CVEs published April 11, 2025
127 CVEs were published on April 11, 2025: 13 critical, 67 high.
- Published
- 127
- Critical
- 13
- High
- 67
- Medium
- 44
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 38
Most affected products
- Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- 6
- SUSE rancher · github.com/rancher/rancher
- 5
- Apple iOS and iPadOS · Apple macOS
- 4
- Apple macOS
- 4
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…
- 3
- Apple iOS and iPadOS · Apple macOS +3
- 2
- dev02ali Easy Post Duplicator
- 2
- OPEN BizRobo!
- 2
- Subnet Solutions PowerSYSTEM Center
- 2
- verbb formie · verbb/formie
- 2
Critical 13
- CVE-2025-0129Prisma Access Browser: Inappropriate control behavior in Prisma Access BrowserPalo Alto Networks Prisma Access Browser
- CVE-2025-3439Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object Injectionwpeverest Everest Forms – Contact Form, Payment Form, Quiz,…
- CVE-2025-23391Rancher: Restricted Administrator can change Administrator's passwordsSUSE rancher · github.com/rancher/rancher
- CVE-2025-32607WordPress WpBookingly plugin <= 1.3.0 - PHP Object Injection vulnerabilitymagepeopleteam WpBookingly
- CVE-2025-32603WordPress WP Online Users Stats plugin <= 1.0.0 - SQL Injection vulnerabilityHK WP Online Users Stats
- CVE-2025-32579WordPress Sync Posts Plugin <= 1.0 - Arbitrary File Upload vulnerabilitySoftClever Limited Sync Posts
- CVE-2025-32577WordPress Build App Online Plugin <= 1.0.23 - Local File Inclusion vulnerabilityhakeemnala Build App Online
- CVE-2025-32569WordPress TableOn plugin <= 1.0.4.3 - PHP Object Injection vulnerabilityRealMag777 TableOn
- CVE-2025-32568WordPress EmpikPlace for Woocommerce Plugin <= 1.4.3 - PHP Object Injection vulnerabilityEmpikPlace for Woocommerce
- CVE-2025-32565WordPress Neon Product Designer Plugin <= 2.2.0 - Unauthenticated SQL Injection vulnerabilityvertim Neon Product Designer
- CVE-2025-32491WordPress Rankology SEO – On-site SEO plugin <= 2.2.4 - Privilege Escalation VulnerabilityRankology SEO – On-site SEO
- CVE-2025-31599WordPress Bulk Product Sync plugin <= 8.6 - SQL Injection vulnerabilityN-Media Bulk Product Sync
- CVE-2025-31565WordPress WPSmartContracts plugin <= 2.0.12 - SQL Injection vulnerabilityLisandro Martinez WPSmartContracts
High 67
- CVE-2023-42977A path handling issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS
- CVE-2023-42970A use-after-free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2023-42875Processing web content may lead to arbitrary code execution.Apple iOS and iPadOS · Apple macOS +3
- CVE-2023-41076An app may be able to elevate privileges.Apple macOS
- CVE-2024-13861A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3.10 allows local userSophos Taegis Endpoint Agent
- CVE-2024-52280Users can issue watch commands for arbitrary resourcesSUSE rancher · github.com/rancher/steve
- CVE-2025-23388Unauthenticated stack overflow in /v3-public/authproviders APISUSE rancher · github.com/rancher/rancher
- CVE-2025-23389Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First LoginSUSE rancher · github.com/rancher/rancher
- CVE-2025-31932Deserialization of untrusted data issue exists in BizRobo! all versions.OPEN BizRobo!
- CVE-2025-32681WordPress Error Log Viewer By WP Guru plugin <= 1.0.5 - SQL Injection vulnerabilityWP Guru Error Log Viewer
- CVE-2025-32672WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.9 - Local File Inclusion Vulnerabilityg5theme Ultimate Bootstrap Elements for Elementor
- CVE-2025-32671WordPress Print Science Designer plugin <= 1.3.155 - Arbitrary File Download vulnerabilityJohn Weissberg Print Science Designer
- CVE-2025-32663WordPress FAT Cooming Soon plugin <= 1.1 - Local File Inclusion vulnerabilityroninwp FAT Cooming Soon
- CVE-2025-32656WordPress Testimonial Slider and Showcase Pro plugin <= 2.3.15 - Local File Inclusion vulnerabilityRadiusTheme Testimonial Slider And Showcase Pro
- CVE-2025-32654WordPress Motors plugin <= 1.4.71 - Local File Inclusion vulnerabilityStylemix Motors
- CVE-2025-32650WordPress Accessibility Suite by Ability, Inc plugin <= 4.18 - SQL Injection vulnerabilityAbility Accessibility Suite
- CVE-2025-32633WordPress Database Toolset Plugin <= 1.8.4 - Arbitrary File Deletion vulnerabilityneoslab Database Toolset
- CVE-2025-32632WordPress Automatic Ban IP Plugin <= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerabilityKaizenCoders Automatic Ban IP
- CVE-2025-32631WordPress Oxygen MyData for WooCommerce plugin <= 1.0.64 - Arbitrary File Deletion vulnerabilityoxygensuite Oxygen MyData for WooCommerce
- CVE-2025-32629WordPress WP-BusinessDirectory Plugin <= 3.1.2 - Arbitrary File Deletion vulnerabilityCMSJunkie - WordPress Business Directory Plugins WP-Busines…
- CVE-2025-32627WordPress JS Job Manager plugin <= 2.0.2 - Local File Inclusion vulnerabilityJoomSky JS Job Manager
- CVE-2025-32618WordPress Wishlist plugin <= 1.0.46 - SQL Injection vulnerabilityPickPlugins Wishlist
- CVE-2025-32614WordPress EventON plugin <= 2.4 - Local File Inclusion vulnerabilityAshan Perera EventON
- CVE-2025-32601WordPress Twispay Credit Card Payments Plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityTwispay Credit Card Payments
- CVE-2025-32600WordPress Tournamatch plugin <= 4.7.0 - Cross Site Scripting (XSS) vulnerabilityTournamatch
- CVE-2025-32599WordPress Task Scheduler Plugin <= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerabilitymiunosoft Task Scheduler
- CVE-2025-32598WordPress WP Table Builder plugin <= 2.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityWP Table Builder
- CVE-2025-32589WordPress Flexi – Guest Submit Plugin <= 4.28 - Local File Inclusion vulnerabilityodude Flexi – Guest Submit
- CVE-2025-32587WordPress WooCommerce Pickupp plugin <= 2.4.3 - Local File Inclusion vulnerabilityWooCommerce Pickupp
- CVE-2025-32586WordPress ABA PayWay Payment Gateway for WooCommerce Plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityABA Bank ABA PayWay Payment Gateway for WooCommerce
- CVE-2025-32585WordPress Shop Products Filter Plugin <= 1.2 - Local File Inclusion vulnerabilityTrusty Plugins Shop Products Filter
- CVE-2025-32567WordPress Easy Post Duplicator Plugin <= 1.0.1 - SQL Injection vulnerabilitydev02ali Easy Post Duplicator
- CVE-2025-32558WordPress Duplicate Title Checker Plugin <= 1.2 - SQL Injection vulnerabilityketanajani Duplicate Title Checker
- CVE-2025-32553WordPress RestroPres plugin <= 3.2.8.4 - Reflected Cross Site Scripting (XSS) vulnerabilityMagnigenie RestroPress
- CVE-2025-32551WordPress Connector to CiviCRM with CiviMcRestFace plugin <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilityJaap Jansma Connector to CiviCRM with CiviMcRestFace
- CVE-2025-32542WordPress Eazy Plugin Manager plugin <= 4.3.0 - Broken Access Control vulnerabilityEazyPlugins Eazy Plugin Manager
- CVE-2025-32541WordPress WooCommerce Sales MIS Report Plugin <= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityinfosoftplugin WooCommerce Sales MIS Report
- CVE-2025-32539WordPress WooCommerce – Store Exporter plugin <= 2.7.4 - Cross Site Scripting (XSS) vulnerabilityJosh Kohlbach Store Exporter
- CVE-2025-32538WordPress Easy Post Duplicator Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilitydev02ali Easy Post Duplicator
- CVE-2025-32537WordPress Lock Your Updates Plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityRachel Cherry Lock Your Updates
- CVE-2025-32536WordPress HTML5 Video Player with Playlist Plugin <= 2.50 - Reflected Cross Site Scripting (XSS) vulnerabilitySandeep Verma HTML5 Video Player with Playlist
- CVE-2025-32534WordPress Workbox Video from Vimeo & Youtube Plugin Plugin <= 3.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityWorkbox Video from Vimeo & Youtube
- CVE-2025-32525WordPress Interactive Geo Maps plugin <= 1.6.24 - Reflected Cross Site Scripting (XSS) vulnerabilityMapGeo Interactive Geo Maps
- CVE-2025-32524WordPress MyWorks WooCommerce Sync for QuickBooks Online plugin <= 2.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityMyWorks WooCommerce Sync for QuickBooks Online
- CVE-2025-32523WordPress WooCommerce – Payphone Gateway plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityWooCommerce – Payphone Gateway
- CVE-2025-32519WordPress IDonate plugin <= 2.1.18 - Local File Inclusion vulnerabilityFoysal Imran IDonate
- CVE-2025-32517WordPress MultiMailer plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilitySCAND MultiMailer
- CVE-2025-32509WordPress Simple WP Events plugin <= 1.8.17 - Arbitrary File Deletion vulnerabilityWPMinds Simple WP Events
- CVE-2025-32144WordPress Job Board Manager Plugin <= 2.1.61 - PHP Object Injection vulnerabilityPickPlugins Job Board Manager
- CVE-2025-32143WordPress Accordion plugin <= 2.3.11 - PHP Object Injection vulnerabilityPickPlugins Accordion
- CVE-2025-31379WordPress Insert HTML Here plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityprogramphases Insert HTML Here
- CVE-2025-31378WordPress Oppso Unit Converter plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitydanbwb Oppso Unit Converter
- CVE-2025-31041WordPress AnyTrack Affiliate Link Manager plugin <= 1.0.4 - Broken Access Control VulnerabilityAnyTrack Affiliate Link Manager
- CVE-2025-31040WordPress WP Food ordering and Restaurant Menu plugin <= 2.7 - Local File Inclusion vulnerabilityExthemes WP Food ordering and Restaurant Menu
- CVE-2025-31028WordPress WP Hide Categories plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityHuseyin Berberoglu WP Hide Categories
- CVE-2025-31021WordPress Mobile Smart plugin <= v1.3.16 - Reflected Cross Site Scripting (XSS) vulnerabilitydolby_uk Mobile Smart
- CVE-2025-31015WordPress SMTP Service, Email Delivery Solved! — MailHawk plugin <= 1.3.1 - Local File Inclusion VulnerabilityAdrian Tobey WordPress SMTP Service, Email Delivery Solved!…
- CVE-2025-31014WordPress Material Dashboard plugin <= 1.4.5 - Local File Inclusion VulnerabilityHossein Material Dashboard
- CVE-2025-3434SMTP for Amazon SES – YaySMTP <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logsyaycommerce SMTP for Amazon SES – YaySMTP
- CVE-2025-32107OS command injection vulnerability exists in Deco BE65 Pro firmware versions prior to "Deco BE65 Pro(JP)_V1_1.1.2 Build 20250123".TP-Link Corporation Limited Deco BE65 Pro
- CVE-2025-2636InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File InclusionInstaWP Connect – 1-click WP Staging & Migration
- CVE-2025-0128PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted PacketPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-0127PAN-OS: Authenticated Admin Command Injection Vulnerability in PAN-OS VM-SeriesPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-0126PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML LoginPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-0120GlobalProtect App: Local Privilege Escalation (PE) VulnerabilityPalo Alto Networks GlobalProtect App · Palo Alto Networks G…
- CVE-2025-32367The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object ReferenOz Forensics face recognition application
- CVE-2025-32808W.W. W. Norton InQuizitive
Medium, low and unrated 47
- CVE-2025-2269Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' ParameterPhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2024-11679An input validation weakness was reported in the TpmSetup module for some legacy System x server products that could allow a local attacker Lenovo System x3550 M5 · Lenovo System x3560 M5
- CVE-2025-0123PAN-OS: Information Disclosure Vulnerability in HTTP/2 Packet CapturesPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-0119Cortex XDR Broker VM: Authenticated Command Injection Vulnerability in Broker VMPalo Alto Networks Cortex XDR Broker VM
- CVE-2025-32077XSSes in Extension:SimpleCalendarThe Wikimedia Foundation Mediawiki - Extension:SimpleCalend…
- CVE-2025-32078XSSes and potential RCE in Special:VersionCompareThe Wikimedia Foundation Mediawiki -
- CVE-2025-32079Saving the right content to MediaWiki:GrowthMentors.json can take down the siteThe Wikimedia Foundation Mediawiki - GrowthExperiments
- CVE-2025-32080Cross-origin data leak in mobilefrontend via lazy load imagesThe Wikimedia Foundation Mediawiki - Mobile Frontend Extens…
- CVE-2025-32076Evil regex used to process user-provided data in VisualDataThe Wikimedia Foundation Mediawiki - Visual Data Extension
- CVE-2025-32072HTML injection in feed output from i18n messageThe Wikimedia Foundation Mediawiki Core - Feed Utils
- CVE-2025-32073System message XSS in HTMLTagsThe Wikimedia Foundation Mediawiki - HTML Tags
- CVE-2025-32074XSSes in Extension:ConfirmAccountThe Wikimedia Foundation Mediawiki - Confirm Account Extens…
- CVE-2025-32075IP and user agent leaks in Extension:TabsThe Wikimedia Foundation Mediawiki - Tabs Extension
- CVE-2025-32067i18n XSS vulnerability in message growthexperimentsThe Wikimedia Foundation Mediawiki - Growth Experiments Ext…
- CVE-2025-32068Revoking authorization of OAuth2 consumer does not invalidate refresh tokensThe Wikimedia Foundation Mediawiki - OAuth Extension
- CVE-2025-32069Wikitext stored XSS on filepages due to dangerous WBMI serializationThe Wikimedia Foundation Mediawiki - Wikibase Media Info Ex…
- CVE-2025-32070XSSes in AJAXPollThe Wikimedia Foundation Mediawiki - AJAX Poll Extension
- CVE-2025-32071Wikibase CommonsInlineImageFormatter: i18n XSSThe Wikimedia Foundation Mediawiki - Wikidata Extension
- CVE-2025-31935Subnet Solutions PowerSYSTEM Center Deserialization of Untrusted DataSubnet Solutions PowerSYSTEM Center
- CVE-2025-31354Subnet Solutions PowerSYSTEM Center Out-of-Bounds ReadSubnet Solutions PowerSYSTEM Center
- CVE-2023-42983Processing a file may lead to a denial-of-service or potentially disclose memory contents.Apple macOS
- CVE-2023-42961A path handling issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS
- CVE-2023-42982Processing a file may lead to a denial-of-service or potentially disclose memory contents.Apple macOS
- CVE-2023-38614A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS
- CVE-2023-42969An app may be able to break out of its sandbox.Apple iOS and iPadOS · Apple macOS
- CVE-2023-42973Private Browsing tabs may be accessed without authentication.Apple iOS and iPadOS
- CVE-2023-42981Processing a file may lead to a denial-of-service or potentially disclose memory contents.Apple macOS
- CVE-2025-32426Formie has a XSS vulnerability for email notification content for previewverbb formie · verbb/formie
- CVE-2025-32427Formie has a XSS vulnerability for importing formsverbb formie · verbb/formie
- CVE-2025-3421Everest Forms <= 3.1.1 - Reflected Cross-Site Scriptingwpeverest Everest Forms – Contact Form, Payment Form, Quiz,…
- CVE-2025-3422Everest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Executionwpeverest Everest Forms – Contact Form, Payment Form, Quiz,…
- CVE-2025-2575Z Companion <= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadwpzita Z Companion
- CVE-2025-2541WP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadwedevs Project Manager – AI Powered Project Management, Tas…
- CVE-2024-52282Rancher Helm Applications may have sensitive values leakedSUSE rancher · github.com/rancher/rancher
- CVE-2025-23387Rancher's SAML-based login via CLI can be denied by unauthenticated usersSUSE rancher · github.com/rancher/rancher
- CVE-2025-31362Use of hard-coded cryptographic key issue exists in BizRobo! all versions.OPEN BizRobo!
- CVE-2025-2128Cost Calculator Builder <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids Parameterstylemix Cost Calculator Builder
- CVE-2025-3512Buffer overflow in QTextMarkdownImporterQt
- CVE-2025-1386Query smuggling in ch-go librarych-go · github.com/ClickHouse/ch-go
- CVE-2025-0125PAN-OS: Improper Neutralization of Input in the Management Web InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-0124PAN-OS: Authenticated File Deletion Vulnerability on the Management Web InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-0122Prisma SD-WAN: Denial of Service (DoS) Vulnerability Through Burst of Crafted PacketsPalo Alto Networks Prisma SD-WAN
- CVE-2025-0121Cortex XDR Agent: Local Windows User Can Crash the AgentPalo Alto Networks Cortex XDR Agent
- CVE-2025-26335Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of Sensitive Information Into Sent Data vulnerability.Dell PowerProtect Cyber Recovery
- CVE-2024-51461IBM QRadar WinCollect Agent denial of serviceIBM QRadar WinCollect Agent
- CVE-2025-32809W.W. W. Norton InQuizitive
- CVE-2025-32816CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity.CodeLit CourseLit