# CVEs published 2025-04-09

194 CVEs were published on April 9, 2025: 13 critical, 99 high. Days are UTC.

- [CVE-2025-32386](https://cve.now/CVE-2025-32386.md): Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination (CVSS 6.5, helm · helm.sh/helm/v3)
- [CVE-2025-32387](https://cve.now/CVE-2025-32387.md): Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow (CVSS 6.5, helm · helm.sh/helm/v3)
- [CVE-2025-24375](https://cve.now/CVE-2025-24375.md): MySQL K8s charm could leak credentials for root-level user \`serverconfig\` (CVSS 5.0, canonical mysql-k8s-operator)
- [CVE-2025-30660](https://cve.now/CVE-2025-30660.md): Junos OS: MX Series: Decapsulation of specific GRE packets leads to PFE reset (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2025-30659](https://cve.now/CVE-2025-30659.md): Junos OS: SRX Series: A device configured for vector routing crashes when receiving malformed traffic (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2025-30658](https://cve.now/CVE-2025-30658.md): Junos OS: SRX Series: On devices with Anti-Virus enabled, malicious server responses will cause memory to leak ultimately causing forwarding to stop (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2025-30657](https://cve.now/CVE-2025-30657.md): Junos OS: Processing of a specific BGP update causes the SRRD process to crash (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2025-30656](https://cve.now/CVE-2025-30656.md): Junos OS: MX Series, SRX Series: Processing of specific SIP INVITE messages by the SIP ALG will lead to an FPC crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2025-30655](https://cve.now/CVE-2025-30655.md): Junos OS and Junos OS Evolved: A specific CLI command will cause an RPD crash when rib-sharding and update-threading is enabled (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2025-30654](https://cve.now/CVE-2025-30654.md): Junos OS and Junos OS Evolved: A local, low privileged user can access sensitive information (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2025-30653](https://cve.now/CVE-2025-30653.md): Junos OS and Junos OS Evolved: LSP flap in a specific MPLS scenario leads to rpd crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2025-30652](https://cve.now/CVE-2025-30652.md): Junos OS and Junos OS Evolved: Executing a specific CLI command when asregex-optimized is configured causes an rpd crash (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2025-30651](https://cve.now/CVE-2025-30651.md): Junos OS and Junos OS Evolved: Receipt of a specific ICMPv6 packet causes a memory overrun leading to an rpd crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2025-30649](https://cve.now/CVE-2025-30649.md): Junos OS: MX240, MX480, MX960 with SPC3: An attacker sending specific packets will cause a CPU utilization DoS. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2025-30648](https://cve.now/CVE-2025-30648.md): Junos OS and Junos OS Evolved: Receipt of a specifically malformed DHCP packet causes jdhcpd process to crash (CVSS 7.4, Juniper Networks Junos OS)
- [CVE-2025-30647](https://cve.now/CVE-2025-30647.md): Junos OS: MX Series: Subscriber login/logout activity will lead to a memory leak (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2025-30646](https://cve.now/CVE-2025-30646.md): Junos OS and Junos OS Evolved: Receipt of a malformed LLDP TLV results in l2cpd crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2025-30645](https://cve.now/CVE-2025-30645.md): Junos OS: SRX Series: Transmission of specific control traffic sent out of a DS-Lite tunnel results in flowd crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2025-30644](https://cve.now/CVE-2025-30644.md): Junos OS: EX2300, EX3400, EX4000 Series, QFX5k Series: Receipt of a specific DHCP packet causes FPC crash when DHCP Option 82 is enabled (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2025-21601](https://cve.now/CVE-2025-21601.md): Junos OS: SRX and EX Series, MX240, MX480, MX960, QFX5120 Series: When web management is enabled for specific services an attacker may cause a CPU spike by sending genuine packets to the device (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2025-21597](https://cve.now/CVE-2025-21597.md): Junos OS and Junos OS Evolved: When BGP rib-sharding and update-threading are configured and a peer flaps, an rpd core is observed (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2025-21595](https://cve.now/CVE-2025-21595.md): Junos OS and Junos OS Evolved: In an EVPN-VXLAN scenario specific ARP or NDP packets cause FPC to crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2025-21594](https://cve.now/CVE-2025-21594.md): Junos OS: MX Series: In DS-lite and NAT scenario receipt of crafted IPv6 traffic causes port block (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2025-21591](https://cve.now/CVE-2025-21591.md): Junos OS: An unauthenticated adjacent attacker sending a malformed DHCP packet causes jdhcpd to crash (CVSS 7.4, Juniper Networks Junos OS)
- [CVE-2025-26888](https://cve.now/CVE-2025-26888.md): WordPress WooCommerce Multilingual & Multicurrency plugin \<= 5.3.8 - Broken Access Control vulnerability (CVSS 5.3, Amir Helzer WooCommerce Multilingual & Multicurrency)
- [CVE-2025-26902](https://cve.now/CVE-2025-26902.md): WordPress Brizy Pro plugin \<= 2.6.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Brizy Pro)
- [CVE-2025-26901](https://cve.now/CVE-2025-26901.md): WordPress Brizy Pro plugin \<= 2.6.1 - Broken Access Control vulnerability (CVSS 4.3, Brizy Pro)
- [CVE-2025-2632](https://cve.now/CVE-2025-2632.md): Out of Bounds Write Vulnerability in NI LabVIEW reading CPU info from cache (CVSS 8.5, NI LabVIEW)
- [CVE-2025-2631](https://cve.now/CVE-2025-2631.md): Out of Bounds Write Vulnerability in NI LabVIEW in InitCPUInformation() (CVSS 7.8, NI LabVIEW)
- [CVE-2025-2630](https://cve.now/CVE-2025-2630.md): DLL Hijacking Vulnerability in NI LabVIEW (CVSS 7.0, NI LabVIEW)
- [CVE-2025-2629](https://cve.now/CVE-2025-2629.md): DLL Hijacking Vulnerability in NI LabVIEW When Loading NI Error Reporting (CVSS 7.0, NI LabVIEW)
- [CVE-2025-3115](https://cve.now/CVE-2025-3115.md): Spotfire Data Function Vulnerability (CVSS 9.4, Spotfire Statistics Services · Spotfire Analyst +6)
- [CVE-2025-3474](https://cve.now/CVE-2025-3474.md): Panels - Critical - Access bypass - SA-CONTRIB-2025-033 (CVSS 6.5, Drupal Panels · drupal/panels)
- [CVE-2025-3131](https://cve.now/CVE-2025-3131.md): ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031 (CVSS 5.4, Drupal ECA: Event - Condition - Action · drupal/eca)
- [CVE-2025-3475](https://cve.now/CVE-2025-3475.md): WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030 (CVSS 6.5, Drupal WEB-T · drupal/webt)
- [CVE-2025-3114](https://cve.now/CVE-2025-3114.md): Spotfire Code Execution Vulnerability (CVSS 9.4, Spotfire Enterprise Runtime for R · Spotfire Statistics… +4)
- [CVE-2025-32695](https://cve.now/CVE-2025-32695.md): WordPress Checkout Mestres WP plugin \<= 8.7.5 - Privilege Escalation Vulnerability (CVSS 9.8, Mestres do WP Checkout Mestres WP)
- [CVE-2025-31383](https://cve.now/CVE-2025-31383.md): WordPress FrescoChat Live Chat plugin \<= 3.2.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, sodena FrescoChat Live Chat)
- [CVE-2025-31385](https://cve.now/CVE-2025-31385.md): WordPress Site Table of Contents plugin \<= 0.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, intelcaprep Site Table of Contents)
- [CVE-2025-31002](https://cve.now/CVE-2025-31002.md): WordPress Squeeze plugin \<= 1.6 - Arbitrary File Upload vulnerability (CVSS 9.1, Bogdan Bendziukov Squeeze)
- [CVE-2025-31003](https://cve.now/CVE-2025-31003.md): WordPress Squeeze plugin \<= 1.6 - Full Path Disclosure (FPD) vulnerability (CVSS 2.7, Bogdan Bendziukov Squeeze)
- [CVE-2025-31004](https://cve.now/CVE-2025-31004.md): WordPress Rich Table of Contents plugin \<= 1.4.0 - Broken Access Control vulnerability (CVSS 4.3, Croover.inc Rich Table of Contents)
- [CVE-2025-31005](https://cve.now/CVE-2025-31005.md): WordPress Easyfonts plugin \<= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Uzair Easyfonts)
- [CVE-2025-31008](https://cve.now/CVE-2025-31008.md): WordPress YouTube Embed plugin \<= 5.3.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Embeds For YouTube Plugin Support YouTube Embed)
- [CVE-2025-31009](https://cve.now/CVE-2025-31009.md): WordPress IndieBlocks plugin \<= 0.13.1 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 5.4, Jan Boddez IndieBlocks)
- [CVE-2025-31012](https://cve.now/CVE-2025-31012.md): WordPress Age Gate plugin \<= 3.5.4 - Broken Access Control Vulnerability (CVSS 5.3, Phil Age Gate)
- [CVE-2025-31017](https://cve.now/CVE-2025-31017.md): WordPress Nav Menu Manager plugin \<= 3.2.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Robert Noakes Nav Menu Manager)
- [CVE-2025-31020](https://cve.now/CVE-2025-31020.md): WordPress Simple Spoiler plugin \<= 1.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Webliberty Simple Spoiler)
- [CVE-2025-31023](https://cve.now/CVE-2025-31023.md): WordPress Seo Meta Tags plugin \<= 1.4 - CSRF to Privilege Escalation vulnerability (CVSS 8.8, Purab Seo Meta Tags)
- [CVE-2025-31026](https://cve.now/CVE-2025-31026.md): WordPress Comment Validation Reloaded plugin \<= 0.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Austin Comment Validation Reloaded)
- [CVE-2025-31032](https://cve.now/CVE-2025-31032.md): WordPress Pagopar – WooCommerce Gateway plugin \<= 2.7.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Pagopar - Grupo M S.A. Pagopar – WooCommerce Gateway)
- [CVE-2025-31033](https://cve.now/CVE-2025-31033.md): WordPress Buddypress Humanity plugin \<= 1.2 - CSRF to Privilege Escalation vulnerability (CVSS 9.8, Adam Nowak Buddypress Humanity)
- [CVE-2025-31034](https://cve.now/CVE-2025-31034.md): WordPress Customize Login Page plugin \<= 1.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, AboZain Albanna Customize Login Page)
- [CVE-2025-31035](https://cve.now/CVE-2025-31035.md): WordPress WP Editor.md – The Perfect Markdown Editor plugin \<= 10.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Benjamin Chris WP Editor.md – The Perfect WordPress Markdow…)
- [CVE-2025-31036](https://cve.now/CVE-2025-31036.md): WordPress WPSolr plugin \<= 24.0 - CSRF to Privilege Escalation vulnerability (CVSS 8.8, WPSolr)
- [CVE-2025-31038](https://cve.now/CVE-2025-31038.md): WordPress Essential Breadcrumbs plugin \<= 1.1.1 - CSRF to Privilege Escalation vulnerability (CVSS 8.8, Essential Marketer Essential Breadcrumbs)
- [CVE-2025-31042](https://cve.now/CVE-2025-31042.md): WordPress Sandwich Adsense plugin \<= 4.0.2 - Broken Access Control Vulnerability (CVSS 5.3, rtakao Sandwich Adsense)
- [CVE-2025-31375](https://cve.now/CVE-2025-31375.md): WordPress Scheduled plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, bhoogterp Scheduled)
- [CVE-2025-31377](https://cve.now/CVE-2025-31377.md): WordPress Woo Product Feed For Marketing Channels plugin \<= 1.9.0 - Broken Access Control Vulnerability (CVSS 7.5, Asaquzzaman mishu Woo Product Feed For Marketing Channels)
- [CVE-2025-31382](https://cve.now/CVE-2025-31382.md): WordPress Language Field plugin \<= 0.9 - CSRF to Stored XSS vulnerability (CVSS 7.1, theode Language Field)
- [CVE-2025-31388](https://cve.now/CVE-2025-31388.md): WordPress The World plugin \<= 0.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, doa The World)
- [CVE-2025-31390](https://cve.now/CVE-2025-31390.md): WordPress Social Crowd plugin \<= 0.9.6.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, bdoga Social Crowd)
- [CVE-2025-31391](https://cve.now/CVE-2025-31391.md): WordPress Script Compressor plugin \<= 1.7.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, regen Script Compressor)
- [CVE-2025-31392](https://cve.now/CVE-2025-31392.md): WordPress Smart Product Gallery Slider plugin \<= 1.0.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, Shameem Reza Smart Product Gallery Slider)
- [CVE-2025-31393](https://cve.now/CVE-2025-31393.md): WordPress Social Bookmarking RELOADED plugin \<= 3.18 - CSRF to Stored XSS vulnerability (CVSS 7.1, vfvalent Social Bookmarking RELOADED)
- [CVE-2025-31394](https://cve.now/CVE-2025-31394.md): WordPress More Mime Type Filters plugin \<= 0.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, Kailey (trepmal) More Mime Type Filters)
- [CVE-2025-31395](https://cve.now/CVE-2025-31395.md): WordPress Easy Custom CSS plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, a.ankit Easy Custom CSS)
- [CVE-2025-31399](https://cve.now/CVE-2025-31399.md): WordPress CG Scroll To Top plugin \<= 3.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Chandan Garg CG Scroll To Top)
- [CVE-2025-31400](https://cve.now/CVE-2025-31400.md): WordPress WS Audio Player plugin \<= 1.1.8 - CSRF to Stored XSS vulnerability (CVSS 7.1, icyleaf WS Audio Player)
- [CVE-2025-31401](https://cve.now/CVE-2025-31401.md): WordPress MMX – Make Me Christmas plugin \<= 1.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, mmetrodw MMX – Make Me Christmas)
- [CVE-2025-31402](https://cve.now/CVE-2025-31402.md): WordPress NewsBoard Post and RSS Scroller plugin \<= 1.2.12 - CSRF to Stored XSS vulnerability (CVSS 7.1, NewsBoard Plugin NewsBoard Post and RSS Scroller)
- [CVE-2025-31404](https://cve.now/CVE-2025-31404.md): WordPress AF Tell a Friend plugin \<= 1.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, Wladyslaw Madejczyk AF Tell a Friend)
- [CVE-2025-32476](https://cve.now/CVE-2025-32476.md): WordPress Advanced Tag Lists plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, blueinstyle Advanced Tag Lists)
- [CVE-2025-32477](https://cve.now/CVE-2025-32477.md): WordPress WP-Easy Menu plugin \<= 0.41 - CSRF to Stored XSS vulnerability (CVSS 7.1, Jordi Salord WP-Easy Menu)
- [CVE-2025-32478](https://cve.now/CVE-2025-32478.md): WordPress WP SexyLightBox plugin \<= 0.5.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, Mario Aguiar WP SexyLightBox)
- [CVE-2025-32479](https://cve.now/CVE-2025-32479.md): WordPress Flags Widget plugin \<= 1.0.7 - CSRF to Stored XSS vulnerability (CVSS 7.1, ab-tools Flags Widget)
- [CVE-2025-32480](https://cve.now/CVE-2025-32480.md): WordPress Windows Live Writer plugin \<= 0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, dalziel Windows Live Writer)
- [CVE-2025-32481](https://cve.now/CVE-2025-32481.md): WordPress Nino Social Connect plugin \<= 2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, ninotheme Nino Social Connect)
- [CVE-2025-32482](https://cve.now/CVE-2025-32482.md): WordPress Custom Smilies plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, quanganhdo Custom Smilies)
- [CVE-2025-32483](https://cve.now/CVE-2025-32483.md): WordPress Request Call Back plugin \<= 1.4.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Scott Salisbury Request Call Back)
- [CVE-2025-32484](https://cve.now/CVE-2025-32484.md): WordPress WP-Planification – WP-Planning plugin \<= 2.3.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Mathieu Chartier WP-Planification)
- [CVE-2025-32485](https://cve.now/CVE-2025-32485.md): WordPress WP Performance Pack plugin \<= 2.5.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Bjoern WP Performance Pack)
- [CVE-2025-32487](https://cve.now/CVE-2025-32487.md): WordPress Waymark plugin \<= 1.5.2 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.9, Joe Waymark)
- [CVE-2025-32488](https://cve.now/CVE-2025-32488.md): WordPress Aria Font plugin \<= 1.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, آریا وردپرس Aria Font)
- [CVE-2025-32489](https://cve.now/CVE-2025-32489.md): WordPress Wetterwarner plugin \<= 2.7.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Tim Wetterwarner)
- [CVE-2025-32492](https://cve.now/CVE-2025-32492.md): WordPress Admin Menu Post List plugin \<= 2.0.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Eliot Akira Admin Menu Post List)
- [CVE-2025-32493](https://cve.now/CVE-2025-32493.md): WordPress BP Social Connect plugin \<= 1.6.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, VibeThemes BP Social Connect)
- [CVE-2025-32494](https://cve.now/CVE-2025-32494.md): WordPress reCAPTCHA Jetpack plugin \<= 0.2.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, bozdoz reCAPTCHA Jetpack)
- [CVE-2025-32495](https://cve.now/CVE-2025-32495.md): WordPress Waymark plugin \<= 1.5.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Joe Waymark)
- [CVE-2025-32496](https://cve.now/CVE-2025-32496.md): WordPress Ultra Demo Importer plugin \<= 1.0.5 - CSRF to RCE vulnerability (CVSS 9.6, Uncodethemes Ultra Demo Importer)
- [CVE-2025-32497](https://cve.now/CVE-2025-32497.md): WordPress Spoiler Block plugin \<= 1.7 - CSRF to Stored XSS vulnerability (CVSS 7.1, squiter Spoiler Block)
- [CVE-2025-32498](https://cve.now/CVE-2025-32498.md): WordPress VKontakte Cross-Post plugin \<= 0.3.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, oleglark VKontakte Cross-Post)
- [CVE-2025-32499](https://cve.now/CVE-2025-32499.md): WordPress Logo Showcase Ultimate plugin \<= 1.4.4 - Local File Inclusion vulnerability (CVSS 6.5, wpWax Logo Showcase Ultimate)
- [CVE-2025-32500](https://cve.now/CVE-2025-32500.md): WordPress Codescar Radio Widget plugin \<= 0.4.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sudavar Codescar Radio Widget)
- [CVE-2025-32501](https://cve.now/CVE-2025-32501.md): WordPress RentSyst plugin \<= 2.0.92 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, dimafreund Rentsyst)
- [CVE-2025-32502](https://cve.now/CVE-2025-32502.md): WordPress ePaper Lister for Yumpu plugin \<= 1.4.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, lemmentwickler ePaper Lister for Yumpu)
- [CVE-2025-32503](https://cve.now/CVE-2025-32503.md): WordPress Link Shield plugin \<= 0.5.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jose Conti Link Shield)
- [CVE-2025-32505](https://cve.now/CVE-2025-32505.md): WordPress MultiMailer plugin \<= 1.0.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, SCAND MultiMailer)
- [CVE-2025-32518](https://cve.now/CVE-2025-32518.md): WordPress ALD Login Page plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, hossainawlad ALD Login Page)
- [CVE-2025-32543](https://cve.now/CVE-2025-32543.md): WordPress Canonical Attachments Plugin \<= 1.8 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, hivedigital Canonical Attachments)
- [CVE-2025-32547](https://cve.now/CVE-2025-32547.md): WordPress All push notification for WP Plugin \<= 1.5.3 - CSRF to SQL Injection vulnerability (CVSS 8.2, gtlwpdev All push notification for WP)
- [CVE-2025-32550](https://cve.now/CVE-2025-32550.md): WordPress Click & Pledge Connect Plugin Plugin \<= 2.24080000-WP6.6.1 - SQL Injection vulnerability (CVSS 7.2, ClickandPledge Click & Pledge Connect Plugin)
- [CVE-2025-32555](https://cve.now/CVE-2025-32555.md): WordPress SEO, Nutrition and Print for Recipes by Edamam plugin \<= 3.3 - CSRF to Cross-Site Scripting vulnerability (CVSS 7.1, SEO, Nutrition and Print for Recipes by Edamam)
- [CVE-2025-32556](https://cve.now/CVE-2025-32556.md): WordPress Simple Post Meta Manager Plugin \<= 1.0.9 - CSRF to Reflected Cross-Site Scripting vulnerability (CVSS 7.1, Sandor Kovacs Simple Post Meta Manager)
- [CVE-2025-32559](https://cve.now/CVE-2025-32559.md): WordPress REVE Chat plugin \<= 6.4.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, REVE Chat)
- [CVE-2025-32563](https://cve.now/CVE-2025-32563.md): WordPress WP Calais Auto Tagger plugin \<= 2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, dangrossman WP Calais Auto Tagger)
- [CVE-2025-32570](https://cve.now/CVE-2025-32570.md): WordPress ChillPay WooCommerce Plugin \<= 2.5.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, ChillPay WooCommerce)
- [CVE-2025-32575](https://cve.now/CVE-2025-32575.md): WordPress WP w3all phpBB Plugin \<= 2.9.9 - CSRF to Stored XSS vulnerability (CVSS 7.1, axew3 WP w3all phpBB)
- [CVE-2025-32576](https://cve.now/CVE-2025-32576.md): WordPress WP shop plugin \<= 2.6.1 - CSRF to Arbitrary File Upload vulnerability (CVSS 9.6, Agence web Eoxia - Montpellier WP shop)
- [CVE-2025-32580](https://cve.now/CVE-2025-32580.md): WordPress DeBounce Email Validator plugin \<= 5.7.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, DeBounce Email Validator)
- [CVE-2025-32581](https://cve.now/CVE-2025-32581.md): WordPress WordPress Spam Blocker Plugin \<= 2.0.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Ankit Singla WordPress Spam Blocker)
- [CVE-2025-32584](https://cve.now/CVE-2025-32584.md): WordPress Chat2 plugin \<= 4.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Chat2)
- [CVE-2025-32591](https://cve.now/CVE-2025-32591.md): WordPress WP Abstracts Plugin \<= 2.7.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Kevon Adonis WP Abstracts)
- [CVE-2025-32597](https://cve.now/CVE-2025-32597.md): WordPress WordPress Events Calendar Plugin – connectDaily plugin \<= 1.5.4 - CSRF to Cross-Site Scripting vulnerability (CVSS 7.1, George Sexton WordPress Events Calendar Plugin – connectDai…)
- [CVE-2025-32610](https://cve.now/CVE-2025-32610.md): WordPress Foliopress WYSIWYG plugin \<= 2.6.18 - CSRF to Stored XSS vulnerability (CVSS 7.1, FolioVision Foliopress WYSIWYG)
- [CVE-2025-32612](https://cve.now/CVE-2025-32612.md): WordPress User Session Synchronizer plugin \<= 1.4.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, rafasashi User Session Synchronizer)
- [CVE-2025-32616](https://cve.now/CVE-2025-32616.md): WordPress Nimbata Call Tracking plugin \<= 1.7.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Nimbata Call Tracking)
- [CVE-2025-32617](https://cve.now/CVE-2025-32617.md): WordPress Multiple Location Google Map plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Ydesignservices Multiple Location Google Map)
- [CVE-2025-32619](https://cve.now/CVE-2025-32619.md): WordPress KeyCAPTCHA plugin \<= 2.5.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, KeyCAPTCHA)
- [CVE-2025-32621](https://cve.now/CVE-2025-32621.md): WordPress WP Map Route Planner plugin \<= 1.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Vsourz Digital WP Map Route Planner)
- [CVE-2025-32623](https://cve.now/CVE-2025-32623.md): WordPress PlainInventory plugin \<= 3.1.9 - CSRF to Stored XSS vulnerability (CVSS 7.1, plainware PlainInventory)
- [CVE-2025-32624](https://cve.now/CVE-2025-32624.md): WordPress Czater.pl – live chat i telefon plugin \<= 1.0.5 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Czater.pl – live chat i telefon)
- [CVE-2025-32640](https://cve.now/CVE-2025-32640.md): WordPress One Click Accessibility plugin \<= 3.1.0 - Cross-Site Scripting (XSS) vulnerability (CVSS 5.9, Elementor Ally)
- [CVE-2025-32641](https://cve.now/CVE-2025-32641.md): WordPress Anant Addons for Elementor plugin \<= 1.1.8 - CSRF to Arbitrary Plugin Installation vulnerability (CVSS 9.6, anantaddons Anant Addons for Elementor)
- [CVE-2025-32642](https://cve.now/CVE-2025-32642.md): WordPress Vite Coupon plugin \<= 1.0.9 - CSRF to Remote Code Execution (RCE) vulnerability (CVSS 9.6, appsbd Vite Coupon)
- [CVE-2025-32644](https://cve.now/CVE-2025-32644.md): WordPress IP2Location World Clock Plugin \<= 1.1.9 - CSRF to Stored XSS vulnerability (CVSS 7.1, IP2Location World Clock)
- [CVE-2025-32645](https://cve.now/CVE-2025-32645.md): WordPress Custom Posts Order Plugin \<= 4.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Hiren Patel Custom Posts Order)
- [CVE-2025-32659](https://cve.now/CVE-2025-32659.md): WordPress FraudLabs Pro for WooCommerce plugin \<= 2.22.8 - CSRF to Stored XSS vulnerability (CVSS 7.1, fraudlabspro FraudLabs Pro for WooCommerce)
- [CVE-2025-32661](https://cve.now/CVE-2025-32661.md): WordPress Interactive US Map plugin \<= 2.7 - CSRF to Stored XSS vulnerability (CVSS 7.1, WP Map Plugins Interactive US Map)
- [CVE-2025-32664](https://cve.now/CVE-2025-32664.md): WordPress Nepali Date Utilities plugin \<= 1.0.15 - CSRF to Stored XSS vulnerability (CVSS 7.1, ashokbasnet Nepali Date Utilities)
- [CVE-2025-32667](https://cve.now/CVE-2025-32667.md): WordPress Doppler Forms plugin \<= 2.5.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, fromdoppler Doppler Forms)
- [CVE-2025-32669](https://cve.now/CVE-2025-32669.md): WordPress Mergado Pack plugin \<= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Mergado Pack)
- [CVE-2025-32673](https://cve.now/CVE-2025-32673.md): WordPress Epeken All Kurir plugin \<= 2.0.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Epeken All Kurir)
- [CVE-2025-32675](https://cve.now/CVE-2025-32675.md): WordPress SEO Help plugin \<= 6.7.9 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.8, QuantumCloud SEO Help)
- [CVE-2025-32676](https://cve.now/CVE-2025-32676.md): WordPress Verowa Connect plugin \<= 3.0.5 - SQL Injection vulnerability (CVSS 7.6, Picture-Planet Verowa Connect)
- [CVE-2025-32677](https://cve.now/CVE-2025-32677.md): WordPress WP Social Stream Designer plugin \<= 1.3 - SQL Injection vulnerability (CVSS 7.6, solwininfotech WP Social Stream Designer)
- [CVE-2025-32678](https://cve.now/CVE-2025-32678.md): WordPress WP Show Stats plugin \<= 1.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Ashish Ajani WP Show Stats)
- [CVE-2025-32679](https://cve.now/CVE-2025-32679.md): WordPress User Registration Using Contact Form 7 plugin \<= 2.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, ZealousWeb User Registration Using Contact Form)
- [CVE-2025-32680](https://cve.now/CVE-2025-32680.md): WordPress Review Stream plugin \<= 1.6.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Grade Us Review Stream)
- [CVE-2025-32683](https://cve.now/CVE-2025-32683.md): WordPress MapSVG Lite plugin \<= 8.6.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, RomanCode MapSVG)
- [CVE-2025-32684](https://cve.now/CVE-2025-32684.md): WordPress MapSVG Lite plugin \<= 8.6.4 - Broken Access Control Vulnerability (CVSS 5.0, RomanCode MapSVG)
- [CVE-2025-32685](https://cve.now/CVE-2025-32685.md): WordPress WP Inquiries plugin \<= 0.2.1 - SQL Injection Vulnerability (CVSS 7.6, Aristo Rinjuang WP Inquiries)
- [CVE-2025-32690](https://cve.now/CVE-2025-32690.md): WordPress PowerPress Podcasting plugin \<= 11.12.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, blubrry PowerPress Podcasting)
- [CVE-2025-32691](https://cve.now/CVE-2025-32691.md): WordPress PowerPress Podcasting plugin \<= 11.12.6 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.9, blubrry PowerPress Podcasting)
- [CVE-2025-32692](https://cve.now/CVE-2025-32692.md): WordPress WP Subscription Forms plugin \<= 1.2.4 - Local File Inclusion Vulnerability (CVSS 7.5, WP Shuffle WP Subscription Forms)
- [CVE-2025-32693](https://cve.now/CVE-2025-32693.md): WordPress WebinarPress plugin \<= 1.33.28 - Open Redirection Vulnerability (CVSS 4.7, WPWebinarSystem WebinarPress)
- [CVE-2025-32694](https://cve.now/CVE-2025-32694.md): WordPress Ultimate WP Mail plugin \<= 1.3.10 - Open Redirection vulnerability (CVSS 4.7, Rustaurius Ultimate WP Mail)
- [CVE-2025-32380](https://cve.now/CVE-2025-32380.md): Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing (CVSS 7.5, apollographql router · apollo-router)
- [CVE-2025-32381](https://cve.now/CVE-2025-32381.md): Denial of Service by abusing xgrammar unbounded cache in memory (CVSS 6.5, mlc-ai xgrammar · xgrammar)
- [CVE-2025-32379](https://cve.now/CVE-2025-32379.md): XSS at ctx.redirect() function in Koajs (CVSS 5.0, koajs koa · koa)
- [CVE-2025-32016](https://cve.now/CVE-2025-32016.md): Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs (CVSS 4.7, AzureAD microsoft-identity-web · Microsoft.Identity.Web +1)
- [CVE-2025-32378](https://cve.now/CVE-2025-32378.md): Shopware's default newsletter opt-in settings allow for mass sign-up abuse (CVSS 6.9, shopware · shopware/core +1)
- [CVE-2025-32375](https://cve.now/CVE-2025-32375.md): Insecure Deserialization leads to RCE in BentoML's runner server (CVSS 9.8, BentoML)
- [CVE-2025-32374](https://cve.now/CVE-2025-32374.md): Possible Denial of Service (DoS) in DNN.PLATFORM registration (CVSS 5.9, dnnsoftware Dnn.Platform)
- [CVE-2025-32373](https://cve.now/CVE-2025-32373.md): DNN allows a registered user to enumerate and access files they should not have access to (CVSS 6.5, dnnsoftware Dnn.Platform)
- [CVE-2025-32372](https://cve.now/CVE-2025-32372.md): Server-Side Request Forgery (SSRF) in DotNetNuke.Core (CVSS 6.5, dnnsoftware Dnn.Platform · DotNetNuke.Core)
- [CVE-2025-32371](https://cve.now/CVE-2025-32371.md): Unexpected external content may be displayed in DNN ImageHandler (CVSS 4.3, dnnsoftware Dnn.Platform)
- [CVE-2025-27391](https://cve.now/CVE-2025-27391.md): Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log (CVSS 6.8, Apache Software Foundation Apache ActiveMQ Artemis · org.ap…)
- [CVE-2025-25023](https://cve.now/CVE-2025-25023.md): IBM Security Guardium information disclosure (CVSS 4.9, IBM Security Guardium)
- [CVE-2023-33844](https://cve.now/CVE-2023-33844.md): IBM Security Verify Governance cross-site scripting (CVSS 5.4, IBM Security Verify Governance)
- [CVE-2025-1968](https://cve.now/CVE-2025-1968.md): Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances all (CVSS 7.7, Progress Software Sitefinity)
- [CVE-2025-31672](https://cve.now/CVE-2025-31672.md): Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names (CVSS 5.3, Apache Software Foundation Apache POI · org.apache.poi:poi-…)
- [CVE-2025-30677](https://cve.now/CVE-2025-30677.md): Apache Pulsar IO Kafka Connector, Apache Pulsar IO Kafka Connect Adaptor: Sensitive information logged in Pulsar's Apache Kafka Connectors (CVSS 6.3, Apache Software Foundation Apache Pulsar IO Kafka Connec… +2)
- [CVE-2017-20197](https://cve.now/CVE-2017-20197.md): propanetank Roommate-Bill-Tracking login.php sql injection (CVSS 6.9, propanetank Roommate-Bill-Tracking)
- [CVE-2025-2442](https://cve.now/CVE-2025-2442.md): CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access whic (CVSS 5.4, Schneider Electric Trio Q Licensed Data Radio)
- [CVE-2025-2441](https://cve.now/CVE-2025-2441.md): CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of confidentiality when a malic (CVSS 4.1, Schneider Electric Trio Q Licensed Data Radio)
- [CVE-2025-2440](https://cve.now/CVE-2025-2440.md): CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential d (CVSS 4.1, Schneider Electric Trio Q Licensed Data Radio)
- [CVE-2025-2223](https://cve.now/CVE-2025-2223.md): CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and Availability of engineering (CVSS 8.4, Schneider Electric ConneXium Network Manager)
- [CVE-2025-2222](https://cve.now/CVE-2025-2222.md): CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak information and potential privi (CVSS 8.2, Schneider Electric ConneXium Network Manager)
- [CVE-2025-29870](https://cve.now/CVE-2025-29870.md): Missing authentication for critical function vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. (CVSS 7.5, Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4)
- [CVE-2025-27934](https://cve.now/CVE-2025-27934.md): Information disclosure of authentication information in the specific service vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. (CVSS 7.5, Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4)
- [CVE-2025-27797](https://cve.now/CVE-2025-27797.md): OS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. (CVSS 9.8, Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4)
- [CVE-2025-27722](https://cve.now/CVE-2025-27722.md): Cleartext transmission of sensitive information issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. (CVSS 5.9, Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4)
- [CVE-2025-25213](https://cve.now/CVE-2025-25213.md): Improper restriction of rendered UI layers or frames issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. (CVSS 6.5, Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4)
- [CVE-2025-25056](https://cve.now/CVE-2025-25056.md): Cross-site request forgery vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. (CVSS 4.3, Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4)
- [CVE-2025-25053](https://cve.now/CVE-2025-25053.md): OS command injection vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. (CVSS 8.8, Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4)
- [CVE-2025-23407](https://cve.now/CVE-2025-23407.md): Incorrect privilege assignment vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. (CVSS 4.3, Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4)
- [CVE-2025-20952](https://cve.now/CVE-2025-20952.md): Improper access control in Mdecservice prior to SMR Apr-2025 Release 1 allows local attackers to access arbitrary files with system privileg (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-3442](https://cve.now/CVE-2025-3442.md): Information Disclosure Vulnerability in TP-Link Tapo IoT Smart Hub (CVSS 4.4, TP-Link Tapo H200 V1 IoT Smart Hub)
- [CVE-2024-8243](https://cve.now/CVE-2024-8243.md): Plugin Upgrade Time Out \<= 1.0 - Stored XSS via CSRF (CVSS 6.3, WordPress/Plugin Upgrade Time Out Plugin)
- [CVE-2024-6860](https://cve.now/CVE-2024-6860.md): WP MultiTasking \<= 0.1.12 - Permalink Suffix Update via CSRF (CVSS 4.3, WP MultiTasking)
- [CVE-2024-6857](https://cve.now/CVE-2024-6857.md): WP MultiTasking \<= 0.1.12 - Header/Footer/Body Script Update via CSRF (CVSS 4.3, WP MultiTasking)
- [CVE-2025-3100](https://cve.now/CVE-2025-3100.md): WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts \<= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, wedevs Project Manager – AI Powered Project Management, Tas…)
- [CVE-2025-29988](https://cve.now/CVE-2025-29988.md): Dell Client Platform BIOS contains a Stack-based Buffer Overflow Vulnerability. (CVSS 6.9, Dell Client Platform BIOS)
- [CVE-2024-55210](https://cve.now/CVE-2024-55210.md): An issue in TOTVS Framework (Linha Protheus) 12.1.2310 allows attackers to bypass multi-factor authentication (MFA) via a crafted websocket (CVSS 9.8)
- [CVE-2025-29018](https://cve.now/CVE-2025-29018.md): A Stored Cross-Site Scripting (XSS) vulnerability exists in the name parameter of pages\_add\_acc\_type.php in Code Astro Internet Banking Syst (CVSS 4.8)
- [CVE-2025-29189](https://cve.now/CVE-2025-29189.md): Flowise \<= 2.2.3 is vulnerable to SQL Injection. (CVSS 7.6, flowise-components)
- [CVE-2025-29389](https://cve.now/CVE-2025-29389.md): PbootCMS v3.2.9 contains a XSS vulnerability in admin.php?p=/Content/index/mcode/2#tab=t2. (CVSS 6.1)
- [CVE-2025-29390](https://cve.now/CVE-2025-29390.md): jerryhanjj ERP 1.0 is vulnerable to SQL Injection in the set\_password function in application/controllers/home.php. (CVSS 8.8)
- [CVE-2025-29391](https://cve.now/CVE-2025-29391.md): horvey Library-Manager v1.0 is vulnerable to SQL Injection in Admin/Controller/BookController.class.php. (CVSS 7.2)
- [CVE-2025-29394](https://cve.now/CVE-2025-29394.md): An insecure permissions vulnerability in verydows v2.0 allows a remote attacker to execute arbitrary code by uploading a file type. (CVSS 8.1)
- [CVE-2025-32460](https://cve.now/CVE-2025-32460.md): GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call. (CVSS 4.0, GraphicsMagick)
- [CVE-2025-32461](https://cve.now/CVE-2025-32461.md): wikiplugin\_includetpl in lib/wiki-plugins/wikiplugin\_includetpl.php in Tiki before 28.3 mishandles input to an eval. (CVSS 9.9, Tiki)
- [CVE-2025-32464](https://cve.now/CVE-2025-32464.md): HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample\_conv\_regsub heap-based buffer overflow because of mishandling of (CVSS 6.8, HAProxy)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.