# CVEs published 2025-04-11

127 CVEs were published on April 11, 2025: 13 critical, 67 high. Days are UTC.

- [CVE-2025-2269](https://cve.now/CVE-2025-2269.md): Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.34 Reflected Cross-Site Scripting via 'image\_id' Parameter (CVSS 6.1, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2025-0129](https://cve.now/CVE-2025-0129.md): Prisma Access Browser: Inappropriate control behavior in Prisma Access Browser (CVSS 9.3, Palo Alto Networks Prisma Access Browser)
- [CVE-2024-11679](https://cve.now/CVE-2024-11679.md): An input validation weakness was reported in the TpmSetup module for some legacy System x server products that could allow a local attacker (CVSS 6.7, Lenovo System x3550 M5 · Lenovo System x3560 M5)
- [CVE-2025-0123](https://cve.now/CVE-2025-0123.md): PAN-OS: Information Disclosure Vulnerability in HTTP/2 Packet Captures (CVSS 5.9, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2025-0119](https://cve.now/CVE-2025-0119.md): Cortex XDR Broker VM: Authenticated Command Injection Vulnerability in Broker VM (CVSS 6.3, Palo Alto Networks Cortex XDR Broker VM)
- [CVE-2025-32077](https://cve.now/CVE-2025-32077.md): XSSes in Extension:SimpleCalendar (CVSS 6.9, The Wikimedia Foundation Mediawiki - Extension:SimpleCalend…)
- [CVE-2025-32078](https://cve.now/CVE-2025-32078.md): XSSes and potential RCE in Special:VersionCompare (CVSS 6.9, The Wikimedia Foundation Mediawiki -)
- [CVE-2025-32079](https://cve.now/CVE-2025-32079.md): Saving the right content to MediaWiki:GrowthMentors.json can take down the site (CVSS 6.5, The Wikimedia Foundation Mediawiki - GrowthExperiments)
- [CVE-2025-32080](https://cve.now/CVE-2025-32080.md): Cross-origin data leak in mobilefrontend via lazy load images (CVSS 6.9, The Wikimedia Foundation Mediawiki - Mobile Frontend Extens…)
- [CVE-2025-32076](https://cve.now/CVE-2025-32076.md): Evil regex used to process user-provided data in VisualData (CVSS 6.9, The Wikimedia Foundation Mediawiki - Visual Data Extension)
- [CVE-2025-32072](https://cve.now/CVE-2025-32072.md): HTML injection in feed output from i18n message (CVSS 6.9, The Wikimedia Foundation Mediawiki Core - Feed Utils)
- [CVE-2025-32073](https://cve.now/CVE-2025-32073.md): System message XSS in HTMLTags (CVSS 5.4, The Wikimedia Foundation Mediawiki - HTML Tags)
- [CVE-2025-32074](https://cve.now/CVE-2025-32074.md): XSSes in Extension:ConfirmAccount (CVSS 5.4, The Wikimedia Foundation Mediawiki - Confirm Account Extens…)
- [CVE-2025-32075](https://cve.now/CVE-2025-32075.md): IP and user agent leaks in Extension:Tabs (CVSS 6.9, The Wikimedia Foundation Mediawiki - Tabs Extension)
- [CVE-2025-32067](https://cve.now/CVE-2025-32067.md): i18n XSS vulnerability in message growthexperiments (CVSS 5.4, The Wikimedia Foundation Mediawiki - Growth Experiments Ext…)
- [CVE-2025-32068](https://cve.now/CVE-2025-32068.md): Revoking authorization of OAuth2 consumer does not invalidate refresh tokens (CVSS 5.4, The Wikimedia Foundation Mediawiki - OAuth Extension)
- [CVE-2025-32069](https://cve.now/CVE-2025-32069.md): Wikitext stored XSS on filepages due to dangerous WBMI serialization (CVSS 5.4, The Wikimedia Foundation Mediawiki - Wikibase Media Info Ex…)
- [CVE-2025-32070](https://cve.now/CVE-2025-32070.md): XSSes in AJAXPoll (CVSS 5.4, The Wikimedia Foundation Mediawiki - AJAX Poll Extension)
- [CVE-2025-32071](https://cve.now/CVE-2025-32071.md): Wikibase CommonsInlineImageFormatter: i18n XSS (CVSS 5.4, The Wikimedia Foundation Mediawiki - Wikidata Extension)
- [CVE-2025-31935](https://cve.now/CVE-2025-31935.md): Subnet Solutions PowerSYSTEM Center Deserialization of Untrusted Data (CVSS 6.2, Subnet Solutions PowerSYSTEM Center)
- [CVE-2025-31354](https://cve.now/CVE-2025-31354.md): Subnet Solutions PowerSYSTEM Center Out-of-Bounds Read (CVSS 4.3, Subnet Solutions PowerSYSTEM Center)
- [CVE-2023-42983](https://cve.now/CVE-2023-42983.md): Processing a file may lead to a denial-of-service or potentially disclose memory contents. (CVSS 6.4, Apple macOS)
- [CVE-2023-42977](https://cve.now/CVE-2023-42977.md): A path handling issue was addressed with improved validation. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42961](https://cve.now/CVE-2023-42961.md): A path handling issue was addressed with improved validation. (CVSS 6.3, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42982](https://cve.now/CVE-2023-42982.md): Processing a file may lead to a denial-of-service or potentially disclose memory contents. (CVSS 6.4, Apple macOS)
- [CVE-2023-42970](https://cve.now/CVE-2023-42970.md): A use-after-free issue was addressed with improved memory management. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2023-38614](https://cve.now/CVE-2023-38614.md): A permissions issue was addressed with additional restrictions. (CVSS 4.3, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42875](https://cve.now/CVE-2023-42875.md): Processing web content may lead to arbitrary code execution. (CVSS 7.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2023-42969](https://cve.now/CVE-2023-42969.md): An app may be able to break out of its sandbox. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-41076](https://cve.now/CVE-2023-41076.md): An app may be able to elevate privileges. (CVSS 7.3, Apple macOS)
- [CVE-2023-42973](https://cve.now/CVE-2023-42973.md): Private Browsing tabs may be accessed without authentication. (CVSS 4.0, Apple iOS and iPadOS)
- [CVE-2023-42981](https://cve.now/CVE-2023-42981.md): Processing a file may lead to a denial-of-service or potentially disclose memory contents. (CVSS 5.4, Apple macOS)
- [CVE-2025-32426](https://cve.now/CVE-2025-32426.md): Formie has a XSS vulnerability for email notification content for preview (CVSS 4.6, verbb formie · verbb/formie)
- [CVE-2025-32427](https://cve.now/CVE-2025-32427.md): Formie has a XSS vulnerability for importing forms (CVSS 5.3, verbb formie · verbb/formie)
- [CVE-2025-3421](https://cve.now/CVE-2025-3421.md): Everest Forms \<= 3.1.1 - Reflected Cross-Site Scripting (CVSS 6.1, wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…)
- [CVE-2025-3422](https://cve.now/CVE-2025-3422.md): Everest Forms \<= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 5.4, wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…)
- [CVE-2025-3439](https://cve.now/CVE-2025-3439.md): Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress \<= 3.1.1 - Unauthenticated PHP Object Injection (CVSS 9.8, wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…)
- [CVE-2024-13861](https://cve.now/CVE-2024-13861.md): A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3.10 allows local user (CVSS 7.8, Sophos Taegis Endpoint Agent)
- [CVE-2024-52280](https://cve.now/CVE-2024-52280.md): Users can issue watch commands for arbitrary resources (CVSS 7.7, SUSE rancher · github.com/rancher/steve)
- [CVE-2025-2575](https://cve.now/CVE-2025-2575.md): Z Companion \<= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, wpzita Z Companion)
- [CVE-2025-2541](https://cve.now/CVE-2025-2541.md): WP Project Manager \<= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, wedevs Project Manager – AI Powered Project Management, Tas…)
- [CVE-2024-52282](https://cve.now/CVE-2024-52282.md): Rancher Helm Applications may have sensitive values leaked (CVSS 6.2, SUSE rancher · github.com/rancher/rancher)
- [CVE-2025-23387](https://cve.now/CVE-2025-23387.md): Rancher's SAML-based login via CLI can be denied by unauthenticated users (CVSS 5.3, SUSE rancher · github.com/rancher/rancher)
- [CVE-2025-23388](https://cve.now/CVE-2025-23388.md): Unauthenticated stack overflow in /v3-public/authproviders API (CVSS 8.2, SUSE rancher · github.com/rancher/rancher)
- [CVE-2025-23389](https://cve.now/CVE-2025-23389.md): Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login (CVSS 8.4, SUSE rancher · github.com/rancher/rancher)
- [CVE-2025-23391](https://cve.now/CVE-2025-23391.md): Rancher: Restricted Administrator can change Administrator's passwords (CVSS 9.1, SUSE rancher · github.com/rancher/rancher)
- [CVE-2025-31932](https://cve.now/CVE-2025-31932.md): Deserialization of untrusted data issue exists in BizRobo! all versions. (CVSS 8.8, OPEN BizRobo!)
- [CVE-2025-31362](https://cve.now/CVE-2025-31362.md): Use of hard-coded cryptographic key issue exists in BizRobo! all versions. (CVSS 3.7, OPEN BizRobo!)
- [CVE-2025-2128](https://cve.now/CVE-2025-2128.md): Cost Calculator Builder \<= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order\_ids Parameter (CVSS 6.5, stylemix Cost Calculator Builder)
- [CVE-2025-32681](https://cve.now/CVE-2025-32681.md): WordPress Error Log Viewer By WP Guru plugin \<= 1.0.5 - SQL Injection vulnerability (CVSS 8.5, WP Guru Error Log Viewer)
- [CVE-2025-32672](https://cve.now/CVE-2025-32672.md): WordPress Ultimate Bootstrap Elements for Elementor plugin \<= 1.4.9 - Local File Inclusion Vulnerability (CVSS 8.1, g5theme Ultimate Bootstrap Elements for Elementor)
- [CVE-2025-32671](https://cve.now/CVE-2025-32671.md): WordPress Print Science Designer plugin \<= 1.3.155 - Arbitrary File Download vulnerability (CVSS 7.5, John Weissberg Print Science Designer)
- [CVE-2025-32663](https://cve.now/CVE-2025-32663.md): WordPress FAT Cooming Soon plugin \<= 1.1 - Local File Inclusion vulnerability (CVSS 8.1, roninwp FAT Cooming Soon)
- [CVE-2025-32656](https://cve.now/CVE-2025-32656.md): WordPress Testimonial Slider and Showcase Pro plugin \<= 2.3.15 - Local File Inclusion vulnerability (CVSS 8.1, RadiusTheme Testimonial Slider And Showcase Pro)
- [CVE-2025-32654](https://cve.now/CVE-2025-32654.md): WordPress Motors plugin \<= 1.4.71 - Local File Inclusion vulnerability (CVSS 8.1, Stylemix Motors)
- [CVE-2025-32650](https://cve.now/CVE-2025-32650.md): WordPress Accessibility Suite by Ability, Inc plugin \<= 4.18 - SQL Injection vulnerability (CVSS 8.5, Ability Accessibility Suite)
- [CVE-2025-32633](https://cve.now/CVE-2025-32633.md): WordPress Database Toolset Plugin \<= 1.8.4 - Arbitrary File Deletion vulnerability (CVSS 8.6, neoslab Database Toolset)
- [CVE-2025-32632](https://cve.now/CVE-2025-32632.md): WordPress Automatic Ban IP Plugin \<= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, KaizenCoders Automatic Ban IP)
- [CVE-2025-32631](https://cve.now/CVE-2025-32631.md): WordPress Oxygen MyData for WooCommerce plugin \<= 1.0.64 - Arbitrary File Deletion vulnerability (CVSS 8.6, oxygensuite Oxygen MyData for WooCommerce)
- [CVE-2025-32629](https://cve.now/CVE-2025-32629.md): WordPress WP-BusinessDirectory Plugin \<= 3.1.2 - Arbitrary File Deletion vulnerability (CVSS 8.6, CMSJunkie - WordPress Business Directory Plugins WP-Busines…)
- [CVE-2025-32627](https://cve.now/CVE-2025-32627.md): WordPress JS Job Manager plugin \<= 2.0.2 - Local File Inclusion vulnerability (CVSS 8.1, JoomSky JS Job Manager)
- [CVE-2025-32618](https://cve.now/CVE-2025-32618.md): WordPress Wishlist plugin \<= 1.0.46 - SQL Injection vulnerability (CVSS 8.5, PickPlugins Wishlist)
- [CVE-2025-32614](https://cve.now/CVE-2025-32614.md): WordPress EventON plugin \<= 2.4 - Local File Inclusion vulnerability (CVSS 8.8, Ashan Perera EventON)
- [CVE-2025-32607](https://cve.now/CVE-2025-32607.md): WordPress WpBookingly plugin \<= 1.3.0 - PHP Object Injection vulnerability (CVSS 9.8, magepeopleteam WpBookingly)
- [CVE-2025-32603](https://cve.now/CVE-2025-32603.md): WordPress WP Online Users Stats plugin \<= 1.0.0 - SQL Injection vulnerability (CVSS 9.3, HK WP Online Users Stats)
- [CVE-2025-32601](https://cve.now/CVE-2025-32601.md): WordPress Twispay Credit Card Payments Plugin \<= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Twispay Credit Card Payments)
- [CVE-2025-32600](https://cve.now/CVE-2025-32600.md): WordPress Tournamatch plugin \<= 4.7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tournamatch)
- [CVE-2025-32599](https://cve.now/CVE-2025-32599.md): WordPress Task Scheduler Plugin \<= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, miunosoft Task Scheduler)
- [CVE-2025-32598](https://cve.now/CVE-2025-32598.md): WordPress WP Table Builder plugin \<= 2.0.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Table Builder)
- [CVE-2025-32589](https://cve.now/CVE-2025-32589.md): WordPress Flexi – Guest Submit Plugin \<= 4.28 - Local File Inclusion vulnerability (CVSS 8.1, odude Flexi – Guest Submit)
- [CVE-2025-32587](https://cve.now/CVE-2025-32587.md): WordPress WooCommerce Pickupp plugin \<= 2.4.3 - Local File Inclusion vulnerability (CVSS 8.1, WooCommerce Pickupp)
- [CVE-2025-32586](https://cve.now/CVE-2025-32586.md): WordPress ABA PayWay Payment Gateway for WooCommerce Plugin \<= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ABA Bank ABA PayWay Payment Gateway for WooCommerce)
- [CVE-2025-32585](https://cve.now/CVE-2025-32585.md): WordPress Shop Products Filter Plugin \<= 1.2 - Local File Inclusion vulnerability (CVSS 7.5, Trusty Plugins Shop Products Filter)
- [CVE-2025-32579](https://cve.now/CVE-2025-32579.md): WordPress Sync Posts Plugin \<= 1.0 - Arbitrary File Upload vulnerability (CVSS 9.9, SoftClever Limited Sync Posts)
- [CVE-2025-32577](https://cve.now/CVE-2025-32577.md): WordPress Build App Online Plugin \<= 1.0.23 - Local File Inclusion vulnerability (CVSS 9.8, hakeemnala Build App Online)
- [CVE-2025-32569](https://cve.now/CVE-2025-32569.md): WordPress TableOn plugin \<= 1.0.4.3 - PHP Object Injection vulnerability (CVSS 9.8, RealMag777 TableOn)
- [CVE-2025-32568](https://cve.now/CVE-2025-32568.md): WordPress EmpikPlace for Woocommerce Plugin \<= 1.4.3 - PHP Object Injection vulnerability (CVSS 9.8, EmpikPlace for Woocommerce)
- [CVE-2025-32567](https://cve.now/CVE-2025-32567.md): WordPress Easy Post Duplicator Plugin \<= 1.0.1 - SQL Injection vulnerability (CVSS 8.5, dev02ali Easy Post Duplicator)
- [CVE-2025-32565](https://cve.now/CVE-2025-32565.md): WordPress Neon Product Designer Plugin \<= 2.2.0 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, vertim Neon Product Designer)
- [CVE-2025-32558](https://cve.now/CVE-2025-32558.md): WordPress Duplicate Title Checker Plugin \<= 1.2 - SQL Injection vulnerability (CVSS 8.5, ketanajani Duplicate Title Checker)
- [CVE-2025-32553](https://cve.now/CVE-2025-32553.md): WordPress RestroPres plugin \<= 3.2.8.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Magnigenie RestroPress)
- [CVE-2025-32551](https://cve.now/CVE-2025-32551.md): WordPress Connector to CiviCRM with CiviMcRestFace plugin \<= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jaap Jansma Connector to CiviCRM with CiviMcRestFace)
- [CVE-2025-32542](https://cve.now/CVE-2025-32542.md): WordPress Eazy Plugin Manager plugin \<= 4.3.0 - Broken Access Control vulnerability (CVSS 8.8, EazyPlugins Eazy Plugin Manager)
- [CVE-2025-32541](https://cve.now/CVE-2025-32541.md): WordPress WooCommerce Sales MIS Report Plugin \<= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, infosoftplugin WooCommerce Sales MIS Report)
- [CVE-2025-32539](https://cve.now/CVE-2025-32539.md): WordPress WooCommerce – Store Exporter plugin \<= 2.7.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Josh Kohlbach Store Exporter)
- [CVE-2025-32538](https://cve.now/CVE-2025-32538.md): WordPress Easy Post Duplicator Plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, dev02ali Easy Post Duplicator)
- [CVE-2025-32537](https://cve.now/CVE-2025-32537.md): WordPress Lock Your Updates Plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rachel Cherry Lock Your Updates)
- [CVE-2025-32536](https://cve.now/CVE-2025-32536.md): WordPress HTML5 Video Player with Playlist Plugin \<= 2.50 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sandeep Verma HTML5 Video Player with Playlist)
- [CVE-2025-32534](https://cve.now/CVE-2025-32534.md): WordPress Workbox Video from Vimeo & Youtube Plugin Plugin \<= 3.2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Workbox Video from Vimeo & Youtube)
- [CVE-2025-32525](https://cve.now/CVE-2025-32525.md): WordPress Interactive Geo Maps plugin \<= 1.6.24 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, MapGeo Interactive Geo Maps)
- [CVE-2025-32524](https://cve.now/CVE-2025-32524.md): WordPress MyWorks WooCommerce Sync for QuickBooks Online plugin \<= 2.9.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, MyWorks WooCommerce Sync for QuickBooks Online)
- [CVE-2025-32523](https://cve.now/CVE-2025-32523.md): WordPress WooCommerce – Payphone Gateway plugin \<= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WooCommerce – Payphone Gateway)
- [CVE-2025-32519](https://cve.now/CVE-2025-32519.md): WordPress IDonate plugin \<= 2.1.18 - Local File Inclusion vulnerability (CVSS 8.1, Foysal Imran IDonate)
- [CVE-2025-32517](https://cve.now/CVE-2025-32517.md): WordPress MultiMailer plugin \<= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, SCAND MultiMailer)
- [CVE-2025-32509](https://cve.now/CVE-2025-32509.md): WordPress Simple WP Events plugin \<= 1.8.17 - Arbitrary File Deletion vulnerability (CVSS 7.5, WPMinds Simple WP Events)
- [CVE-2025-32491](https://cve.now/CVE-2025-32491.md): WordPress Rankology SEO – On-site SEO plugin \<= 2.2.4 - Privilege Escalation Vulnerability (CVSS 9.8, Rankology SEO – On-site SEO)
- [CVE-2025-32144](https://cve.now/CVE-2025-32144.md): WordPress Job Board Manager Plugin \<= 2.1.61 - PHP Object Injection vulnerability (CVSS 8.8, PickPlugins Job Board Manager)
- [CVE-2025-32143](https://cve.now/CVE-2025-32143.md): WordPress Accordion plugin \<= 2.3.11 - PHP Object Injection vulnerability (CVSS 8.8, PickPlugins Accordion)
- [CVE-2025-31599](https://cve.now/CVE-2025-31599.md): WordPress Bulk Product Sync plugin \<= 8.6 - SQL Injection vulnerability (CVSS 9.3, N-Media Bulk Product Sync)
- [CVE-2025-31565](https://cve.now/CVE-2025-31565.md): WordPress WPSmartContracts plugin \<= 2.0.12 - SQL Injection vulnerability (CVSS 9.3, Lisandro Martinez WPSmartContracts)
- [CVE-2025-31379](https://cve.now/CVE-2025-31379.md): WordPress Insert HTML Here plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, programphases Insert HTML Here)
- [CVE-2025-31378](https://cve.now/CVE-2025-31378.md): WordPress Oppso Unit Converter plugin \<= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, danbwb Oppso Unit Converter)
- [CVE-2025-31041](https://cve.now/CVE-2025-31041.md): WordPress AnyTrack Affiliate Link Manager plugin \<= 1.0.4 - Broken Access Control Vulnerability (CVSS 7.5, AnyTrack Affiliate Link Manager)
- [CVE-2025-31040](https://cve.now/CVE-2025-31040.md): WordPress WP Food ordering and Restaurant Menu plugin \<= 2.7 - Local File Inclusion vulnerability (CVSS 8.1, Exthemes WP Food ordering and Restaurant Menu)
- [CVE-2025-31028](https://cve.now/CVE-2025-31028.md): WordPress WP Hide Categories plugin \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Huseyin Berberoglu WP Hide Categories)
- [CVE-2025-31021](https://cve.now/CVE-2025-31021.md): WordPress Mobile Smart plugin \<= v1.3.16 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, dolby\_uk Mobile Smart)
- [CVE-2025-31015](https://cve.now/CVE-2025-31015.md): WordPress SMTP Service, Email Delivery Solved! — MailHawk plugin \<= 1.3.1 - Local File Inclusion Vulnerability (CVSS 7.5, Adrian Tobey WordPress SMTP Service, Email Delivery Solved!…)
- [CVE-2025-31014](https://cve.now/CVE-2025-31014.md): WordPress Material Dashboard plugin \<= 1.4.5 - Local File Inclusion Vulnerability (CVSS 7.5, Hossein Material Dashboard)
- [CVE-2025-3434](https://cve.now/CVE-2025-3434.md): SMTP for Amazon SES – YaySMTP \<= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs (CVSS 7.2, yaycommerce SMTP for Amazon SES – YaySMTP)
- [CVE-2025-32107](https://cve.now/CVE-2025-32107.md): OS command injection vulnerability exists in Deco BE65 Pro firmware versions prior to "Deco BE65 Pro(JP)\_V1\_1.1.2 Build 20250123". (CVSS 8.0, TP-Link Corporation Limited Deco BE65 Pro)
- [CVE-2025-3512](https://cve.now/CVE-2025-3512.md): Buffer overflow in QTextMarkdownImporter (CVSS 4.8, Qt)
- [CVE-2025-1386](https://cve.now/CVE-2025-1386.md): Query smuggling in ch-go library (CVSS 5.9, ch-go · github.com/ClickHouse/ch-go)
- [CVE-2025-2636](https://cve.now/CVE-2025-2636.md): InstaWP Connect \<= 0.1.0.85 - Unauthenticated Local PHP File Inclusion (CVSS 8.1, InstaWP Connect – 1-click WP Staging & Migration)
- [CVE-2025-0128](https://cve.now/CVE-2025-0128.md): PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet (CVSS 8.7, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2025-0127](https://cve.now/CVE-2025-0127.md): PAN-OS: Authenticated Admin Command Injection Vulnerability in PAN-OS VM-Series (CVSS 7.1, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2025-0126](https://cve.now/CVE-2025-0126.md): PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login (CVSS 8.3, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2025-0125](https://cve.now/CVE-2025-0125.md): PAN-OS: Improper Neutralization of Input in the Management Web Interface (CVSS 6.9, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2025-0124](https://cve.now/CVE-2025-0124.md): PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface (CVSS 5.1, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2025-0122](https://cve.now/CVE-2025-0122.md): Prisma SD-WAN: Denial of Service (DoS) Vulnerability Through Burst of Crafted Packets (CVSS 5.1, Palo Alto Networks Prisma SD-WAN)
- [CVE-2025-0121](https://cve.now/CVE-2025-0121.md): Cortex XDR Agent: Local Windows User Can Crash the Agent (CVSS 6.8, Palo Alto Networks Cortex XDR Agent)
- [CVE-2025-0120](https://cve.now/CVE-2025-0120.md): GlobalProtect App: Local Privilege Escalation (PE) Vulnerability (CVSS 7.1, Palo Alto Networks GlobalProtect App · Palo Alto Networks G…)
- [CVE-2025-26335](https://cve.now/CVE-2025-26335.md): Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of Sensitive Information Into Sent Data vulnerability. (CVSS 5.8, Dell PowerProtect Cyber Recovery)
- [CVE-2024-51461](https://cve.now/CVE-2024-51461.md): IBM QRadar WinCollect Agent denial of service (CVSS 4.3, IBM QRadar WinCollect Agent)
- [CVE-2025-32367](https://cve.now/CVE-2025-32367.md): The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Referen (CVSS 8.6, Oz Forensics face recognition application)
- [CVE-2025-32808](https://cve.now/CVE-2025-32808.md): W. (CVSS 7.7, W. W. Norton InQuizitive)
- [CVE-2025-32809](https://cve.now/CVE-2025-32809.md): W. (CVSS 6.4, W. W. Norton InQuizitive)
- [CVE-2025-32816](https://cve.now/CVE-2025-32816.md): CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity. (CVSS 3.1, CodeLit CourseLit)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.