS 9.8, Sabuj Kundu CBX Poll)
- [CVE-2025-31594](https://cve.now/CVE-2025-31594.md): WordPress Auto scroll for reading plugin \<= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPglob Auto scroll for reading)
- [CVE-2025-31580](https://cve.now/CVE-2025-31580.md): WordPress Ni WooCommerce Product Enquiry plugin \<= 4.1.8 - Broken Access Control vulnerability (CVSS 7.5, Anzar Ahmed Ni WooCommerce Product Enquiry)
- [CVE-2025-31579](https://cve.now/CVE-2025-31579.md): WordPress WP AutoKeyword plugin \<= 1.0 - SQL Injection vulnerability (CVSS 9.3, EXEIdeas International WP AutoKeyword)
- [CVE-2025-31578](https://cve.now/CVE-2025-31578.md): WordPress Fonts Manager | Custom Fonts plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Wisdomlogix Solutions Pvt. Fonts Manager | Custom Fonts)
- [CVE-2025-31571](https://cve.now/CVE-2025-31571.md): WordPress The Logo Slider plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Cynob IT Consultancy The Logo Slider)
- [CVE-2025-31568](https://cve.now/CVE-2025-31568.md): WordPress LeadLab by wiredminds plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wiredmindshelp LeadLab by wiredminds)
- [CVE-2025-31564](https://cve.now/CVE-2025-31564.md): WordPress Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin \<= 2.2.6 - SQL Injection vulnerability (CVSS 8.5, aitool Ai Auto Tool Content Writing Assistant (Gemini Write…)
- [CVE-2025-31563](https://cve.now/CVE-2025-31563.md): WordPress AI Search Bar plugin \<= 2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Vimal Kava AI Search Bar)
- [CVE-2025-31561](https://cve.now/CVE-2025-31561.md): WordPress Ultimate Push Notifications plugin \<= 1.2.0 - SQL Injection vulnerability (CVSS 8.5, CodeSolz Ultimate Push Notifications)
- [CVE-2025-31560](https://cve.now/CVE-2025-31560.md): WordPress Salon booking system plugin \< 10.15 - Privilege Escalation vulnerability (CVSS 7.2, Dimitri Grassi Salon booking system)
- [CVE-2025-31553](https://cve.now/CVE-2025-31553.md): WordPress Advanced WooCommerce Product Sales Reporting plugin \<= 4.1.1 - SQL Injection vulnerability (CVSS 9.3, WPFactory Advanced WooCommerce Product Sales Reporting)
- [CVE-2025-31552](https://cve.now/CVE-2025-31552.md): WordPress RSVPMarker plugin \<= 11.6.7 - SQL Injection vulnerability (CVSS 9.3, davidfcarr RSVPMarker)
- [CVE-2025-31551](https://cve.now/CVE-2025-31551.md): WordPress Salesmate Add-On for Gravity Forms plugin \<= 2.0.3 - SQL Injection vulnerability (CVSS 9.3, Salesmate.io Salesmate Add-On for Gravity Forms)
- [CVE-2025-31550](https://cve.now/CVE-2025-31550.md): WordPress WP-LESS plugin \<= 1.9.6 - Sensitive Data Exposure vulnerability (CVSS 5.8, thom4 WP-LESS)
- [CVE-2025-31548](https://cve.now/CVE-2025-31548.md): WordPress Ultimate Push Notifications plugin \<= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CodeSolz Ultimate Push Notifications)
- [CVE-2025-31537](https://cve.now/CVE-2025-31537.md): WordPress Bulk NoIndex & NoFollow Toolkit plugin \<= 2.16 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, madfishdigital Bulk NoIndex & NoFollow Toolkit)
- [CVE-2025-31534](https://cve.now/CVE-2025-31534.md): WordPress Shopper plugin \<= 3.2.5 - SQL Injection vulnerability (CVSS 9.3, shopperdotcom Shopper)
- [CVE-2025-31531](https://cve.now/CVE-2025-31531.md): WordPress History Log by click5 plugin \<= 1.0.13 - SQL Injection vulnerability (CVSS 9.3, History Log by click5)
- [CVE-2025-31525](https://cve.now/CVE-2025-31525.md): WordPress WP Mobile Bottom Menu plugin \<= 1.4.0 - Broken Access Control vulnerability (CVSS 4.3, WP Messiah WP Mobile Bottom Menu)
- [CVE-2025-31462](https://cve.now/CVE-2025-31462.md): WordPress CGM Event Calendar plugin \<= 0.8.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, rzfarrell CGM Event Calendar)
- [CVE-2025-31461](https://cve.now/CVE-2025-31461.md): WordPress NanoSupport plugin \<= 0.6.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mayeenul Islam NanoSupport)
- [CVE-2025-31455](https://cve.now/CVE-2025-31455.md): WordPress Limit Max IPs Per User plugin \<= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ralxz Limit Max IPs Per User)
- [CVE-2025-31454](https://cve.now/CVE-2025-31454.md): WordPress Delete Post Revision plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Arefly Delete Post Revision)
- [CVE-2025-31446](https://cve.now/CVE-2025-31446.md): WordPress WP Cleaner plugin \<= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jiangmiao WP Cleaner)
- [CVE-2025-31445](https://cve.now/CVE-2025-31445.md): WordPress Pages Order plugin \<= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sed Lex Pages Order)
- [CVE-2025-31441](https://cve.now/CVE-2025-31441.md): WordPress WordPress Galleria plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WordPress Galleria)
- [CVE-2025-31431](https://cve.now/CVE-2025-31431.md): WordPress WP Bookmarks plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, conlabz WP Bookmarks)
- [CVE-2025-31097](https://cve.now/CVE-2025-31097.md): WordPress Material Dashboard plugin \<= 1.4.5 - Local File Inclusion Vulnerability (CVSS 8.1, Hossein Material Dashboard)
- [CVE-2025-31089](https://cve.now/CVE-2025-31089.md): WordPress Order Splitter for WooCommerce plugin \<= 5.3.0 - SQL Injection Vulnerability (CVSS 8.5, Fahad Mahmood Order Splitter for WooCommerce)
- [CVE-2025-31086](https://cve.now/CVE-2025-31086.md): WordPress Product Table by WBW plugin \<= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WBW Plugins Product Table by WBW)
- [CVE-2025-31085](https://cve.now/CVE-2025-31085.md): WordPress xili-language plugin \<= 2.21.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Michel - xiligroup dev xili-language)
- [CVE-2025-31082](https://cve.now/CVE-2025-31082.md): WordPress News & Blog Designer Pack plugin \<= 4.0 - Local File Inclusion vulnerability (CVSS 8.1, InfornWeb News & Blog Designer Pack)
- [CVE-2025-31081](https://cve.now/CVE-2025-31081.md): WordPress Enable Media Replace plugin \<= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ShortPixel Enable Media Replace)
- [CVE-2025-31080](https://cve.now/CVE-2025-31080.md): WordPress HTML Forms plugin \<= 1.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Link Software HTML Forms)
- [CVE-2025-31078](https://cve.now/CVE-2025-31078.md): WordPress Small Package Quotes – Worldwide Express Edition plugin \<= 5.2.18 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, enituretechnology Small Package Quotes – Worldwide Express…)
- [CVE-2025-30913](https://cve.now/CVE-2025-30913.md): WordPress Access Areas Plugin \<= 1.5.19 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, podpirate Access Areas)
- [CVE-2025-30906](https://cve.now/CVE-2025-30906.md): WordPress Plugin Oficial – Getnet para WooCommerce plugin \<= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, lisandragetnet Plugin Oficial – Getnet para WooCommerce)
- [CVE-2025-30905](https://cve.now/CVE-2025-30905.md): WordPress Secure Copy Content Protection and Content Locking plugin \<= 4.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ays Pro Secure Copy Content Protection and Content Locking)
- [CVE-2025-30892](https://cve.now/CVE-2025-30892.md): WordPress WpTravelly Plugin \<= 1.8.7 - PHP Object Injection vulnerability (CVSS 8.8, magepeopleteam WpTravelly)
- [CVE-2025-30853](https://cve.now/CVE-2025-30853.md): WordPress ShortPixel Adaptive Images plugin \<= 3.10.0 - Broken Authentication vulnerability (CVSS 5.4, ShortPixel Adaptive Images)
- [CVE-2025-30852](https://cve.now/CVE-2025-30852.md): WordPress Oracle Cards Lite plugin \<= 1.2.1 - Reflected Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, emotionalonlinestorytelling Oracle Cards Lite)
- [CVE-2025-30844](https://cve.now/CVE-2025-30844.md): WordPress Watu Quiz plugin \<= 3.4.2 - Reflected Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Bob Watu Quiz)
- [CVE-2025-30841](https://cve.now/CVE-2025-30841.md): WordPress Countdown & Clock plugin \<=2.8.8 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, adamskaat Countdown & Clock)
- [CVE-2025-30825](https://cve.now/CVE-2025-30825.md): WordPress WPC Smart Linked Products plugin \<= 1.3.5 - Privilege Escalation vulnerability (CVSS 8.8, WPClever WPC Smart Linked Products - Upsells & Cross-sells…)
- [CVE-2025-30807](https://cve.now/CVE-2025-30807.md): WordPress Next-Cart Store to WooCommerce Migration plugin \<= 3.9.4 - SQL Injection vulnerability (CVSS 9.3, Martin Nguyen Next-Cart Store to WooCommerce Migration)
- [CVE-2025-30778](https://cve.now/CVE-2025-30778.md): WordPress VForm plugin \<= 3.1.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Vikas Ratudi VPSUForm)
- [CVE-2025-30580](https://cve.now/CVE-2025-30580.md): WordPress DigiWidgets Image Editor plugin \<= 1.10 - Remote Code Execution (RCE) Vulnerability (CVSS 10.0, kellydiek DigiWidgets Image Editor)
- [CVE-2025-30554](https://cve.now/CVE-2025-30554.md): WordPress Frizzly plugin \<= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Abhishek Kumar Frizzly)
- [CVE-2025-31753](https://cve.now/CVE-2025-31753.md): WordPress Advanced Speed Increaser Plugin \<= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Animesh Kumar Advanced Speed Increaser)
- [CVE-2025-3096](https://cve.now/CVE-2025-3096.md): Clinics Patient Management System SQL Injection (CVSS 9.3, SourceCodester Clinic's Patient Management System)
- [CVE-2025-31137](https://cve.now/CVE-2025-31137.md): Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers (CVSS 7.5, remix-run react-router · @react-router/express +1)
- [CVE-2025-25041](https://cve.now/CVE-2025-25041.md): Arbitrary File Overwrite in HPE Aruba Networking Virtual Intranet Access (VIA) Microsoft Windows Client (CVSS 5.5, Hewlett Packard Enterprise (HPE) Virtual Intranet Access)
- [CVE-2025-21986](https://cve.now/CVE-2025-21986.md): net: switchdev: Convert blocking notification chain to a raw one (no CVSS, Linux)
- [CVE-2025-21985](https://cve.now/CVE-2025-21985.md): drm/amd/display: Fix out-of-bound accesses (CVSS 7.8, Linux)
- [CVE-2025-21984](https://cve.now/CVE-2025-21984.md): mm: fix kernel BUG when userfaultfd\_move encounters swapcache (CVSS 7.8, Linux)
- [CVE-2025-21983](https://cve.now/CVE-2025-21983.md): mm/slab/kvfree\_rcu: Switch to WQ\_MEM\_RECLAIM wq (no CVSS, Linux)
- [CVE-2025-21982](https://cve.now/CVE-2025-21982.md): pinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xx\_gpio\_fw (CVSS 5.5, Linux)
- [CVE-2025-21981](https://cve.now/CVE-2025-21981.md): ice: fix memory leak in aRFS after reset (CVSS 5.5, Linux)
- [CVE-2025-21980](https://cve.now/CVE-2025-21980.md): sched: address a potential NULL pointer dereference in the GRED scheduler. (CVSS 5.5, Linux)
- [CVE-2025-21979](https://cve.now/CVE-2025-21979.md): wifi: cfg80211: cancel wiphy\_work before freeing wiphy (CVSS 7.8, Linux)
- [CVE-2025-21978](https://cve.now/CVE-2025-21978.md): drm/hyperv: Fix address space leak when Hyper-V DRM device is removed (no CVSS, Linux)
- [CVE-2025-21977](https://cve.now/CVE-2025-21977.md): fbdev: hyperv\_fb: Fix hang in kdump kernel when on Hyper-V Gen 2 VMs (no CVSS, Linux)
- [CVE-2025-21976](https://cve.now/CVE-2025-21976.md): fbdev: hyperv\_fb: Allow graceful removal of framebuffer (CVSS 7.8, Linux)
- [CVE-2025-21975](https://cve.now/CVE-2025-21975.md): net/mlx5: handle errors in mlx5\_chains\_create\_table() (no CVSS, Linux)
- [CVE-2025-21974](https://cve.now/CVE-2025-21974.md): eth: bnxt: return fail if interface is down in bnxt\_queue\_mem\_alloc() (no CVSS, Linux)
- [CVE-2025-21973](https://cve.now/CVE-2025-21973.md): eth: bnxt: fix kernel panic in the bnxt\_get\_queue\_stats{rx | tx} (no CVSS, Linux)
- [CVE-2025-21972](https://cve.now/CVE-2025-21972.md): net: mctp: unshare packets when reassembling (CVSS 8.8, Linux)
- [CVE-2025-21971](https://cve.now/CVE-2025-21971.md): net\_sched: Prevent creation of classes with TC\_H\_ROOT (CVSS 7.8, Linux)
- [CVE-2025-21970](https://cve.now/CVE-2025-21970.md): net/mlx5: Bridge, fix the crash caused by LAG state check (CVSS 7.8, Linux)
- [CVE-2025-21969](https://cve.now/CVE-2025-21969.md): Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap\_send\_cmd (CVSS 8.8, Linux)
- [CVE-2025-21968](https://cve.now/CVE-2025-21968.md): drm/amd/display: Fix slab-use-after-free on hdcp\_work (CVSS 7.8, Linux)
- [CVE-2025-21967](https://cve.now/CVE-2025-21967.md): ksmbd: fix use-after-free in ksmbd\_free\_work\_struct (CVSS 8.8, Linux)
- [CVE-2025-21966](https://cve.now/CVE-2025-21966.md): dm-flakey: Fix memory corruption in optional corrupt\_bio\_byte feature (CVSS 7.8, Linux)
- [CVE-2025-21965](https://cve.now/CVE-2025-21965.md): sched\_ext: Validate prev\_cpu in scx\_bpf\_select\_cpu\_dfl() (CVSS 7.8, Linux)
- [CVE-2025-21964](https://cve.now/CVE-2025-21964.md): cifs: Fix integer overflow while processing acregmax mount option (CVSS 5.5, Linux)
- [CVE-2025-21963](https://cve.now/CVE-2025-21963.md): cifs: Fix integer overflow while processing acdirmax mount option (CVSS 5.5, Linux)
- [CVE-2025-21962](https://cve.now/CVE-2025-21962.md): cifs: Fix integer overflow while processing closetimeo mount option (CVSS 5.5, Linux)
- [CVE-2025-21961](https://cve.now/CVE-2025-21961.md): eth: bnxt: fix truesize for mb-xdp-pass case (CVSS 7.5, Linux)
- [CVE-2025-21960](https://cve.now/CVE-2025-21960.md): eth: bnxt: do not update checksum in bnxt\_xdp\_build\_skb() (CVSS 7.5, Linux)
- [CVE-2025-21959](https://cve.now/CVE-2025-21959.md): netfilter: nf\_conncount: Fully initialize struct nf\_conncount\_tuple in insert\_tree() (CVSS 7.3, Linux)
- [CVE-2025-21958](https://cve.now/CVE-2025-21958.md): Revert "openvswitch: switch to per-action label counting in conntrack" (CVSS 7.8, Linux)
- [CVE-2025-21957](https://cve.now/CVE-2025-21957.md): scsi: qla1280: Fix kernel oops when debug level \> 2 (CVSS 5.5, Linux)
- [CVE-2025-21956](https://cve.now/CVE-2025-21956.md): drm/amd/display: Assign normalized\_pix\_clk when color depth = 14 (no CVSS, Linux)
- [CVE-2025-21955](https://cve.now/CVE-2025-21955.md): ksmbd: prevent connection release during oplock break notification (CVSS 8.8, Linux)
- [CVE-2025-21954](https://cve.now/CVE-2025-21954.md): netmem: prevent TX of unreadable skbs (CVSS 9.8, Linux)
- [CVE-2025-21953](https://cve.now/CVE-2025-21953.md): net: mana: cleanup mana struct after debugfs\_remove() (CVSS 5.5, Linux)
- [CVE-2025-21952](https://cve.now/CVE-2025-21952.md): HID: corsair-void: Update power supply values with a unified work handler (no CVSS, Linux)
- [CVE-2025-21951](https://cve.now/CVE-2025-21951.md): bus: mhi: host: pci\_generic: Use pci\_try\_reset\_function() to avoid deadlock (CVSS 5.5, Linux)
- [CVE-2025-21950](https://cve.now/CVE-2025-21950.md): drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd\_ioctl (no CVSS, Linux)
- [CVE-2025-21949](https://cve.now/CVE-2025-21949.md): LoongArch: Set hugetlb mmap base address aligned with pmd size (CVSS 7.8, Linux)
- [CVE-2025-21948](https://cve.now/CVE-2025-21948.md): HID: appleir: Fix potential NULL dereference at raw event handle (CVSS 5.5, Linux)
- [CVE-2025-21947](https://cve.now/CVE-2025-21947.md): ksmbd: fix type confusion via race condition when using ipc\_msg\_send\_request (CVSS 8.1, Linux)
- [CVE-2025-21946](https://cve.now/CVE-2025-21946.md): ksmbd: fix out-of-bounds in parse\_sec\_desc() (CVSS 8.8, Linux)
- [CVE-2025-21945](https://cve.now/CVE-2025-21945.md): ksmbd: fix use-after-free in smb2\_lock (CVSS 8.8, Linux)
- [CVE-2025-21944](https://cve.now/CVE-2025-21944.md): ksmbd: fix bug on trap in smb2\_lock (no CVSS, Linux)
- [CVE-2025-21943](https://cve.now/CVE-2025-21943.md): gpio: aggregator: protect driver attr handlers against module unload (CVSS 4.7, Linux)
- [CVE-2025-21942](https://cve.now/CVE-2025-21942.md): btrfs: zoned: fix extent range end unlock in cow\_file\_range() (no CVSS, Linux)
- [CVE-2025-21941](https://cve.now/CVE-2025-21941.md): drm/amd/display: Fix null check for pipe\_ctx-\>plane\_state in resource\_build\_scaling\_params (CVSS 5.5, Linux)
- [CVE-2025-21940](https://cve.now/CVE-2025-21940.md): drm/amdkfd: Fix NULL Pointer Dereference in KFD queue (CVSS 5.5, Linux)
- [CVE-2025-21939](https://cve.now/CVE-2025-21939.md): drm/xe/hmm: Don't dereference struct page pointers without notifier lock (CVSS 7.8, Linux)
- [CVE-2025-21938](https://cve.now/CVE-2025-21938.md): mptcp: fix 'scheduling while atomic' in mptcp\_pm\_nl\_append\_new\_local\_addr (CVSS 7.5, Linux)
- [CVE-2025-21937](https://cve.now/CVE-2025-21937.md): Bluetooth: Add check for mgmt\_alloc\_skb() in mgmt\_remote\_name() (CVSS 5.5, Linux)
- [CVE-2025-21936](https://cve.now/CVE-2025-21936.md): Bluetooth: Add check for mgmt\_alloc\_skb() in mgmt\_device\_connected() (CVSS 5.5, Linux)
- [CVE-2025-21935](https://cve.now/CVE-2025-21935.md): rapidio: add check for rio\_add\_net() in rio\_scan\_alloc\_net() (no CVSS, Linux)
- [CVE-2025-21934](https://cve.now/CVE-2025-21934.md): rapidio: fix an API misues when rio\_add\_net() fails (CVSS 7.8, Linux)
- [CVE-2025-21933](https://cve.now/CVE-2025-21933.md): arm: pgtable: fix NULL pointer dereference issue (CVSS 5.5, Linux)
- [CVE-2025-21932](https://cve.now/CVE-2025-21932.md): mm: abort vma\_modify() on merge out of memory failure (CVSS 7.0, Linux)
- [CVE-2025-21931](https://cve.now/CVE-2025-21931.md): hwpoison, memory\_hotplug: lock folio before unmap hwpoisoned folio (no CVSS, Linux)
- [CVE-2025-21930](https://cve.now/CVE-2025-21930.md): wifi: iwlwifi: mvm: don't try to talk to a dead firmware (CVSS 5.5, Linux)
- [CVE-2025-21929](https://cve.now/CVE-2025-21929.md): HID: intel-ish-hid: Fix use-after-free issue in hid\_ishtp\_cl\_remove() (CVSS 7.8, Linux)
- [CVE-2025-21928](https://cve.now/CVE-2025-21928.md): HID: intel-ish-hid: Fix use-after-free issue in ishtp\_hid\_remove() (CVSS 7.8, Linux)
- [CVE-2025-21927](https://cve.now/CVE-2025-21927.md): nvme-tcp: fix potential memory corruption in nvme\_tcp\_recv\_pdu() (CVSS 9.8, Linux)
- [CVE-2025-21926](https://cve.now/CVE-2025-21926.md): net: gso: fix ownership in \_\_udp\_gso\_segment (CVSS 7.8, Linux)
- [CVE-2025-21925](https://cve.now/CVE-2025-21925.md): llc: do not use skb\_get() before dev\_queue\_xmit() (no CVSS, Linux)
- [CVE-2025-21924](https://cve.now/CVE-2025-21924.md): net: hns3: make sure ptp clock is unregister and freed if hclge\_ptp\_get\_cycle returns an error (CVSS 7.8, Linux)
- [CVE-2025-21923](https://cve.now/CVE-2025-21923.md): HID: hid-steam: Fix use-after-free when detaching device (CVSS 7.8, Linux)
- [CVE-2025-21922](https://cve.now/CVE-2025-21922.md): ppp: Fix KMSAN uninit-value warning with bpf (CVSS 5.5, Linux)
- [CVE-2025-21921](https://cve.now/CVE-2025-21921.md): net: ethtool: netlink: Allow NULL nlattrs when getting a phy\_device (no CVSS, Linux)
- [CVE-2025-21920](https://cve.now/CVE-2025-21920.md): vlan: enforce underlying device type (CVSS 7.1, Linux)
- [CVE-2025-21919](https://cve.now/CVE-2025-21919.md): sched/fair: Fix potential memory corruption in child\_cfs\_rq\_on\_list (CVSS 7.8, Linux)
- [CVE-2025-21918](https://cve.now/CVE-2025-21918.md): usb: typec: ucsi: Fix NULL pointer access (CVSS 5.5, Linux)
- [CVE-2025-21917](https://cve.now/CVE-2025-21917.md): usb: renesas\_usbhs: Flush the notify\_hotplug\_work (CVSS 5.5, Linux)
- [CVE-2025-21916](https://cve.now/CVE-2025-21916.md): usb: atm: cxacru: fix a flaw in existing endpoint checks (no CVSS, Linux)
- [CVE-2025-21915](https://cve.now/CVE-2025-21915.md): cdx: Fix possible UAF error in driver\_override\_show() (CVSS 7.0, Linux)
- [CVE-2025-21914](https://cve.now/CVE-2025-21914.md): slimbus: messaging: Free transaction ID in delayed interrupt scenario (CVSS 7.8, Linux)
- [CVE-2025-21913](https://cve.now/CVE-2025-21913.md): x86/amd\_nb: Use rdmsr\_safe() in amd\_get\_mmconfig\_range() (no CVSS, Linux)
- [CVE-2025-21912](https://cve.now/CVE-2025-21912.md): gpio: rcar: Use raw\_spinlock to protect register access (no CVSS, Linux)
- [CVE-2025-21911](https://cve.now/CVE-2025-21911.md): drm/imagination: avoid deadlock on fence release (CVSS 5.5, Linux)
- [CVE-2025-21910](https://cve.now/CVE-2025-21910.md): wifi: cfg80211: regulatory: improve invalid hints checking (no CVSS, Linux)
- [CVE-2025-21909](https://cve.now/CVE-2025-21909.md): wifi: nl80211: reject cooked mode if it is set along with other flags (no CVSS, Linux)
- [CVE-2025-21908](https://cve.now/CVE-2025-21908.md): NFS: fix nfs\_release\_folio() to not deadlock via kcompactd writeback (CVSS 5.5, Linux)
- [CVE-2025-21907](https://cve.now/CVE-2025-21907.md): mm: memory-failure: update ttu flag inside unmap\_poisoned\_folio (no CVSS, Linux)
- [CVE-2025-21906](https://cve.now/CVE-2025-21906.md): wifi: iwlwifi: mvm: clean up ROC on failure (CVSS 7.6, Linux)
- [CVE-2025-21905](https://cve.now/CVE-2025-21905.md): wifi: iwlwifi: limit printed string from FW file (CVSS 7.1, Linux)
- [CVE-2025-21904](https://cve.now/CVE-2025-21904.md): caif\_virtio: fix wrong pointer check in cfv\_probe() (CVSS 5.5, Linux)
- [CVE-2025-21903](https://cve.now/CVE-2025-21903.md): mctp i3c: handle NULL header address (no CVSS, Linux)
- [CVE-2025-21902](https://cve.now/CVE-2025-21902.md): acpi: typec: ucsi: Introduce a -\>poll\_cci method (no CVSS, Linux)
- [CVE-2025-21901](https://cve.now/CVE-2025-21901.md): RDMA/bnxt\_re: Add sanity checks on rdev validity (CVSS 7.8, Linux)
- [CVE-2025-21900](https://cve.now/CVE-2025-21900.md): NFSv4: Fix a deadlock when recovering state on a sillyrenamed file (CVSS 7.5, Linux)
- [CVE-2025-21899](https://cve.now/CVE-2025-21899.md): tracing: Fix bad hist from corrupting named\_triggers list (CVSS 7.8, Linux)
- [CVE-2025-21898](https://cve.now/CVE-2025-21898.md): ftrace: Avoid potential division by zero in function\_stat\_show() (CVSS 5.5, Linux)
- [CVE-2025-21897](https://cve.now/CVE-2025-21897.md): sched\_ext: Fix pick\_task\_scx() picking non-queued tasks when it's called without balance() (no CVSS, Linux)
- [CVE-2025-21896](https://cve.now/CVE-2025-21896.md): fuse: revert back to \_\_readahead\_folio() for readahead (CVSS 7.8, Linux)
- [CVE-2025-21895](https://cve.now/CVE-2025-21895.md): perf/core: Order the PMU list to fix warning about unordered pmu\_ctx\_list (no CVSS, Linux)
- [CVE-2025-21894](https://cve.now/CVE-2025-21894.md): net: enetc: VFs do not support HWTSTAMP\_TX\_ONESTEP\_SYNC (no CVSS, Linux)
- [CVE-2025-31132](https://cve.now/CVE-2025-31132.md): Raven allows Remote Code Execution due to improper validation (CVSS 8.1, The-Commit-Company raven)
- [CVE-2025-31131](https://cve.now/CVE-2025-31131.md): Path Traversal allowing arbitrary read of files in Yeswiki (CVSS 8.6, yeswiki · yeswiki/yeswiki)
- [CVE-2025-31121](https://cve.now/CVE-2025-31121.md): OpenEMR allows XSS in Patient Image feature (CVSS 7.0, openemr)
- [CVE-2025-31910](https://cve.now/CVE-2025-31910.md): WordPress BookingPress plugin \<= 1.1.28 - SQL Injection vulnerability (CVSS 7.6, reputeinfosystems BookingPress)
- [CVE-2025-31908](https://cve.now/CVE-2025-31908.md): WordPress JSON Structuring Markup plugin \<= 0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Sami Ahmed Siddiqui JSON Structuring Markup)
- [CVE-2025-31906](https://cve.now/CVE-2025-31906.md): WordPress WP Profitshare Plugin \<= 1.4.9 - CSRF to Stored XSS vulnerability (CVSS 7.1, ProfitShare.ro WP Profitshare)
- [CVE-2025-31904](https://cve.now/CVE-2025-31904.md): WordPress Ebook Downloader plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Infoway Ebook Downloader)
- [CVE-2025-31897](https://cve.now/CVE-2025-31897.md): WordPress Arrow Custom Feed for Twitter plugin \<= 1.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Arrow Plugins Arrow Custom Feed for Twitter)
- [CVE-2025-31895](https://cve.now/CVE-2025-31895.md): WordPress ABC Notation Plugin \<= 6.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, paulrosen ABC Notation)
- [CVE-2025-31894](https://cve.now/CVE-2025-31894.md): WordPress Ebook Downloader plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Infoway Ebook Downloader)
- [CVE-2025-31892](https://cve.now/CVE-2025-31892.md): WordPress WP Crowdfunding plugin \<= 2.1.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themeum WP Crowdfunding)
- [CVE-2025-31891](https://cve.now/CVE-2025-31891.md): WordPress Gosign – Posts Slider Block plugin \<= 1.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Gosign – Posts Slider Block)
- [CVE-2025-31890](https://cve.now/CVE-2025-31890.md): WordPress Simple Map No Api plugin \<= 1.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Mashi Simple Map No Api)
- [CVE-2025-31888](https://cve.now/CVE-2025-31888.md): WordPress WP Multi Store Locator Plugin \<= 2.5.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WPExperts.io WP Multistore Locator)
- [CVE-2025-31887](https://cve.now/CVE-2025-31887.md): WordPress MyBookProgress plugin \<= 1.0.8 - Broken Access Control vulnerability (CVSS 4.3, zookatron MyBookProgress by Stormhill Media)
- [CVE-2025-31886](https://cve.now/CVE-2025-31886.md): WordPress Social proof testimonials and reviews by Repuso plugin \<= 5.21 - Broken Access Control vulnerability (CVSS 4.3, Social proof testimonials and reviews by Repuso)
- [CVE-2025-31885](https://cve.now/CVE-2025-31885.md): WordPress Hyperlink Group Block plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Daniel Floeter Hyperlink Group Block)
- [CVE-2025-31884](https://cve.now/CVE-2025-31884.md): WordPress Norse Rune Oracle Plugin plugin \<= 1.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP CMS Ninja Norse Rune Oracle Plugin)
- [CVE-2025-31883](https://cve.now/CVE-2025-31883.md): WordPress WebinarPress plugin \<= 1.33.28 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WPWebinarSystem WebinarPress)
- [CVE-2025-31882](https://cve.now/CVE-2025-31882.md): WordPress Webinar Plugin \<= 1.33.28 - Broken Access Control vulnerability (CVSS 4.3, WPWebinarSystem WebinarPress)
- [CVE-2025-31881](https://cve.now/CVE-2025-31881.md): WordPress Pearl plugin \<= 1.3.9 - Broken Access Control vulnerability (CVSS 5.4, Stylemix Pearl)
- [CVE-2025-31880](https://cve.now/CVE-2025-31880.md): WordPress Pearl plugin \<= 1.3.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Stylemix Pearl)
- [CVE-2025-31879](https://cve.now/CVE-2025-31879.md): WordPress Barcode Generator for WooCommerce plugin \<= 2.0.4 - Settings Change vulnerability (CVSS 5.4, Dmitry V. (CEO of "UKR Solution") Barcode Generator for Woo…)
- [CVE-2025-31878](https://cve.now/CVE-2025-31878.md): WordPress UPC/EAN/GTIN Code Generator plugin \<= 2.0.2 - Settings Change vulnerability (CVSS 5.4, Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generat…)
- [CVE-2025-31877](https://cve.now/CVE-2025-31877.md): WordPress RestroPress plugin \<= 3.2.8 - Broken Access Control vulnerability (CVSS 4.3, Magnigenie RestroPress)
- [CVE-2025-31875](https://cve.now/CVE-2025-31875.md): WordPress FancyPost plugin \<= 6.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Pluginic FancyPost)
- [CVE-2025-31874](https://cve.now/CVE-2025-31874.md): WordPress WebberZone Snippetz plugin \<= 2.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ajay WebberZone Snippetz)
- [CVE-2025-31873](https://cve.now/CVE-2025-31873.md): WordPress SheetDB plugin \<= 1.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SheetDB)
- [CVE-2025-31872](https://cve.now/CVE-2025-31872.md): WordPress WP Clone any post type Plugin \<= 3.6 - Broken Access Control vulnerability (CVSS 5.3, Galaxy Weblinks WP Clone any post type)
- [CVE-2025-31871](https://cve.now/CVE-2025-31871.md): WordPress WP Clone any post type Plugin \<= 3.6 - Open Redirect vulnerability (CVSS 4.7, Galaxy Weblinks WP Clone any post type)
- [CVE-2025-31870](https://cve.now/CVE-2025-31870.md): WordPress WP AutoKeyword plugin \<= 1.0 - Arbitrary Content Deletion vulnerability (CVSS 5.4, EXEIdeas International WP AutoKeyword)
- [CVE-2025-31869](https://cve.now/CVE-2025-31869.md): WordPress Black Widgets For Elementor plugin \<= 1.3.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Modernaweb Studio Black Widgets For Elementor)
- [CVE-2025-31868](https://cve.now/CVE-2025-31868.md): WordPress JS Job Manager plugin \<= 2.0.2 - Broken Access Control vulnerability (CVSS 5.3, JoomSky JS Job Manager)
- [CVE-2025-31867](https://cve.now/CVE-2025-31867.md): WordPress JS Job Manager Plugin \<= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, JoomSky JS Job Manager)
- [CVE-2025-31866](https://cve.now/CVE-2025-31866.md): WordPress ShipDepot for WooCommerce plugin \<= 1.2.19 - Broken Access Control vulnerability (CVSS 4.3, Ship Depot ShipDepot for WooCommerce)
- [CVE-2025-31865](https://cve.now/CVE-2025-31865.md): WordPress CartBoss plugin \<= 4.1.2 - Broken Access Control vulnerability (CVSS 4.3, CartBoss)
- [CVE-2025-31864](https://cve.now/CVE-2025-31864.md): WordPress Beam me up Scotty – Back to Top Button plugin \<= 1.0.23 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Out the Box Beam me up Scotty)
- [CVE-2025-31863](https://cve.now/CVE-2025-31863.md): WordPress Agency Toolkit plugin \<= 1.0.24 - Broken Access Control vulnerability (CVSS 5.3, inspry Agency Toolkit)
- [CVE-2025-31862](https://cve.now/CVE-2025-31862.md): WordPress Job Board Manager Plugin \<= 2.1.61 - Broken Access Control vulnerability (CVSS 5.3, PickPlugins Job Board Manager)
- [CVE-2025-31861](https://cve.now/CVE-2025-31861.md): WordPress Perfect Font Awesome Integration Plugin \<= 2.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPOrbit Support Perfect Font Awesome Integration)
- [CVE-2025-31860](https://cve.now/CVE-2025-31860.md): WordPress WP AdCenter plugin \<= 2.5.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPeka WP AdCenter)
- [CVE-2025-31859](https://cve.now/CVE-2025-31859.md): WordPress Feedbucket – Website Feedback Tool Plugin \<= 1.0.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Feedbucket – Website Feedback Tool)
- [CVE-2025-31857](https://cve.now/CVE-2025-31857.md): WordPress Directorist AddonsKit for Elementor plugin \<= 1.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpWax Directorist AddonsKit for Elementor)
- [CVE-2025-31856](https://cve.now/CVE-2025-31856.md): WordPress Export All Post Meta Plugin \<= 1.2.1 - Broken Access Control vulnerability (CVSS 4.3, brainvireinfo Export All Post Meta)
- [CVE-2025-31855](https://cve.now/CVE-2025-31855.md): WordPress SMM API plugin \<= 6.0.31 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, softnwords SMM API)
- [CVE-2025-31854](https://cve.now/CVE-2025-31854.md): WordPress Simple Sticky Add To Cart For WooCommerce plugin \<= 1.4.9 - Broken Access Control vulnerability (CVSS 4.3, Sharaz Shahid Simple Sticky Add To Cart For WooCommerce)
- [CVE-2025-31853](https://cve.now/CVE-2025-31853.md): WordPress Smartarget Popup Plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Erez Hadas-Sonnenschein Smartarget Popup)
- [CVE-2025-31852](https://cve.now/CVE-2025-31852.md): WordPress Bulk Product Sync plugin \<= 8.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, N-Media Bulk Product Sync)
- [CVE-2025-31851](https://cve.now/CVE-2025-31851.md): WordPress Beds24 Online Booking plugin \<= 2.0.27 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, markkinchin Beds24 Online Booking)
- [CVE-2025-31850](https://cve.now/CVE-2025-31850.md): WordPress PDF Generator Addon for Elementor Page Builder plugin \<= 2.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RedefiningTheWeb PDF Generator Addon for Elementor Page Bui…)
- [CVE-2025-31849](https://cve.now/CVE-2025-31849.md): WordPress Nemesis All-in-One plugin \<= 1.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, fbtemplates Nemesis All-in-One)
- [CVE-2025-31848](https://cve.now/CVE-2025-31848.md): WordPress WordPress Adverts Plugin plugin \<= 1.4 - Broken Access Control vulnerability (CVSS 5.3, WPFactory Adverts)
- [CVE-2025-31847](https://cve.now/CVE-2025-31847.md): WordPress mFolio Lite plugin \<= 1.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, themelooks mFolio Lite)
- [CVE-2025-31846](https://cve.now/CVE-2025-31846.md): WordPress Theater for WordPress plugin \<= 0.18.7 - Broken Access Control vulnerability (CVSS 4.3, Jeroen Schmit Theater for WordPress)
- [CVE-2025-31845](https://cve.now/CVE-2025-31845.md): WordPress Theme Duplicator Plugin \<= 1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Rohit Choudhary Theme Duplicator)
- [CVE-2025-31844](https://cve.now/CVE-2025-31844.md): WordPress Magical Blocks plugin \<= 1.0.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Noor Alam Magical Blocks)
- [CVE-2025-31843](https://cve.now/CVE-2025-31843.md): WordPress OpenAI Tools for WordPress & WooCommerce plugin \<= 2.2.1 - Broken Access Control vulnerability (CVSS 4.3, Wilson OpenAI Tools for WordPress & WooCommerce)
- [CVE-2025-31842](https://cve.now/CVE-2025-31842.md): WordPress Viral Loops WP Integration Plugin \<= 3.4.0 - Sensitive Data Exposure vulnerability (CVSS 5.3, viralloops Viral Loops WP Integration)
- [CVE-2025-31840](https://cve.now/CVE-2025-31840.md): WordPress Simple Fixed Notice Plugin \<= 1.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, digireturn Simple Fixed Notice)
- [CVE-2025-31839](https://cve.now/CVE-2025-31839.md): WordPress Footer Contacts Bar plugin \<= 1.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, digireturn DN Footer Contacts)
- [CVE-2025-31838](https://cve.now/CVE-2025-31838.md): WordPress Eventbee RSVP Widget plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Eventbee RSVP Widget)
- [CVE-2025-31837](https://cve.now/CVE-2025-31837.md): WordPress WP Proposals plugin \<= 2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WP Codeus WP Proposals)
- [CVE-2025-31836](https://cve.now/CVE-2025-31836.md): WordPress Review Manager plugin \<= 2.5.0 - Broken Access Control vulnerability (CVSS 5.3, matthewrubin Review Manager)
- [CVE-2025-31835](https://cve.now/CVE-2025-31835.md): WordPress WP Plugin Info Card plugin \<= 5.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Brice Capobianco WP Plugin Info Card)
- [CVE-2025-31834](https://cve.now/CVE-2025-31834.md): WordPress JobBoard Job listing plugin Plugin \<= 1.2.8 - Broken Access Control vulnerability (CVSS 5.3, themeglow JobBoard Job listing)
- [CVE-2025-31833](https://cve.now/CVE-2025-31833.md): WordPress JobBoard Job listing plugin Plugin \<= 1.2.8 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.9, themeglow JobBoard Job listing)
- [CVE-2025-31832](https://cve.now/CVE-2025-31832.md): WordPress ACF City Selector plugin \<= 1.17.0 - Sensitive Data Exposure vulnerability (CVSS 5.3, Beee ACF City Selector)
- [CVE-2025-31831](https://cve.now/CVE-2025-31831.md): WordPress AtomChat plugin \<= 1.1.7 - Broken Access Control vulnerability (CVSS 4.3, Team AtomChat AtomChat)
- [CVE-2025-31830](https://cve.now/CVE-2025-31830.md): WordPress Printus Plugin \<= 1.2.6 - Broken Access Control vulnerability (CVSS 4.3, Uriahs Victor Printus)
- [CVE-2025-31829](https://cve.now/CVE-2025-31829.md): WordPress ShopCred plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, devscred ShopCred)
- [CVE-2025-31828](https://cve.now/CVE-2025-31828.md): WordPress Easy!Appointments plugin \<= 1.4.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, alextselegidis Easy!Appointments)
- [CVE-2025-31826](https://cve.now/CVE-2025-31826.md): WordPress Ni WooCommerce Cost Of Goods plugin \<= 3.2.8 - Broken Access Control vulnerability (CVSS 5.4, Anzar Ahmed Ni WooCommerce Cost Of Goods)
- [CVE-2025-31824](https://cve.now/CVE-2025-31824.md): WordPress WP Optin Wheel Plugin \<= 1.4.7 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, Wombat Plugins WP Optin Wheel)
- [CVE-2025-31823](https://cve.now/CVE-2025-31823.md): WordPress WPoperation Elementor Addons plugin 1.1.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpoperations WPoperation Elementor Addons)
- [CVE-2025-31822](https://cve.now/CVE-2025-31822.md): WordPress WordPress Simple HTML Sitemap plugin \<= 3.4 - Broken Access Control vulnerability (CVSS 5.3, Ashish Ajani WP Simple HTML Sitemap)
- [CVE-2025-31821](https://cve.now/CVE-2025-31821.md): WordPress Integration of Zoho CRM and Contact Form 7 plugin \<= 1.0.6 - Open Redirection Vulnerability (CVSS 4.7, formsintegrations Integration of Zoho CRM and Contact Form)
- [CVE-2025-31820](https://cve.now/CVE-2025-31820.md): WordPress Automatic Featured Images from Videos plugin \<= 1.2.4 - Broken Access Control vulnerability (CVSS 4.3, webdevstudios Automatic Featured Images from Videos)
- [CVE-2025-31818](https://cve.now/CVE-2025-31818.md): WordPress ContentBot AI Writer plugin \<= 1.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ContentBot.ai ContentBot AI Writer)
- [CVE-2025-31817](https://cve.now/CVE-2025-31817.md): WordPress BlockWheels plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPWheels BlockWheels)
- [CVE-2025-31816](https://cve.now/CVE-2025-31816.md): WordPress Mobile App Canvas Plugin \<= 3.8.2 - Broken Access Control vulnerability (CVSS 5.4, pietro Mobile App Canvas)
- [CVE-2025-31815](https://cve.now/CVE-2025-31815.md): WordPress Design Blocks plugin \<= 1.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, devscred Design Blocks)
- [CVE-2025-31814](https://cve.now/CVE-2025-31814.md): WordPress OwnerRez Plugin \<= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, OwnerRez API)
- [CVE-2025-31813](https://cve.now/CVE-2025-31813.md): WordPress WPSHARE247 Elementor Addons plugin \<= 2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Website366.com WPSHARE247 Elementor Addons)
- [CVE-2025-31812](https://cve.now/CVE-2025-31812.md): WordPress BuddyPress Members Only plugin \<= 3.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tomas BuddyPress Members Only)
- [CVE-2025-31811](https://cve.now/CVE-2025-31811.md): WordPress Planyo online reservation system plugin \<= 3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, xtreeme Planyo online reservation system)
- [CVE-2025-31810](https://cve.now/CVE-2025-31810.md): WordPress Question Answer plugin \<= 1.2.73 - Broken Access Control vulnerability (CVSS 5.3, PickPlugins Question Answer)
- [CVE-2025-31809](https://cve.now/CVE-2025-31809.md): WordPress Labinator Content Types Duplicator Plugin \<= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Labinator Content Types Duplicator)
- [CVE-2025-31808](https://cve.now/CVE-2025-31808.md): WordPress SCSS WP Editor plugin \<= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, IT Path Solutions SCSS WP Editor)
- [CVE-2025-31807](https://cve.now/CVE-2025-31807.md): WordPress Product Notices for WooCommerce plugin \<= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, CloudRedux Product Notices for WooCommerce)
- [CVE-2025-31806](https://cve.now/CVE-2025-31806.md): WordPress Webling plugin \<= 3.9.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, uSystems Webling)
- [CVE-2025-31805](https://cve.now/CVE-2025-31805.md): WordPress Gutena Kit plugin \<= 2.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Saad Iqbal Gutena Kit – Gutenberg Blocks and Templates)
- [CVE-2025-31804](https://cve.now/CVE-2025-31804.md): WordPress Follow Us Badges plugin \<= 3.1.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DraftPress Team Follow Us Badges)
- [CVE-2025-31803](https://cve.now/CVE-2025-31803.md): WordPress Turisbook Booking System plugin \<= 1.3.8 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Neteuro Turisbook Booking System)
- [CVE-2025-31802](https://cve.now/CVE-2025-31802.md): WordPress Shiptimize for WooCommerce plugin \<= 3.1.86 - Settings Change vulnerability (CVSS 5.4, Shiptimize for WooCommerce)
- [CVE-2025-31801](https://cve.now/CVE-2025-31801.md): WordPress MX Time Zone Clocks plugin \<= 5.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Maksym Marko MX Time Zone Clocks)
- [CVE-2025-31799](https://cve.now/CVE-2025-31799.md): WordPress Publitio plugin \<= 2.1.8 - Broken Access Control vulnerability (CVSS 4.3, Publitio)
- [CVE-2025-31798](https://cve.now/CVE-2025-31798.md): WordPress Publitio Plugin \<= 2.1.8 - Broken Access Control vulnerability (CVSS 4.3, Publitio)
- [CVE-2025-31797](https://cve.now/CVE-2025-31797.md): WordPress Sprout Clients plugin \<= 3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BoldGrid Sprout Clients)
- [CVE-2025-31796](https://cve.now/CVE-2025-31796.md): WordPress ElementsCSS Addons for Elementor plugin \<= 1.0.8.9 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, TheInnovs ElementsCSS Addons for Elementor)
- [CVE-2025-31793](https://cve.now/CVE-2025-31793.md): WordPress Piotnet Forms plugin \<= 1.0.30 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, piotnetdotcom Piotnet Forms)
- [CVE-2025-31792](https://cve.now/CVE-2025-31792.md): WordPress Piotnet Forms plugin \<= 1.0.30 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, piotnetdotcom Piotnet Forms)
- [CVE-2025-31791](https://cve.now/CVE-2025-31791.md): WordPress Pin Generator Plugin \<= 2.0.0 - Broken Access Control vulnerability (CVSS 5.4, Oliver Boyers Pin Generator)
- [CVE-2025-31790](https://cve.now/CVE-2025-31790.md): WordPress Posten plugin \<= 0.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Binsaifullah Posten)
- [CVE-2025-31788](https://cve.now/CVE-2025-31788.md): WordPress AIO Performance Profiler, Monitor, Optimize, Compress & Debug plugin \<= 1.3 - Sensitive Data Exposure vulnerability (CVSS 5.3, Smackcoders Inc., AIO Performance Profiler, Monitor, Optimi…)
- [CVE-2025-31787](https://cve.now/CVE-2025-31787.md): WordPress Cue by AudioTheme.com plugin \<= 2.4.4 - Broken Access Control vulnerability (CVSS 4.3, AudioTheme Cue)
- [CVE-2025-31786](https://cve.now/CVE-2025-31786.md): WordPress Simple Icons plugin \<= 2.8.4 - Broken Access Control vulnerability (CVSS 5.3, Travis Simple Icons)
- [CVE-2025-31785](https://cve.now/CVE-2025-31785.md): WordPress Clearbit Reveal plugin \<= 1.0.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Clearbit Reveal)
- [CVE-2025-31784](https://cve.now/CVE-2025-31784.md): WordPress Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more Plugin \<= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Rudy Susanto Embed Extended)
- [CVE-2025-31783](https://cve.now/CVE-2025-31783.md): WordPress Leartes TRY Exchange Rates Plugin \<= 2.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Leartes.NET Leartes TRY Exchange Rates)
- [CVE-2025-31782](https://cve.now/CVE-2025-31782.md): WordPress mb.YTPlayer plugin \<= 3.3.8 - Broken Access Control vulnerability (CVSS 5.4, pupunzi mb.YTPlayer)
- [CVE-2025-31781](https://cve.now/CVE-2025-31781.md): WordPress Gift Cards for WooCommerce plugin \<= 1.5.8 - Broken Access Control vulnerability (CVSS 4.3, ahmadshyk Gift Cards for WooCommerce)
- [CVE-2025-31780](https://cve.now/CVE-2025-31780.md): WordPress Append Content plugin \<= 2.1.1 - CSRF to Settings Change vulnerability (CVSS 6.5, Andy Stratton Append Content)
- [CVE-2025-31779](https://cve.now/CVE-2025-31779.md): WordPress Query Wrangler plugin \<= 1.5.54 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Jonathan Daggerhart Query Wrangler)
- [CVE-2025-31778](https://cve.now/CVE-2025-31778.md): WordPress Donate Me Plugin \<= 1.2.5 - Stored Cross-Site Scripting vulnerability (CVSS 6.5, raphaelheide Donate Me)
- [CVE-2025-31777](https://cve.now/CVE-2025-31777.md): WordPress Clockinator Lite plugin \<= 1.0.9 - Broken Access Control vulnerability (CVSS 5.3, BeastThemes Clockinator Lite)
- [CVE-2025-31776](https://cve.now/CVE-2025-31776.md): WordPress Uptime Robot Plugin \<= 2.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Aphotrax Uptime Robot Plugin for WordPress)
- [CVE-2025-31775](https://cve.now/CVE-2025-31775.md): WordPress Google SEO Pressor for Rich snippets Plugin \<= 2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Smackcoders Inc., Google SEO Pressor Snippet)
- [CVE-2025-31774](https://cve.now/CVE-2025-31774.md): WordPress plugin Astra Security Suite plugin\<= 0.2 - Broken Access Control vulnerability (CVSS 5.3, WebProtect.ai Astra Security Suite)
- [CVE-2025-31773](https://cve.now/CVE-2025-31773.md): WordPress Ship Per Product plugin \<= 2.1.0 - Broken Access Control vulnerability (CVSS 5.3, cedcommerce Ship Per Product)
- [CVE-2025-31772](https://cve.now/CVE-2025-31772.md): WordPress WP Modal Popup with Cookie Integration plugin \<= 2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Astoundify WP Modal Popup with Cookie Integration)
- [CVE-2025-31771](https://cve.now/CVE-2025-31771.md): WordPress Team Members for Elementor Page Builder plugin \<= 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sultan Nasir Uddin Team Members for Elementor Page Builder)
- [CVE-2025-31770](https://cve.now/CVE-2025-31770.md): WordPress Content Manager Light plugin \<= 3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, OTWthemes Content Manager Light)
- [CVE-2025-31769](https://cve.now/CVE-2025-31769.md): WordPress CLP – Custom Login Page by NiteoThemes plugin \<= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, CLP – Custom Login Page by NiteoThemes)
- [CVE-2025-31767](https://cve.now/CVE-2025-31767.md): WordPress Post Custom Templates Lite plugin \<= 1.14 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, OTWthemes Post Custom Templates Lite)
- [CVE-2025-31766](https://cve.now/CVE-2025-31766.md): WordPress PhotoShelter for Photographers Blog Feed plugin \<= 1.5.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PhotoShelter for Photographers Blog Feed Plugin)
- [CVE-2025-31765](https://cve.now/CVE-2025-31765.md): WordPress GDPR Cookie Notice plugin \<= 1.2.0 - Broken Access Control vulnerability (CVSS 5.3, themeqx GDPR Cookie Notice)
- [CVE-2025-31764](https://cve.now/CVE-2025-31764.md): WordPress Cache control by Cacholong plugin \<= 5.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Preliot Cache control by Cacholong)
- [CVE-2025-31763](https://cve.now/CVE-2025-31763.md): WordPress Cache control by Cacholong Plugin \<= 5.4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Preliot Cache control by Cacholong)
- [CVE-2025-31762](https://cve.now/CVE-2025-31762.md): WordPress Sheet2Site plugin \<= 1.0.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, andreyazimov Sheet2Site)
- [CVE-2025-31761](https://cve.now/CVE-2025-31761.md): WordPress Hypotext plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DEJAN Hypotext)
- [CVE-2025-31760](https://cve.now/CVE-2025-31760.md): WordPress SnapWidget Social Photo Feed Widget plugin \<= 1.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SnapWidget Social Photo Feed Widget)
- [CVE-2025-31759](https://cve.now/CVE-2025-31759.md): WordPress Boo Recipes plugin \<= 2.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BooSpot Boo Recipes)
- [CVE-2025-31757](https://cve.now/CVE-2025-31757.md): WordPress Free Woocommerce Product Table View plugin \<= 1.78 - Broken Access Control vulnerability (CVSS 5.4, BinaryCarpenter Free Woocommerce Product Table View)
- [CVE-2025-31756](https://cve.now/CVE-2025-31756.md): WordPress TZ PlusGallery Plugin \<= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, tuyennv TZ PlusGallery)
- [CVE-2025-31755](https://cve.now/CVE-2025-31755.md): WordPress pCloud Backup plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 4.3, josselynj pCloud Backup)
- [CVE-2025-31754](https://cve.now/CVE-2025-31754.md): WordPress DobsonDev Shortcodes plugin \<= 2.1.12 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DobsonDev Shortcodes)
- [CVE-2025-31752](https://cve.now/CVE-2025-31752.md): WordPress Bulk Fields Editor plugin \<= 1.8.0 - Broken Access Control vulnerability (CVSS 4.3, termel Bulk Fields Editor)
- [CVE-2025-31751](https://cve.now/CVE-2025-31751.md): WordPress Breaking News WP Plugin \<= 1.3 - CSRF to Settings Change vulnerability (CVSS 6.5, doit Breaking News WP)
- [CVE-2025-31750](https://cve.now/CVE-2025-31750.md): WordPress Breaking News WP Plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, doit Breaking News WP)
- [CVE-2025-31749](https://cve.now/CVE-2025-31749.md): WordPress HMH Footer Builder For Elementor plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPelite HMH Footer Builder For Elementor)
- [CVE-2025-31748](https://cve.now/CVE-2025-31748.md): WordPress Opal Portfolio Plugin \<= 1.0.4 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpopal Opal Portfolio)
- [CVE-2025-31747](https://cve.now/CVE-2025-31747.md): WordPress WP Chrono plugin \<= 1.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, milan.latinovic WP Chrono)
- [CVE-2025-31745](https://cve.now/CVE-2025-31745.md): WordPress Subscription Form for Feedblitz Plugin \<= 1.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Arni Cinco Subscription Form for Feedblitz)
- [CVE-2025-31744](https://cve.now/CVE-2025-31744.md): WordPress Lightweight and Responsive Youtube Embed plugin \<= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpszaki Lightweight and Responsive Youtube Embed)
- [CVE-2025-31743](https://cve.now/CVE-2025-31743.md): WordPress Lightweight and Responsive Youtube Embed Plugin \<= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpszaki Lightweight and Responsive Youtube Embed)
- [CVE-2025-31742](https://cve.now/CVE-2025-31742.md): WordPress Dima Take Action Plugin \<= 1.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, PixelDima Dima Take Action)
- [CVE-2025-31741](https://cve.now/CVE-2025-31741.md): WordPress Easy Magazine plugin \<= 2.1.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Filtr8 Easy Magazine)
- [CVE-2025-31740](https://cve.now/CVE-2025-31740.md): WordPress News, Magazine and Blog Elements Plugin \<= 1.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, aThemeArt News, Magazine and Blog Elements)
- [CVE-2025-31738](https://cve.now/CVE-2025-31738.md): WordPress LeadQuizzes Plugin \<= 1.1.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, yazamodeveloper LeadQuizzes)
- [CVE-2025-31737](https://cve.now/CVE-2025-31737.md): WordPress Client Showcase plugin \<= 1.2.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, dxladner Client Showcase)
- [CVE-2025-31735](https://cve.now/CVE-2025-31735.md): WordPress Footnotes for WordPress plugin \<= 2016.1230 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, C. Johnson Footnotes for WordPress)
- [CVE-2025-31734](https://cve.now/CVE-2025-31734.md): WordPress Simple Post Expiration plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Syed Balkhi Simple Post Expiration)
- [CVE-2025-31733](https://cve.now/CVE-2025-31733.md): WordPress WP Sitemap Plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Boot Div WP Sitemap)
- [CVE-2025-31732](https://cve.now/CVE-2025-31732.md): WordPress GB Gallery Slideshow plugin \<= 1.3 - Broken Access Control vulnerability (CVSS 4.3, gb-plugins GB Gallery Slideshow)
- [CVE-2025-31731](https://cve.now/CVE-2025-31731.md): WordPress Author Bio Shortcode Plugin \<= 2.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Philip John Author Bio Shortcode)
- [CVE-2025-31730](https://cve.now/CVE-2025-31730.md): WordPress Marketer Addons Plugin \<= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DigitalCourt Marketer Addons)
- [CVE-2025-30676](https://cve.now/CVE-2025-30676.md): Apache OFBiz: Stored XSS Vulnerability (CVSS 6.1, Apache Software Foundation Apache OFBiz)
- [CVE-2025-30224](https://cve.now/CVE-2025-30224.md): MyDumper arbitrary file read issue (CVSS 5.1, mydumper)
- [CVE-2025-30354](https://cve.now/CVE-2025-30354.md): Bruno ignores Safe-Mode in Asserts expressions (CVSS 8.7, usebruno bruno)
- [CVE-2025-30210](https://cve.now/CVE-2025-30210.md): Bruno XSS On Environment Name (CVSS 8.7, usebruno bruno)
- [CVE-2025-31408](https://cve.now/CVE-2025-31408.md): WordPress Zoho Flow plugin \<= 2.13.3 - Broken Access Control vulnerability (CVSS 4.3, Zoho Flow)
- [CVE-2025-22231](https://cve.now/CVE-2025-22231.md): VMware Aria Operations updates address a local privilege escalation vulnerability (CVE-2025-22231) (CVSS 7.8, VMware Aria operations)
- [CVE-2025-1660](https://cve.now/CVE-2025-1660.md): DWFX File Parsing Memory Corruption Vulnerability (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2025-3035](https://cve.now/CVE-2025-3035.md): Tab title disclosure across pages when using AI chatbot (CVSS 5.3, Mozilla Firefox)
- [CVE-2025-3034](https://cve.now/CVE-2025-3034.md): Memory safety bugs fixed in Firefox 137 and Thunderbird 137 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-3033](https://cve.now/CVE-2025-3033.md): Opening local .url files could lead to another file being opened (CVSS 7.7, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-3032](https://cve.now/CVE-2025-3032.md): Leaking file descriptors from the fork server (CVSS 7.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-3031](https://cve.now/CVE-2025-3031.md): JIT optimization bug with different stack slot sizes (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-3030](https://cve.now/CVE-2025-3030.md): Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-3029](https://cve.now/CVE-2025-3029.md): URL Bar Spoofing via non-BMP Unicode characters (CVSS 7.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-3028](https://cve.now/CVE-2025-3028.md): Use-after-free triggered by XSLTProcessor (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1659](https://cve.now/CVE-2025-1659.md): DWFX File Parsing Out-of-Bounds Read Vulnerability (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2025-1658](https://cve.now/CVE-2025-1658.md): DWFX File Parsing Out-of-Bounds Read Vulnerability (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2025-3085](https://cve.now/CVE-2025-3085.md): MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked (CVSS 8.1, MongoDB Server)
- [CVE-2025-30177](https://cve.now/CVE-2025-30177.md): Apache Camel: Camel-Undertow Message Header Injection via Improper Filtering (CVSS 6.5, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2025-3084](https://cve.now/CVE-2025-3084.md): MongoDB Server may crash due to improper validation of explain command (CVSS 6.5, MongoDB Server)
- [CVE-2025-3083](https://cve.now/CVE-2025-3083.md): Malformed MongoDB wire protocol messages may cause mongos to crash (CVSS 7.5, MongoDB Server)
- [CVE-2025-2237](https://cve.now/CVE-2025-2237.md): WP RealEstate \<= 1.6.26 - Unauthenticated Privilege Escalation via 'process\_register' (CVSS 9.8, ApusThemes WP RealEstate)
- [CVE-2024-13553](https://cve.now/CVE-2024-13553.md): SMS Alert Order Notifications – WooCommerce \<= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation (CVSS 9.8, cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…)
- [CVE-2025-2906](https://cve.now/CVE-2025-2906.md): Contempo Real Estate Core \<= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, contempoinc Contempo Real Estate Core)
- [CVE-2025-3082](https://cve.now/CVE-2025-3082.md): User may override a view's collation and gain unauthorized access to underlying data (CVSS 3.1, MongoDB Server)
- [CVE-2024-56325](https://cve.now/CVE-2024-56325.md): Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required (CVSS 9.8, Apache Software Foundation Apache Pinot · org.apache.pin… +2)
- [CVE-2025-27130](https://cve.now/CVE-2025-27130.md): Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. (CVSS 6.3, Welcart e-Commerce)
- [CVE-2025-29868](https://cve.now/CVE-2025-29868.md): Apache Answer: Using externally referenced images can leak user privacy. (CVSS 6.5, Apache Software Foundation Apache Answer · github.com/apach…)
- [CVE-2025-30065](https://cve.now/CVE-2025-30065.md): Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata (CVSS 10.0, Apache Software Foundation Apache Parquet Java · org.apache…)
- [CVE-2025-2891](https://cve.now/CVE-2025-2891.md): WP Pro Real Estate 7 \<= 3.5.4 - Authenticated (Custom) Arbitrary File Upload (CVSS 8.8, contempoinc Real Estate 7 WordPress)
- [CVE-2025-27427](https://cve.now/CVE-2025-27427.md): Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission (CVSS 2.3, Apache Software Foundation Apache ActiveMQ Artemis · org.ap…)
- [CVE-2025-1512](https://cve.now/CVE-2025-1512.md): PowerPack Elementor Addons (Free Widgets, Extensions and Templates) \<= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ideaboxcreations PowerPack Addons for Elementor)
- [CVE-2025-1267](https://cve.now/CVE-2025-1267.md): Groundhogg \<= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter (CVSS 5.5, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2024-12189](https://cve.now/CVE-2024-12189.md): WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder \<= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, posimyththemes WDesignKit – Elementor & Gutenberg Starter T…)
- [CVE-2024-12278](https://cve.now/CVE-2024-12278.md): Booster for WooCommerce \<= 7.2.4 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, pluggabl Booster for WooCommerce – PDF Invoices, Abandoned…)
- [CVE-2025-2048](https://cve.now/CVE-2025-2048.md): Lana Downloads Manager \< 1.10.0 - Admin+ Arbitrary File Download via Path Traversal (CVSS 4.1, Lana Downloads Manager)
- [CVE-2025-1986](https://cve.now/CVE-2025-1986.md): Gutentor \< 3.4.7 - Admin+ SQL Injection (CVSS 4.1, Gutentor)
- [CVE-2025-31409](https://cve.now/CVE-2025-31409.md): WordPress Bridge Core plugin \< 3.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, NotFound Bridge Core)
- [CVE-2025-31024](https://cve.now/CVE-2025-31024.md): WordPress RJ Quickcharts plugin \<= 0.6.1 - SQL Injection vulnerability (CVSS 8.5, randyjensen RJ Quickcharts)
- [CVE-2025-31001](https://cve.now/CVE-2025-31001.md): WordPress GTM Kit plugin \<= 2.4.0 - Sensitive Data Exposure vulnerability (CVSS 7.5, TLA Media GTM Kit)
- [CVE-2025-30971](https://cve.now/CVE-2025-30971.md): WordPress XV Random Quotes plugin \<= 2.0.0 - SQL Injection vulnerability (CVSS 9.3, Xavi Ivars XV Random Quotes)
- [CVE-2025-22277](https://cve.now/CVE-2025-22277.md): WordPress Vitepos plugin \<= 3.1.4 - Broken Authentication vulnerability (CVSS 8.8, appsbd Vitepos)
- [CVE-2025-31415](https://cve.now/CVE-2025-31415.md): WordPress YayExtra \<= 1.5.2 - Broken Access Control Vulnerability (CVSS 7.6, YayCommerce YayExtra)
- [CVE-2025-31095](https://cve.now/CVE-2025-31095.md): WordPress Material Dashboard plugin \<= 1.4.5 - Privilege Escalation Vulnerability (CVSS 9.8, Hossein Material Dashboard)
- [CVE-2025-31087](https://cve.now/CVE-2025-31087.md): WordPress Multiple Shipping And Billing Address For Woocommerce plugin \<= 1.5 - PHP Object Injection Vulnerability (CVSS 9.8, silverplugins217 Multiple Shipping And Billing Address For…)
- [CVE-2025-31084](https://cve.now/CVE-2025-31084.md): WordPress Sunshine Photo Cart plugin \<= 3.4.10 - PHP Object Injection Vulnerability (CVSS 9.8, sunshinephotocart Sunshine Photo Cart)
- [CVE-2025-31074](https://cve.now/CVE-2025-31074.md): WordPress MDJM Event Management plugin \<= 1.7.5.2 - PHP Object Injection vulnerability (CVSS 8.8, MDJM Mobile DJ Manager)
- [CVE-2025-30926](https://cve.now/CVE-2025-30926.md): WordPress King Addons for Elementor plugin \<= 24.12.58 - Broken Access Control Vulnerability (CVSS 4.3, KingAddons.com King Addons for Elementor)
- [CVE-2025-30924](https://cve.now/CVE-2025-30924.md): WordPress Primer MyData for Woocommerce plugin \< 4.2.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, primersoftware Primer MyData for Woocommerce)
- [CVE-2025-30917](https://cve.now/CVE-2025-30917.md): WordPress SKU Generator for WooCommerce plugin \<= 1.6.2 - Reflected Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, WP Wham SKU Generator for WooCommerce)
- [CVE-2025-30911](https://cve.now/CVE-2025-30911.md): WordPress RomethemeKit For Elementor plugin \<= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerability (CVSS 9.9, Rometheme RTMKit)
- [CVE-2025-30910](https://cve.now/CVE-2025-30910.md): WordPress CM Download Manager plugin \<= 2.9.6 - Arbitrary File Deletion vulnerability (CVSS 8.6, CreativeMindsSolutions CM Download Manager)
- [CVE-2025-30902](https://cve.now/CVE-2025-30902.md): WordPress AEC Kiosque plugin \<= 1.9.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ATL Software SRL AEC Kiosque)
- [CVE-2025-30901](https://cve.now/CVE-2025-30901.md): WordPress JS Help Desk plugin \<= 2.9.2 - Local File Inclusion vulnerability (CVSS 8.1, JoomSky JS Help Desk)
- [CVE-2025-30886](https://cve.now/CVE-2025-30886.md): WordPress JS Help Desk plugin \<= 2.9.2 - SQL Injection vulnerability (CVSS 9.3, JoomSky JS Help Desk)
- [CVE-2025-30882](https://cve.now/CVE-2025-30882.md): WordPress JS Help Desk plugin \<= 2.9.1 - Arbitrary File Download vulnerability (CVSS 7.5, JoomSky JS Help Desk)
- [CVE-2025-30880](https://cve.now/CVE-2025-30880.md): WordPress JS Help Desk plugin \<= 2.9.2 - Broken Access Control vulnerability (CVSS 7.5, JoomSky JS Help Desk)
- [CVE-2025-30878](https://cve.now/CVE-2025-30878.md): WordPress JS Help Desk plugin \<= 2.9.2 - Arbitrary File Deletion vulnerability (CVSS 8.6, JoomSky JS Help Desk)
- [CVE-2025-30876](https://cve.now/CVE-2025-30876.md): WordPress Ads by WPQuads plugin \<= 2.0.87.1 - SQL Injection Vulnerability (CVSS 9.3, Ads by WPQuads)
- [CVE-2025-30870](https://cve.now/CVE-2025-30870.md): WordPress WP Travel Engine plugin \<= 6.3.5 - Local File Inclusion vulnerability (CVSS 8.1, WP Travel Engine)
- [CVE-2025-30869](https://cve.now/CVE-2025-30869.md): WordPress Image Wall plugin \<= 3.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Parakoos Image Wall)
- [CVE-2025-30849](https://cve.now/CVE-2025-30849.md): WordPress Essential Real Estate plugin \<= 5.2.0 - Local File Inclusion Vulnerability (CVSS 8.1, g5theme Essential Real Estate)
- [CVE-2025-30848](https://cve.now/CVE-2025-30848.md): WordPress Hostel plugin \<= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bob Hostel)
- [CVE-2025-30840](https://cve.now/CVE-2025-30840.md): WordPress xili-dictionary plugin \<= 2.12.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Michel - xiligroup dev xili-dictionary)
- [CVE-2025-30837](https://cve.now/CVE-2025-30837.md): WordPress WooCommerce Fattureincloud plugin \<= 2.6.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Cristiano Zanca WooCommerce Fattureincloud)
- [CVE-2025-30834](https://cve.now/CVE-2025-30834.md): WordPress Bit Assist plugin \<= 1.5.4 - Path Traversal vulnerability (CVSS 7.5, Bit Apps Bit Assist)
- [CVE-2025-30827](https://cve.now/CVE-2025-30827.md): WordPress WP2LEADS plugin \<= 3.4.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Saleswonder Team: Tobias WP2LEADS)
- [CVE-2025-30808](https://cve.now/CVE-2025-30808.md): WordPress About Author plugin \<= 1.6.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Weblizar - WordPress Themes & Plugin About Author)
- [CVE-2025-30802](https://cve.now/CVE-2025-30802.md): WordPress Our Team Members plugin \<= 2.2 - Sensitive Data Exposure vulnerability (CVSS 4.3, WPBean Our Team Members)
- [CVE-2025-30798](https://cve.now/CVE-2025-30798.md): WordPress Better WishList API plugin \<= 1.1.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, rickonline\_nl Better WishList API)
- [CVE-2025-30797](https://cve.now/CVE-2025-30797.md): WordPress Greek Multi Tool – Fix peralinks, accents, auto create menus and more plugin \<= 2.3.1 - Broken Access Control Vulnerability (CVSS 7.5, bigdrop.gr Greek Multi Tool – Fix peralinks, accents, auto…)
- [CVE-2025-30796](https://cve.now/CVE-2025-30796.md): WordPress The Ultimate WordPress Toolkit – WP Extended plugin \<= 3.0.14 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, The Ultimate WordPress Toolkit – WP Extended)
- [CVE-2025-30794](https://cve.now/CVE-2025-30794.md): WordPress Event Tickets plugin \<= 5.20.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, StellarWP Event Tickets)
- [CVE-2025-30793](https://cve.now/CVE-2025-30793.md): WordPress Houzez Property Feed plugin \<= 2.5.4 - Arbitrary File Download Vulnerability (CVSS 7.5, Property Hive Houzez Property Feed)
- [CVE-2025-30782](https://cve.now/CVE-2025-30782.md): WordPress Subscribe to Download Lite plugin \<= 1.2.9 - Local File Inclusion vulnerability (CVSS 7.5, WP Shuffle Subscribe to Download Lite)
- [CVE-2025-30774](https://cve.now/CVE-2025-30774.md): WordPress Quiz Maker plugin \<= 6.6.8.7 - SQL Injection vulnerability (CVSS 8.2, Ays Pro Quiz Maker)
- [CVE-2025-30622](https://cve.now/CVE-2025-30622.md): WordPress PostMash plugin \<= 1.0.3 - SQL Injection Vulnerability (CVSS 9.3, torsteino PostMash)
- [CVE-2025-30614](https://cve.now/CVE-2025-30614.md): WordPress Google Font Fix plugin \<= 2.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Haozhe Xie Google Font Fix)
- [CVE-2025-30613](https://cve.now/CVE-2025-30613.md): WordPress Nmedia MailChimp plugin \<= 5.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, N-Media Nmedia MailChimp)
- [CVE-2025-30607](https://cve.now/CVE-2025-30607.md): WordPress Quick Localization plugin \<= 0.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Name.ly Quick Localization)
- [CVE-2025-30594](https://cve.now/CVE-2025-30594.md): WordPress Include URL plugin \<= 0.3.5 Arbitrary File Download Vulnerability (CVSS 6.5, samsk Include URL)
- [CVE-2025-30589](https://cve.now/CVE-2025-30589.md): WordPress Flickr set slideshows plugin \<= 0.9 - SQL Injection Vulnerability (CVSS 8.5, Dourou Flickr set slideshows)
- [CVE-2025-30579](https://cve.now/CVE-2025-30579.md): WordPress Pesapal Gateway for Woocommerce plugin \<= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jakeii Pesapal Gateway for Woocommerce)
- [CVE-2025-30563](https://cve.now/CVE-2025-30563.md): WordPress Tidekey plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, makong Tidekey)
- [CVE-2025-30559](https://cve.now/CVE-2025-30559.md): WordPress Kento WordPress Stats plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PluginsPoint Kento WordPress Stats)
- [CVE-2025-30548](https://cve.now/CVE-2025-30548.md): WordPress Advanced Post Search plugin \<= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, VarDump s.r.l. Advanced Post Search)
- [CVE-2025-30547](https://cve.now/CVE-2025-30547.md): WordPress WP Cards plugin \<= 1.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, David Tufts WP Cards)
- [CVE-2025-30544](https://cve.now/CVE-2025-30544.md): WordPress OK Poster Group plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, svmidi OK Poster Group)
- [CVE-2025-30520](https://cve.now/CVE-2025-30520.md): WordPress Breezing Forms plugin \<= 1.2.8.11 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, crosstec Breezing Forms)
- [CVE-2025-1665](https://cve.now/CVE-2025-1665.md): Avada Builder \<= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, themefusion Avada (Fusion) Builder)
- [CVE-2024-13567](https://cve.now/CVE-2024-13567.md): Awesome Support – WordPress HelpDesk & Support Plugin \<= 6.3.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 7.5, awesomesupport Awesome Support – WordPress HelpDesk & Suppo…)
- [CVE-2025-2008](https://cve.now/CVE-2025-2008.md): Import Export Suite for CSV and XML Datafeed \<= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, smackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…)
- [CVE-2025-2007](https://cve.now/CVE-2025-2007.md): Import Export Suite for CSV and XML Datafeed \<= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1, smackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…)
- [CVE-2025-0416](https://cve.now/CVE-2025-0416.md): Valmet DNA Local privilege escalation through insecure DCOM configuration (CVSS 8.9, Valmet DNA)
- [CVE-2025-0417](https://cve.now/CVE-2025-0417.md): Valmet DNA Lack of protection against brute force attacks (CVSS 7.0, Valmet DNA)
- [CVE-2025-0418](https://cve.now/CVE-2025-0418.md): Valmet DNA user passwords in plain text (CVSS 5.2, Valmet DNA)
- [CVE-2025-1534](https://cve.now/CVE-2025-1534.md): Cross-site Scripting (Stored) (CVSS 6.8, Payara Platform Payara Server)
- [CVE-2025-3051](https://cve.now/CVE-2025-3051.md): Linux::Statm::Tiny for Perl allows untrusted code to be included from the current working directory (CVSS 6.5, RRWO Linux::Statm::Tiny)
- [CVE-2025-30673](https://cve.now/CVE-2025-30673.md): Sub::HandlesVia for Perl allows untrusted code to be included from the current working directory (CVSS 6.5, TOBYINK Sub::HandlesVia)
- [CVE-2025-30672](https://cve.now/CVE-2025-30672.md): Mite for Perl generates code with an untrusted search path vulnerability (CVSS 6.5, TOBYINK Mite)
- [CVE-2025-21384](https://cve.now/CVE-2025-21384.md): Azure Health Bot Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Azure Health Bot)
- [CVE-2025-3045](https://cve.now/CVE-2025-3045.md): oretnom23/SourceCodester Apartment Visitor Management System remove-apartment.php sql injection (CVSS 5.3, oretnom23 Apartment Visitor Management System · SourceCodes…)
- [CVE-2025-3043](https://cve.now/CVE-2025-3043.md): GuoMinJim PersonManage login preHandle path traversal (CVSS 6.9, GuoMinJim PersonManage)
- [CVE-2025-3042](https://cve.now/CVE-2025-3042.md): Project Worlds Online Time Table Generator updateprofile.php unrestricted upload (CVSS 5.3, Project Worlds Online Time Table Generator)
- [CVE-2003-20001](https://cve.now/CVE-2003-20001.md): An issue was discovered on Mitel ICP VoIP 3100 devices. (CVSS 5.6)
- [CVE-2023-46988](https://cve.now/CVE-2023-46988.md): Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating th (CVSS 6.7)
- [CVE-2025-26054](https://cve.now/CVE-2025-26054.md): Infinxt iEdge 100 2.1.32 is vulnerable to Cross Site Scripting (XSS) via the "Description" field during LAN configuration. (CVSS 5.4)
- [CVE-2025-26055](https://cve.now/CVE-2025-26055.md): An OS Command Injection vulnerability exists in the Infinxt iEdge 100 2.1.32 Troubleshoot module, specifically in the tracertVal parameter o (CVSS 6.5)
- [CVE-2025-26056](https://cve.now/CVE-2025-26056.md): A command injection vulnerability exists in the Infinxt iEdge 100 2.1.32 in the Troubleshoot module "MTR" functionality. (CVSS 5.4)
- [CVE-2025-27829](https://cve.now/CVE-2025-27829.md): An issue was discovered in Stormshield Network Security (SNS) 4.3.x before 4.3.35. (CVSS 7.3)
- [CVE-2025-28131](https://cve.now/CVE-2025-28131.md): A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform ad (CVSS 4.6)
- [CVE-2025-28132](https://cve.now/CVE-2025-28132.md): A session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leadi (CVSS 4.6)
- [CVE-2025-28395](https://cve.now/CVE-2025-28395.md): D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec\_road\_asp function via the host\_ip parameter. (CVSS 7.1)
- [CVE-2025-28398](https://cve.now/CVE-2025-28398.md): D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec\_net\_asp function via the remot\_ip parameter. (CVSS 7.1)
- [CVE-2025-29033](https://cve.now/CVE-2025-29033.md): An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET par (CVSS 7.3)
- [CVE-2025-29036](https://cve.now/CVE-2025-29036.md): An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component. (CVSS 5.9)
- [CVE-2025-29049](https://cve.now/CVE-2025-29049.md): Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary (CVSS 6.3, mathlive)
- [CVE-2025-29069](https://cve.now/CVE-2025-29069.md): A heap buffer overflow vulnerability has been identified in the lcms2-2.16. (CVSS 7.3)
- [CVE-2025-29070](https://cve.now/CVE-2025-29070.md): A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause (CVSS 7.5)
- [CVE-2025-29208](https://cve.now/CVE-2025-29208.md): CodeZips Gym Management System v1.0 is vulnerable to SQL injection in the name parameter within /dashboard/admin/deleteroutine.php. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.