# CVEs published 2025-04-12

15 CVEs were published on April 12, 2025: 0 critical, 3 high. Days are UTC.

- [CVE-2025-2814](https://cve.now/CVE-2025-2814.md): Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions (CVSS 4.0, LDS Crypt::CBC)
- [CVE-2025-1456](https://cve.now/CVE-2025-1456.md): Royal Elementor Addons and Templates \<= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2025-1455](https://cve.now/CVE-2025-1455.md): Royal Elementor Addons and Templates \<= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2024-13338](https://cve.now/CVE-2024-13338.md): Webcraftic Clearfy – WordPress optimization plugin \<= 2.3.1 - Cross-Site Request Forgery to Clear Cache (CVSS 5.3, creativemotion Clearfy Cache – WordPress optimization plugi…)
- [CVE-2025-3276](https://cve.now/CVE-2025-3276.md): SKT Blocks – Gutenberg based Page Builder \<= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, sonalsinha21 SKT Blocks – Gutenberg based Page Builder)
- [CVE-2024-13337](https://cve.now/CVE-2024-13337.md): Webcraftic Clearfy – WordPress optimization plugin \<= 2.3.2 - Cross-Site Request Forgery to Plugin Settings Update via 'setup-wbcr\_clearfy' (CVSS 4.3, creativemotion Clearfy Cache – WordPress optimization plugi…)
- [CVE-2025-3282](https://cve.now/CVE-2025-3282.md): User Registration & Membership – Custom Registration Form, Login Form, and User Profile \<= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification (CVSS 5.3, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2025-3418](https://cve.now/CVE-2025-3418.md): WPC Admin Columns 2.0.6 - 2.1.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update (CVSS 8.8, wpclever WPC Admin Columns)
- [CVE-2025-3292](https://cve.now/CVE-2025-3292.md): User Registration & Membership – Custom Registration Form, Login Form, and User Profile \<= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update (CVSS 4.3, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2025-2871](https://cve.now/CVE-2025-2871.md): WordPress Mega Menu – QuadMenu \<= 3.2.0 - Cross-Site Request Forgery to Limited User Meta Update (CVSS 4.3, quadlayers QuadMenu – Mega Menu)
- [CVE-2025-2881](https://cve.now/CVE-2025-2881.md): Developer Toolbar \<= 1.0.3 - Unauthenticated Information Exposure (CVSS 5.3, bap22 Developer Toolbar)
- [CVE-2025-2841](https://cve.now/CVE-2025-2841.md): Cart66 Cloud \<= 2.3.7 - Unauthenticated Information Exposure (CVSS 5.3, reality66 Cart66 Cloud :: WordPress Ecommerce The Easy Way)
- [CVE-2025-29834](https://cve.now/CVE-2025-29834.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Edge)
- [CVE-2025-32726](https://cve.now/CVE-2025-32726.md): Visual Studio Code Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Visual Studio Code)
- [CVE-2025-29803](https://cve.now/CVE-2025-29803.md): Visual Studio Tools for Applications and SQL Server Management Studio Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft SQL Server Management Studio · Microsoft Visua… +2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.