# CVEs published 2025-04-17

314 CVEs were published on April 17, 2025: 38 critical, 201 high. Days are UTC.

- [CVE-2025-3246](https://cve.now/CVE-2025-3246.md): Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggers (CVSS 8.6, GitHub Enterprise Server)
- [CVE-2025-3509](https://cve.now/CVE-2025-3509.md): Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation (CVSS 7.1, GitHub Enterprise Server)
- [CVE-2025-3124](https://cve.now/CVE-2025-3124.md): Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository names (CVSS 5.3, GitHub Enterprise Server)
- [CVE-2024-42178](https://cve.now/CVE-2024-42178.md): HCL MyXalytics is affected by a failure to restrict URL access vulnerability (CVSS 2.5, HCL Software HCL MyXalytics)
- [CVE-2025-3765](https://cve.now/CVE-2025-3765.md): SourceCodester Web-based Pharmacy Product Management System edit-photo.php unrestricted upload (CVSS 5.3, SourceCodester Web-based Pharmacy Product Management System)
- [CVE-2025-3764](https://cve.now/CVE-2025-3764.md): SourceCodester Web-based Pharmacy Product Management System edit-product.php unrestricted upload (CVSS 5.3, SourceCodester Web-based Pharmacy Product Management System)
- [CVE-2024-42177](https://cve.now/CVE-2024-42177.md): HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities (CVSS 2.6, HCL Software HCL MyXalytics)
- [CVE-2025-3763](https://cve.now/CVE-2025-3763.md): SourceCodester Phone Management System Password main buffer overflow (CVSS 4.8, SourceCodester Phone Management System)
- [CVE-2025-3762](https://cve.now/CVE-2025-3762.md): PCMan FTP Server MPUT Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2021-47671](https://cve.now/CVE-2021-47671.md): can: etas\_es58x: es58x\_rx\_err\_msg(): fix memory leak in error path (CVSS 3.3, Linux)
- [CVE-2021-47670](https://cve.now/CVE-2021-47670.md): can: peak\_usb: fix use after free bugs (CVSS 8.8, Linux)
- [CVE-2021-47669](https://cve.now/CVE-2021-47669.md): can: vxcan: vxcan\_xmit: fix use after free bug (CVSS 7.8, Linux)
- [CVE-2021-47668](https://cve.now/CVE-2021-47668.md): can: dev: can\_restart: fix use after free bug (CVSS 8.8, Linux)
- [CVE-2020-36789](https://cve.now/CVE-2020-36789.md): can: dev: can\_get\_echo\_skb(): prevent call to kfree\_skb() in hard IRQ context (CVSS 5.5, Linux)
- [CVE-2025-2947](https://cve.now/CVE-2025-2947.md): IBM i privilege escalation (CVSS 7.2, IBM i)
- [CVE-2025-43015](https://cve.now/CVE-2025-43015.md): In JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfaces (CVSS 8.3, JetBrains RubyMine)
- [CVE-2025-43014](https://cve.now/CVE-2025-43014.md): In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation (CVSS 6.1, JetBrains Toolbox App)
- [CVE-2025-43013](https://cve.now/CVE-2025-43013.md): In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible (CVSS 6.9, JetBrains Toolbox App)
- [CVE-2025-43012](https://cve.now/CVE-2025-43012.md): In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible (CVSS 8.3, JetBrains Toolbox App)
- [CVE-2025-42921](https://cve.now/CVE-2025-42921.md): In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin (CVSS 4.2, JetBrains Toolbox App)
- [CVE-2025-23443](https://cve.now/CVE-2025-23443.md): WordPress Author Showcase plugin \<= 1.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Claire Ryan Author Showcase)
- [CVE-2025-23448](https://cve.now/CVE-2025-23448.md): WordPress visualslider Sldier plugin \<= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, dastan800 visualslider Sldier)
- [CVE-2025-23773](https://cve.now/CVE-2025-23773.md): WordPress Delete All Posts plugin \<= 1.1.1 - Broken Access Control vulnerability (CVSS 6.5, mingocommerce Delete All Posts)
- [CVE-2025-23782](https://cve.now/CVE-2025-23782.md): WordPress TotalContest Lite Plugin \<= 2.8.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, TotalSuite TotalContest Lite)
- [CVE-2025-23855](https://cve.now/CVE-2025-23855.md): WordPress SpiderDisplay plugin \<= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fyljp SpiderDisplay)
- [CVE-2025-23858](https://cve.now/CVE-2025-23858.md): WordPress Custom Users Order Plugin \<= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Hiren Patel Custom Users Order)
- [CVE-2025-23906](https://cve.now/CVE-2025-23906.md): WordPress WordPress Dashboard Tweeter plugin \<= 1.3.2 - Settings Change vulnerability (CVSS 6.5, wpseek WordPress Dashboard Tweeter)
- [CVE-2025-23958](https://cve.now/CVE-2025-23958.md): WordPress Editor Wysiwyg Background Color plugin \<= 1.0 - Broken Access Control vulnerability (CVSS 6.5, FADI MED Editor Wysiwyg Background Color)
- [CVE-2025-24539](https://cve.now/CVE-2025-24539.md): WordPress DeBounce Email Validator plugin \<= 5.6.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, DeBounce Email Validator)
- [CVE-2025-24548](https://cve.now/CVE-2025-24548.md): WordPress Autoglot – Automatic WordPress Translation plugin \<=2.4.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Autoglot – Automatic WordPress Translation)
- [CVE-2025-24550](https://cve.now/CVE-2025-24550.md): WordPress Job Manager plugin \<= 2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, JobScore Job Manager)
- [CVE-2025-24553](https://cve.now/CVE-2025-24553.md): WordPress Shipping with Venipak for WooCommerce plugin \<= 1.22.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Akadrama Shipping with Venipak for WooCommerce)
- [CVE-2025-24577](https://cve.now/CVE-2025-24577.md): WordPress Poll Maker plugin \<= 5.5.0 - Broken Access Control vulnerability (CVSS 6.5, Ays Pro Poll Maker)
- [CVE-2025-24581](https://cve.now/CVE-2025-24581.md): WordPress Instantio plugin \<= 3.3.7 - Settings Change vulnerability (CVSS 6.5, Themefic Instantio)
- [CVE-2025-24583](https://cve.now/CVE-2025-24583.md): WordPress 12 Step Meeting List plugin \<= 3.16.5 - Settings Change vulnerability (CVSS 6.5, AA Web Servant 12 Step Meeting List)
- [CVE-2025-24586](https://cve.now/CVE-2025-24586.md): WordPress Shipment Tracker for Woocommerce plugin \<= 1.4.23 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, bitsstech Shipment Tracker for Woocommerce)
- [CVE-2025-24619](https://cve.now/CVE-2025-24619.md): WordPress WP Log Action Plugin \<= 0.51 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, webheadcoder WP Log Action)
- [CVE-2025-24621](https://cve.now/CVE-2025-24621.md): WordPress Arconix Shortcodes plugin \<= 2.1.15 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tychesoftwares Arconix Shortcodes)
- [CVE-2025-24624](https://cve.now/CVE-2025-24624.md): WordPress HT Event – WordPress Event Manager Plugin for Elementor Plugin \<= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, DevItems HT Event)
- [CVE-2025-24637](https://cve.now/CVE-2025-24637.md): WordPress Beacon Lead Magnets and Lead Capture Plugin \<= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Syed Balkhi Beacon Lead Magnets and Lead Capture)
- [CVE-2025-24640](https://cve.now/CVE-2025-24640.md): WordPress Empty Tags Remover Plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dan-Lucian Stefancu Empty Tags Remover)
- [CVE-2025-24645](https://cve.now/CVE-2025-24645.md): WordPress Eazy Under Construction Plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rob Scott Eazy Under Construction)
- [CVE-2025-24651](https://cve.now/CVE-2025-24651.md): WordPress WebToffee WP Backup and Migration plugin \<= 1.5.3 - Sensitive Data Exposure vulnerability (CVSS 5.9, WebToffee WordPress Backup & Migration)
- [CVE-2025-24655](https://cve.now/CVE-2025-24655.md): WordPress Wishlist Plugin \<= 1.0.39 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PickPlugins Wishlist)
- [CVE-2025-24670](https://cve.now/CVE-2025-24670.md): WordPress Term Taxonomy Converter Plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dhanendran Rajagopal Term Taxonomy Converter)
- [CVE-2025-24737](https://cve.now/CVE-2025-24737.md): WordPress WP Helper Premium plugin \<= 4.6.1 - Broken Access Control vulnerability (CVSS 6.5, Mat Bao WP Helper Premium)
- [CVE-2025-24745](https://cve.now/CVE-2025-24745.md): WordPress Classified Listing plugin \<= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, RadiusTheme Classified Listing)
- [CVE-2025-24752](https://cve.now/CVE-2025-24752.md): WordPress Essential Addons for Elementor plugin \<= 6.0.14 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPDeveloper Essential Addons for Elementor)
- [CVE-2025-27282](https://cve.now/CVE-2025-27282.md): WordPress Theme File Duplicator Plugin \<= 1.3 - Arbitrary File Upload vulnerability (CVSS 9.9, rockgod100 Theme File Duplicator)
- [CVE-2025-27283](https://cve.now/CVE-2025-27283.md): WordPress Theme File Duplicator Plugin \<= 1.3 - Arbitrary File Download vulnerability (CVSS 6.5, rockgod100 Theme File Duplicator)
- [CVE-2025-27284](https://cve.now/CVE-2025-27284.md): WordPress Flagged Content Plugin \<= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, divspark Flagged Content)
- [CVE-2025-27285](https://cve.now/CVE-2025-27285.md): WordPress Easy Form by AYS Plugin \<= 2.6.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ays Pro Easy Form)
- [CVE-2025-27286](https://cve.now/CVE-2025-27286.md): WordPress Saoshyant Slider Plugin \<= 3.0 - PHP Object Injection vulnerability (CVSS 9.8, saoshyant1994 Saoshyant Slider)
- [CVE-2025-27287](https://cve.now/CVE-2025-27287.md): WordPress SS Quiz Plugin \<= 2.0.5 - PHP Object Injection vulnerability (CVSS 9.8, ssvadim SS Quiz)
- [CVE-2025-27288](https://cve.now/CVE-2025-27288.md): WordPress File Icons Plugin \<= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, BjornW File Icons)
- [CVE-2025-27289](https://cve.now/CVE-2025-27289.md): WordPress Restrict Taxonomies Plugin \<= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Antoine Guillien Restrict Taxonomies)
- [CVE-2025-27291](https://cve.now/CVE-2025-27291.md): WordPress Photo Gallery – Image Gallery Plugin \<= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, uxgallery WordPress Photo Gallery – Image Gallery)
- [CVE-2025-27292](https://cve.now/CVE-2025-27292.md): WordPress WPYog Documents Plugin \<= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PoppinsDigital.com WPYog Documents)
- [CVE-2025-27293](https://cve.now/CVE-2025-27293.md): WordPress Shipmozo Courier Tracking plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, webparexapp Shipmozo Courier Tracking)
- [CVE-2025-27295](https://cve.now/CVE-2025-27295.md): WordPress Live css plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpion Live css)
- [CVE-2025-27299](https://cve.now/CVE-2025-27299.md): WordPress MyTicket Events plugin \<= 1.2.4 - Non-Arbitrary File Read vulnerability (CVSS 5.3, WP Asia MyTicket Events)
- [CVE-2025-27302](https://cve.now/CVE-2025-27302.md): WordPress CHATLIVE plugin \<= 2.0.1 - SQL Injection vulnerability (CVSS 9.3, Claudio Adrian Marrero CHATLIVE)
- [CVE-2025-27308](https://cve.now/CVE-2025-27308.md): WordPress WP Video Posts plugin \<= 3.5.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, cmstactics WP Video Posts)
- [CVE-2025-27309](https://cve.now/CVE-2025-27309.md): WordPress flickr-slideshow-wrapper Plugin \<= 5.4.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jeannot Muller flickr-slideshow-wrapper)
- [CVE-2025-27310](https://cve.now/CVE-2025-27310.md): WordPress Page and Post Lister plugin \<= 1.2.1 - Arbitrary Content Deletion vulnerability (CVSS 6.5, Radius of Thought Page and Post Lister)
- [CVE-2025-27313](https://cve.now/CVE-2025-27313.md): WordPress Google Maps GPX Viewer Plugin \<= 3.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bernd Altmeier Google Maps GPX Viewer)
- [CVE-2025-27314](https://cve.now/CVE-2025-27314.md): WordPress Kush Micro News Plugin \<= 1.6.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kush Sharma Kush Micro News)
- [CVE-2025-27319](https://cve.now/CVE-2025-27319.md): WordPress User List plugin \<= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ivan82 User List)
- [CVE-2025-27322](https://cve.now/CVE-2025-27322.md): WordPress QR Code for WooCommerce Plugin \<= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bappa Mal QR Code for WooCommerce)
- [CVE-2025-27324](https://cve.now/CVE-2025-27324.md): WordPress 17TRACK for WooCommerce Plugin \<= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, 17TRACK for WooCommerce)
- [CVE-2025-27333](https://cve.now/CVE-2025-27333.md): WordPress Protected wp-login Plugin \<= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, alvego Protected wp-login)
- [CVE-2025-27337](https://cve.now/CVE-2025-27337.md): WordPress Fontsampler Plugin \<= 0.4.14 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kontur Fontsampler)
- [CVE-2025-27338](https://cve.now/CVE-2025-27338.md): WordPress List Urls Plugin \<= 0.2 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, graphems List Urls)
- [CVE-2025-27343](https://cve.now/CVE-2025-27343.md): WordPress WooCommerce HTML5 Video Plugin \<= 1.7.10 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Webilop WooCommerce HTML5 Video)
- [CVE-2025-27345](https://cve.now/CVE-2025-27345.md): WordPress Booking Ultra Pro Plugin \<= 1.1.19 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Deetronix Booking Ultra Pro)
- [CVE-2025-27346](https://cve.now/CVE-2025-27346.md): WordPress Rebuild Permalinks Plugin \<= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, gerrygooner Rebuild Permalinks)
- [CVE-2025-27354](https://cve.now/CVE-2025-27354.md): WordPress Simple Email Subscriber plugin \<= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, phil88530 Simple Email Subscriber)
- [CVE-2025-31006](https://cve.now/CVE-2025-31006.md): WordPress Activity Reactions For Buddypress plugin \<= 1.0.22 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, arete-it Activity Reactions For Buddypress)
- [CVE-2025-31018](https://cve.now/CVE-2025-31018.md): WordPress FireDrum Email Marketing plugin \<= 1.64 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, FireDrum Email Marketing)
- [CVE-2025-31030](https://cve.now/CVE-2025-31030.md): WordPress Ray Enterprise Translation plugin \<= 1.7.0 - Local File Inclusion via CSRF Vulnerability (CVSS 7.5, Jiro Sasamoto Ray Enterprise Translation)
- [CVE-2025-31380](https://cve.now/CVE-2025-31380.md): WordPress Paid Videochat Turnkey Site plugin \<= 7.3.11 - Broken Authentication Vulnerability (CVSS 9.8, videowhisper Paid Videochat Turnkey Site)
- [CVE-2025-32490](https://cve.now/CVE-2025-32490.md): WordPress wp secure plugin \<= 1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, WebsiteDefender wp secure)
- [CVE-2025-32504](https://cve.now/CVE-2025-32504.md): WordPress Silvasoft boekhouden plugin \<= 3.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Silvasoft boekhouden)
- [CVE-2025-32506](https://cve.now/CVE-2025-32506.md): WordPress AT Internet SmartTag plugin \<= 0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, BenDlz AT Internet SmartTag)
- [CVE-2025-32507](https://cve.now/CVE-2025-32507.md): WordPress Event Espresso plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Aakif Kadiwala Event Espresso – Custom Email Template Short…)
- [CVE-2025-32508](https://cve.now/CVE-2025-32508.md): WordPress Course Booking System plugin \<= 6.1.2 - Reflected Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, ComMotion Course Booking System)
- [CVE-2025-32511](https://cve.now/CVE-2025-32511.md): WordPress Make Email Customizer for WooCommerce plugin \<= 1.0.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Excellent Dynamics Make Email Customizer for WooCommerce)
- [CVE-2025-32512](https://cve.now/CVE-2025-32512.md): WordPress Revamp CRM for WooCommerce plugin \<= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, revampcrm Revamp CRM for WooCommerce)
- [CVE-2025-32513](https://cve.now/CVE-2025-32513.md): WordPress Total processing card payments for WooCommerce plugin \<= 7.1.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, totalprocessing Nomupay Payment Processing Gateway)
- [CVE-2025-32514](https://cve.now/CVE-2025-32514.md): WordPress WooCommerce Estimate and Quote plugin \<= 1.0.2.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, cscode WooCommerce Estimate and Quote)
- [CVE-2025-32515](https://cve.now/CVE-2025-32515.md): WordPress Terminal Africa plugin \<= 1.13.24 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, terminalafrica Terminal Africa)
- [CVE-2025-32516](https://cve.now/CVE-2025-32516.md): WordPress Related Videos for JW Player plugin \<= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ilGhera Related Videos for JW Player)
- [CVE-2025-32520](https://cve.now/CVE-2025-32520.md): WordPress WordPress Health and Server Condition plugin \<= 4.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, M. Ali Saleem WordPress Health and Server Condition – Integ…)
- [CVE-2025-32521](https://cve.now/CVE-2025-32521.md): WordPress Cool Flipbox plugin \<= 1.8.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CoolHappy Cool Flipbox – Shortcode & Gutenberg Block)
- [CVE-2025-32522](https://cve.now/CVE-2025-32522.md): WordPress License Manager for WooCommerce plugin \<= 3.0.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Saad Iqbal License Manager for WooCommerce)
- [CVE-2025-32526](https://cve.now/CVE-2025-32526.md): WordPress Zephyr Project Manager plugin \<= 3.3.101 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dylan James Zephyr Project Manager)
- [CVE-2025-32527](https://cve.now/CVE-2025-32527.md): WordPress T&P Gallery Slider plugin \<= 1.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, pey22 T&P Gallery Slider)
- [CVE-2025-32528](https://cve.now/CVE-2025-32528.md): WordPress iCal Feeds Plugin \<= 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, maximevalette iCal Feeds)
- [CVE-2025-32529](https://cve.now/CVE-2025-32529.md): WordPress iONE360 configurator plugin \<= 2.0.57 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, iONE360 configurator)
- [CVE-2025-32530](https://cve.now/CVE-2025-32530.md): WordPress Wallet System for WooCommerce plugin \<= 2.6.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Swings Wallet System for WooCommerce)
- [CVE-2025-32531](https://cve.now/CVE-2025-32531.md): WordPress Arconix FAQ plugin \<= 1.9.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tychesoftwares Arconix FAQ)
- [CVE-2025-32532](https://cve.now/CVE-2025-32532.md): WordPress UXsniff plugin \<= 1.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pei Yong Goh UXsniff)
- [CVE-2025-32533](https://cve.now/CVE-2025-32533.md): WordPress Deliver via Shipos for WooCommerce Plugin \<= 2.1.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Matat Technologies Deliver via Shipos for WooCommerce)
- [CVE-2025-32535](https://cve.now/CVE-2025-32535.md): WordPress DN Shipping by Weight for WooCommerce Plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, digireturn DN Shipping by Weight for WooCommerce)
- [CVE-2025-32540](https://cve.now/CVE-2025-32540.md): WordPress Feedify – Web Push Notifications plugin \<= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Feedify – Web Push Notifications)
- [CVE-2025-32544](https://cve.now/CVE-2025-32544.md): WordPress WooCommerce Loyal Customers plugin \<= 2.6 - Broken Access Control vulnerability (CVSS 7.5, The Right Software WooCommerce Loyal Customers)
- [CVE-2025-32545](https://cve.now/CVE-2025-32545.md): WordPress WooCommerce Products without featured images Plugin \<= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, SOFTAGON WooCommerce Products without featured images)
- [CVE-2025-32546](https://cve.now/CVE-2025-32546.md): WordPress All push notification for WP Plugin \<= 1.5.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, gtlwpdev All push notification for WP)
- [CVE-2025-32548](https://cve.now/CVE-2025-32548.md): WordPress Hamburger Icon Menu Lite Plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, borisolhor Hamburger Icon Menu Lite)
- [CVE-2025-32552](https://cve.now/CVE-2025-32552.md): WordPress MSRP (RRP) Pricing for WooCommerce Plugin \<= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPFactory MSRP (RRP) Pricing for WooCommerce)
- [CVE-2025-32554](https://cve.now/CVE-2025-32554.md): WordPress Raptive Ads plugin \<= 3.7.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Raptive Ads)
- [CVE-2025-32557](https://cve.now/CVE-2025-32557.md): WordPress WP Featured Screenshot Plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rico Macchi WP Featured Screenshot)
- [CVE-2025-32560](https://cve.now/CVE-2025-32560.md): WordPress WP-Hijri Plugin \<= 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mohammad I. Okfie WP-Hijri)
- [CVE-2025-32561](https://cve.now/CVE-2025-32561.md): WordPress WP\_DEBUG Toggle plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, plugins.club WP\_DEBUG Toggle)
- [CVE-2025-32562](https://cve.now/CVE-2025-32562.md): WordPress WP Easy Poll Plugin \<= 2.2.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, aviplugins.com WP Easy Poll)
- [CVE-2025-32564](https://cve.now/CVE-2025-32564.md): WordPress Stop Registration Spam Plugin \<= 1.24 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tomroyal Stop Registration Spam)
- [CVE-2025-32566](https://cve.now/CVE-2025-32566.md): WordPress License For Envato Plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ashraful Sarkar Naiem License For Envato)
- [CVE-2025-32571](https://cve.now/CVE-2025-32571.md): WordPress TuriTop Booking System Plugin \<= 1.0.10 - PHP Object Injection vulnerability (CVSS 8.8, TuriTop Booking System)
- [CVE-2025-32572](https://cve.now/CVE-2025-32572.md): WordPress Kata Plus Plugin \<= 1.5.3 - PHP Object Injection vulnerability (CVSS 9.8, Climax Themes Kata Plus)
- [CVE-2025-32573](https://cve.now/CVE-2025-32573.md): WordPress KiotViet Sync Plugin \<= 1.8.3 - SQL Injection vulnerability (CVSS 8.5, KiotViet Sync)
- [CVE-2025-32578](https://cve.now/CVE-2025-32578.md): WordPress Coming Soon Countdown Plugin \<= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mapro Collins Coming Soon Countdown)
- [CVE-2025-32582](https://cve.now/CVE-2025-32582.md): WordPress WP AutoKeyword Plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, EXEIdeas International WP AutoKeyword)
- [CVE-2025-32583](https://cve.now/CVE-2025-32583.md): WordPress PDF 2 Post Plugin \<= 2.4.0 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, termel PDF 2 Post)
- [CVE-2025-32588](https://cve.now/CVE-2025-32588.md): WordPress Credova\_Financial plugin \<= 2.4.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Credova Financial Credova\_Financial)
- [CVE-2025-32590](https://cve.now/CVE-2025-32590.md): WordPress Web2application Plugin \<= 6.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tzin111 Web2application)
- [CVE-2025-32592](https://cve.now/CVE-2025-32592.md): WordPress TableOn Plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, RealMag777 TableOn)
- [CVE-2025-32593](https://cve.now/CVE-2025-32593.md): WordPress Add Product Frontend for WooCommerce plugin \<= 1.0.8 - Arbitrary Content Deletion vulnerability (CVSS 8.2, Bytes Technolab Add Product Frontend for WooCommerce)
- [CVE-2025-32594](https://cve.now/CVE-2025-32594.md): WordPress Simple WP Events plugin \<= 1.8.17 - Sensitive Data Exposure vulnerability (CVSS 7.5, WPMinds Simple WP Events)
- [CVE-2025-32596](https://cve.now/CVE-2025-32596.md): WordPress Real Estate Manager plugin \<= 7.3 - Arbitrary Code Execution vulnerability (CVSS 7.3, Rameez Iqbal Real Estate Manager)
- [CVE-2025-32602](https://cve.now/CVE-2025-32602.md): WordPress WooMS Plugin \<= 9.12 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpcraft WooMS)
- [CVE-2025-32604](https://cve.now/CVE-2025-32604.md): WordPress AWSA Shipping Plugin \<= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sajjad Aslani AWSA Shipping)
- [CVE-2025-32605](https://cve.now/CVE-2025-32605.md): WordPress MemberPress Discord Addon Plugin \<= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, expresstechsoftware MemberPress Discord Addon)
- [CVE-2025-32606](https://cve.now/CVE-2025-32606.md): WordPress Listings for Buildium plugin \<= 0.1.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Deepak Khokhar Listings for Buildium)
- [CVE-2025-32608](https://cve.now/CVE-2025-32608.md): WordPress Movylo Marketing Automation Plugin \<= 2.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Movylo Marketing Automation)
- [CVE-2025-32609](https://cve.now/CVE-2025-32609.md): WordPress Verowa Connect Plugin \<= 3.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Picture-Planet Verowa Connect)
- [CVE-2025-32611](https://cve.now/CVE-2025-32611.md): WordPress WooCommerce TBC Credit Card Payment Gateway (Free) Plugin \<= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, We Are De WooCommerce TBC Credit Card Payment Gateway)
- [CVE-2025-32613](https://cve.now/CVE-2025-32613.md): WordPress Debug Log Manager plugin \<= 2.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bowo Debug Log Manager)
- [CVE-2025-32615](https://cve.now/CVE-2025-32615.md): WordPress Clinked Client Portal Plugin \<= 1.10 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Clinked Client Portal)
- [CVE-2025-32620](https://cve.now/CVE-2025-32620.md): WordPress Doppler Forms plugin \<= 2.4.6 - Broken Access Control vulnerability (CVSS 7.1, fromdoppler Doppler Forms)
- [CVE-2025-32622](https://cve.now/CVE-2025-32622.md): WordPress OTP-less one tap Sign in Plugin \<= 2.0.58 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, OTP-less one tap Sign in)
- [CVE-2025-32625](https://cve.now/CVE-2025-32625.md): WordPress Mobile Blocks Plugin \<= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, pootlepress Mobile Pages)
- [CVE-2025-32626](https://cve.now/CVE-2025-32626.md): WordPress JS Job Manager plugin \<= 2.0.2 - SQL Injection vulnerability (CVSS 9.3, JoomSky JS Job Manager)
- [CVE-2025-32628](https://cve.now/CVE-2025-32628.md): WordPress Crowdfunding for WooCommerce Plugin \<= 3.1.12 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Wham Crowdfunding for WooCommerce)
- [CVE-2025-32630](https://cve.now/CVE-2025-32630.md): WordPress WP-BusinessDirectory Plugin \<= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CMSJunkie - WordPress Business Directory Plugins WP-Busines…)
- [CVE-2025-32634](https://cve.now/CVE-2025-32634.md): WordPress Run Contests, Raffles, and Giveaways plugin \<= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mdedev Run Contests, Raffles, and Giveaways with ContestsWP)
- [CVE-2025-32635](https://cve.now/CVE-2025-32635.md): WordPress Hive Support plugin \<= 1.2.6 - Sensitive Data Exposure vulnerability (CVSS 7.5, Hive Support)
- [CVE-2025-32636](https://cve.now/CVE-2025-32636.md): WordPress Local Magic plugin \<= 2.9.0 - SQL Injection vulnerability (CVSS 9.3, matthewrubin Local Magic)
- [CVE-2025-32637](https://cve.now/CVE-2025-32637.md): WordPress WP Donate Plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ketanajani WP Donate)
- [CVE-2025-32638](https://cve.now/CVE-2025-32638.md): WordPress ShopApper plugin \<= 0.4.61 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, weptile Mobile App for WooCommerce)
- [CVE-2025-32639](https://cve.now/CVE-2025-32639.md): WordPress Affiliate Links plugin \<= 3.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wecantrack Affiliate Links Lite)
- [CVE-2025-32646](https://cve.now/CVE-2025-32646.md): WordPress Question Answer plugin \<= 1.2.70 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PickPlugins Question Answer)
- [CVE-2025-32647](https://cve.now/CVE-2025-32647.md): WordPress Question Answer plugin \<= 1.2.73 - PHP Object Injection vulnerability (CVSS 8.8, PickPlugins Question Answer)
- [CVE-2025-32648](https://cve.now/CVE-2025-32648.md): WordPress Projectopia plugin \<= 5.1.24 - Privilege Escalation vulnerability (CVSS 9.8, Projectopia)
- [CVE-2025-32649](https://cve.now/CVE-2025-32649.md): WordPress GB Gallery Slideshow Plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, gb-plugins GB Gallery Slideshow)
- [CVE-2025-32651](https://cve.now/CVE-2025-32651.md): WordPress SERPed.net Plugin \<= 4.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, serpednet SERPed.net)
- [CVE-2025-32652](https://cve.now/CVE-2025-32652.md): WordPress Solace Extra plugin \<= 1.3.1 - Arbitrary File Upload vulnerability (CVSS 9.9, solacewp Solace Extra)
- [CVE-2025-32653](https://cve.now/CVE-2025-32653.md): WordPress Cart66 Cloud Plugin \<= 2.3.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Lee Blue Cart66 Cloud)
- [CVE-2025-32655](https://cve.now/CVE-2025-32655.md): WordPress Restrict User Registration plugin \<= 1.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, DevriX Restrict User Registration)
- [CVE-2025-32658](https://cve.now/CVE-2025-32658.md): WordPress HelpGent plugin \<= 2.2.5 - PHP Object Injection vulnerability (CVSS 9.8, wpWax HelpGent)
- [CVE-2025-32660](https://cve.now/CVE-2025-32660.md): WordPress JS Job Manager plugin \<= 2.0.2 - Arbitrary File Upload vulnerability (CVSS 10.0, JoomSky JS Job Manager)
- [CVE-2025-32662](https://cve.now/CVE-2025-32662.md): WordPress uListing plugin \<= 2.2.0 - Deserialization of untrusted data vulnerability (CVSS 8.8, Stylemix uListing)
- [CVE-2025-32665](https://cve.now/CVE-2025-32665.md): WordPress Office Locator plugin \<= 1.3.0 - SQL Injection vulnerability (CVSS 9.3, WebbyTemplate Office Locator)
- [CVE-2025-32666](https://cve.now/CVE-2025-32666.md): WordPress Hive Support plugin \<= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Hive Support)
- [CVE-2025-32670](https://cve.now/CVE-2025-32670.md): WordPress Spark GF Failed Submissions plugin \<= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mark Parnell Spark GF Failed Submissions)
- [CVE-2025-32674](https://cve.now/CVE-2025-32674.md): WordPress Product Excel Import Export & Bulk Edit for WooCommerce plugin \<= 4.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, WPFactory Product Excel Import Export & Bulk Edit for WooCo…)
- [CVE-2025-32682](https://cve.now/CVE-2025-32682.md): WordPress MapSVG Lite plugin \<= 8.6.4 - Arbitrary File Upload Vulnerability (CVSS 9.9, RomanCode MapSVG)
- [CVE-2025-32686](https://cve.now/CVE-2025-32686.md): WordPress Team Members plugin \<= 3.4.4 - PHP Object Injection Vulnerability (CVSS 8.8, WPSpeedo Team Members)
- [CVE-2025-39519](https://cve.now/CVE-2025-39519.md): WordPress Bulk Page Stub Creator plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, runthings.dev Bulk Page Stub Creator)
- [CVE-2025-39521](https://cve.now/CVE-2025-39521.md): WordPress Contact Form vCard Generator plugin \<= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ashish Ajani Contact Form vCard Generator)
- [CVE-2025-39526](https://cve.now/CVE-2025-39526.md): WordPress Hotel Booking Plugin \<= 3.6 - Local File Inclusion vulnerability (CVSS 8.1, nicdark Hotel Booking)
- [CVE-2025-39527](https://cve.now/CVE-2025-39527.md): WordPress Rating by BestWebSoft plugin \<= 1.7 - PHP Object Injection Vulnerability (CVSS 8.8, bestweblayout Rating by BestWebSoft)
- [CVE-2025-39532](https://cve.now/CVE-2025-39532.md): WordPress Spice Blocks plugin \<= 2.0.7.7 - Broken Access Control vulnerability (CVSS 7.5, spicethemes Spice Blocks)
- [CVE-2025-39533](https://cve.now/CVE-2025-39533.md): WordPress Starfish Review Generation & Marketing plugin \<= 3.1.19 - Privilege Escalation vulnerability (CVSS 8.8, Starfish Reviews Starfish Review Generation & Marketing)
- [CVE-2025-39535](https://cve.now/CVE-2025-39535.md): WordPress Vitepos plugin \<= 3.1.7 - Broken Authentication Vulnerability (CVSS 7.2, appsbd Vitepos)
- [CVE-2025-39542](https://cve.now/CVE-2025-39542.md): WordPress Xelion Webchat plugin \<= 9.1.0 - Privilege Escalation Vulnerability (CVSS 8.8, Jauhari Xelion Xelion Webchat)
- [CVE-2025-39550](https://cve.now/CVE-2025-39550.md): WordPress FluentCommunity plugin \<= 1.2.15 - PHP Object Injection Vulnerability (CVSS 9.8, Shahjahan Jewel FluentCommunity)
- [CVE-2025-39551](https://cve.now/CVE-2025-39551.md): WordPress FluentBoards plugin \<= 1.47 - PHP Object Injection Vulnerability (CVSS 9.8, Mahmudul Hasan Arif FluentBoards)
- [CVE-2025-39554](https://cve.now/CVE-2025-39554.md): WordPress AI Text to Speech plugin \<= 3.0.3 - Broken Access Control vulnerability (CVSS 6.5, Elliot Sowersby / RelyWP AI Text to Speech)
- [CVE-2025-39558](https://cve.now/CVE-2025-39558.md): WordPress CRM Perks plugin \<= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CRM Perks)
- [CVE-2025-39559](https://cve.now/CVE-2025-39559.md): WordPress Bring Fraktguiden for WooCommerce plugin \<= 1.11.4 - Broken Access Control vulnerability (CVSS 6.5, Eivin Landa Bring Fraktguiden for WooCommerce)
- [CVE-2025-39562](https://cve.now/CVE-2025-39562.md): WordPress Payment Form for PayPal Pro plugin \<= 1.1.72 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, codepeople Payment Form for PayPal Pro)
- [CVE-2025-39567](https://cve.now/CVE-2025-39567.md): WordPress Web Directory Free plugin \<= 1.7.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Shamalli Web Directory Free)
- [CVE-2025-39568](https://cve.now/CVE-2025-39568.md): WordPress StoreContrl Woocommerce plugin \<= 4.1.3 - Arbitrary File Download Vulnerability (CVSS 7.5, Arture B.V. StoreContrl Woocommerce)
- [CVE-2025-39569](https://cve.now/CVE-2025-39569.md): WordPress Taskbuilder plugin \<= 4.0.1 - SQL Injection Vulnerability (CVSS 8.5, Taskbuilder)
- [CVE-2025-39580](https://cve.now/CVE-2025-39580.md): WordPress Dashi plugin \<= 3.1.8 - Broken Access Control Vulnerability (CVSS 5.8, jidaikobo Dashi)
- [CVE-2025-39583](https://cve.now/CVE-2025-39583.md): WordPress BERTHA AI plugin \<= 1.12.10.2 - Arbitrary Content Deletion Vulnerability (CVSS 7.1, Bertha AI – Andrew Palmer BERTHA AI)
- [CVE-2025-39586](https://cve.now/CVE-2025-39586.md): WordPress ProfileGrid plugin \<= 5.9.4.8 - SQL Injection Vulnerability (CVSS 8.5, Metagauss ProfileGrid)
- [CVE-2025-39587](https://cve.now/CVE-2025-39587.md): WordPress Cost Calculator Builder plugin \<= 3.2.65 - SQL Injection Vulnerability (CVSS 9.3, Stylemix Cost Calculator Builder)
- [CVE-2025-39588](https://cve.now/CVE-2025-39588.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 2.4.0 - Deserialization of untrusted data Vulnerability (CVSS 9.8, bdthemes Ultimate Store Kit Elementor Addons)
- [CVE-2025-39594](https://cve.now/CVE-2025-39594.md): WordPress Arigato Autoresponder and Newsletter plugin \<= 2.7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bob Arigato Autoresponder and Newsletter)
- [CVE-2025-39595](https://cve.now/CVE-2025-39595.md): WordPress Quentn WP plugin \<= 1.2.8 - SQL Injection Vulnerability (CVSS 9.3, Quentn.com Quentn WP)
- [CVE-2025-39596](https://cve.now/CVE-2025-39596.md): WordPress Quentn WP plugin \<= 1.2.8 - Privilege Escalation Vulnerability (CVSS 9.8, Quentn.com Quentn WP)
- [CVE-2024-12530](https://cve.now/CVE-2024-12530.md): Insecure Dynamic-Link Library (DLL) Load vulnerability (CVSS 7.0, OpenText Secure Content Manager)
- [CVE-2025-22340](https://cve.now/CVE-2025-22340.md): WordPress Data Dash plugin \<= 1.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Think201 Data Dash)
- [CVE-2025-22565](https://cve.now/CVE-2025-22565.md): WordPress vooPlayer v4 Plugin \<= 4.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bill Zimmerman vooPlayer)
- [CVE-2025-22636](https://cve.now/CVE-2025-22636.md): WordPress VR-Frases plugin \<= 4.0.1 - Reflected XSS to SQL Injection vulnerability (CVSS 8.2, Vicente Ruiz Gálvez VR-Frases)
- [CVE-2025-22651](https://cve.now/CVE-2025-22651.md): WordPress Stylish Google Sheet Reader plugin \<= 4.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wppluginboxdev Stylish Google Sheet Reader)
- [CVE-2025-22655](https://cve.now/CVE-2025-22655.md): WordPress CWD - Stealth Links plugin \<= 1.3 - SQL Injection vulnerability (CVSS 9.3, Caio Web Dev CWD – Stealth Links)
- [CVE-2025-22692](https://cve.now/CVE-2025-22692.md): WordPress Sponsered Link plugin \<= 4.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, rachanaS Sponsered Link)
- [CVE-2025-22771](https://cve.now/CVE-2025-22771.md): WordPress The Great Firewords of China plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Studio Hyperset The Great Firewords of China)
- [CVE-2025-22774](https://cve.now/CVE-2025-22774.md): WordPress CRUDLab Scroll to Top Plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CRUDLab Scroll to Top)
- [CVE-2025-22796](https://cve.now/CVE-2025-22796.md): WordPress WP-Asambleas Plugin \<= 2.85.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, platcom WP-Asambleas)
- [CVE-2025-26968](https://cve.now/CVE-2025-26968.md): WordPress Cloak Front End Email \<= 1.9.5 - Broken Access Control Vulnerability (CVSS 7.5, webbernaut Cloak Front End Email)
- [CVE-2025-39414](https://cve.now/CVE-2025-39414.md): WordPress spam-stopper plugin \<= 3.1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, Mike spam-stopper)
- [CVE-2025-39415](https://cve.now/CVE-2025-39415.md): WordPress Social Media Links plugin \<= 1.0.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, Jayesh Parejiya Social Media Links)
- [CVE-2025-39416](https://cve.now/CVE-2025-39416.md): WordPress translit it! plugin \<= 1.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, Ichi translit it!)
- [CVE-2025-39417](https://cve.now/CVE-2025-39417.md): WordPress Redirect wordpress to welcome or landing page plugin \<= 2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Eslam Mahmoud Redirect wordpress to welcome or landing page)
- [CVE-2025-39418](https://cve.now/CVE-2025-39418.md): WordPress RSS Manager plugin \<= 0.06 - CSRF to Stored XSS vulnerability (CVSS 7.1, ajayver RSS Manager)
- [CVE-2025-39419](https://cve.now/CVE-2025-39419.md): WordPress Revision Diet plugin \<= 1.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, David Miller Revision Diet)
- [CVE-2025-39420](https://cve.now/CVE-2025-39420.md): WordPress WP Twitter Button plugin \<= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, ruudkok WP Twitter Button)
- [CVE-2025-39421](https://cve.now/CVE-2025-39421.md): WordPress WP Sticky Side Buttons plugin \<= 2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Mustafa KUCUK WP Sticky Side Buttons)
- [CVE-2025-39422](https://cve.now/CVE-2025-39422.md): WordPress WP Social Bookmarking plugin \<= 3.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, PResponsive WP Social Bookmarking)
- [CVE-2025-39423](https://cve.now/CVE-2025-39423.md): WordPress Add to Header plugin \<= 1.0 - CSRF to XSS vulnerability (CVSS 7.1, Jenst Add to Header)
- [CVE-2025-39424](https://cve.now/CVE-2025-39424.md): WordPress Simple Maps plugin \<= 0.98 - CSRF to XSS vulnerability (CVSS 7.1, simplemaps Simple Maps)
- [CVE-2025-39425](https://cve.now/CVE-2025-39425.md): WordPress Style Manager plugin \<= 2.2.7 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, pixelgrade Style Manager)
- [CVE-2025-39426](https://cve.now/CVE-2025-39426.md): WordPress illow – Cookies Consent plugin \<= 0.2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, illow – Cookies Consent)
- [CVE-2025-39427](https://cve.now/CVE-2025-39427.md): WordPress WP Post to PDF Enhanced plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Beth Tucker Long WP Post to PDF Enhanced)
- [CVE-2025-39428](https://cve.now/CVE-2025-39428.md): WordPress Gravity Forms CSS Themes with Fontawesome and Placeholders plugin \<= 8.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Maros Pristas Gravity Forms CSS Themes with Fontawesome and…)
- [CVE-2025-39429](https://cve.now/CVE-2025-39429.md): WordPress Széchenyi 2020 Logo \<= 1.1 - Local File Inclusion vulnerability (CVSS 7.5, Földesi, Mihály Széchenyi 2020 Logo)
- [CVE-2025-39430](https://cve.now/CVE-2025-39430.md): WordPress mLanguage plugin \<= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Alexander Rauscha mLanguage)
- [CVE-2025-39431](https://cve.now/CVE-2025-39431.md): WordPress Amazon Showcase WordPress Plugin plugin \<= 2.2 - CSRF to XSS vulnerability (CVSS 7.1, Aaron Forgue Amazon Showcase WordPress Plugin)
- [CVE-2025-39432](https://cve.now/CVE-2025-39432.md): WordPress bbPress2 shortcode whitelist plugin \<= 2.2.1 - CSRF to XSS vulnerability (CVSS 7.1, antonchanning bbPress2 shortcode whitelist)
- [CVE-2025-39433](https://cve.now/CVE-2025-39433.md): WordPress Bknewsticker plugin \<= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, beke\_ro Bknewsticker)
- [CVE-2025-39434](https://cve.now/CVE-2025-39434.md): WordPress Avatar plugin \<= 0.1.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Scott Taylor Avatar)
- [CVE-2025-39435](https://cve.now/CVE-2025-39435.md): WordPress My Marginalia plugin \<= 1.0.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, davidfcarr My Marginalia)
- [CVE-2025-39436](https://cve.now/CVE-2025-39436.md): WordPress I Draw \<= 1.0 - Arbitrary File Upload Vulnerability (CVSS 9.1, aidraw I Draw)
- [CVE-2025-39437](https://cve.now/CVE-2025-39437.md): WordPress Anthologize plugin \<= 0.8.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Boone Gorges Anthologize)
- [CVE-2025-39438](https://cve.now/CVE-2025-39438.md): WordPress Theme Changer plugin \<= 1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, momen2009 Theme Changer)
- [CVE-2025-39439](https://cve.now/CVE-2025-39439.md): WordPress wpLike2Get plugin \<= 1.2.9 - Sensitive Data Exposure vulnerability (CVSS 5.3, Markus Drubba wpLike2Get)
- [CVE-2025-39440](https://cve.now/CVE-2025-39440.md): WordPress Broken Links Remover plugin \<= 1.2.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Rajesh Broken Links Remover)
- [CVE-2025-39441](https://cve.now/CVE-2025-39441.md): WordPress Dashboard Notepads plugin \<= 1.2.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, swedish boy Dashboard Notepads)
- [CVE-2025-39442](https://cve.now/CVE-2025-39442.md): WordPress Review Wave – Google Places Reviews plugin \<= 1.4.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, MessageMetric Review Wave – Google Places Reviews)
- [CVE-2025-39444](https://cve.now/CVE-2025-39444.md): WordPress MaxButtons plugin \<= 9.8.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, maxfoundry MaxButtons)
- [CVE-2025-39443](https://cve.now/CVE-2025-39443.md): WordPress Verge3D plugin \<= 4.9.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Soft8Soft Verge3D)
- [CVE-2025-39452](https://cve.now/CVE-2025-39452.md): WordPress WPCafe plugin \<= 2.2.32 - Local File Inclusion vulnerability (CVSS 7.5, Arraytics WPCafe)
- [CVE-2025-39453](https://cve.now/CVE-2025-39453.md): WordPress Advanced Dynamic Pricing for WooCommerce plugin \<= 4.9.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, algol.plus Advanced Dynamic Pricing for WooCommerce)
- [CVE-2025-39455](https://cve.now/CVE-2025-39455.md): WordPress IP2Location Variables plugin \<= 2.9.5 - CSRF to Cross Site Scripting (XSS) vulnerability (CVSS 7.1, IP2Location Variables)
- [CVE-2025-39456](https://cve.now/CVE-2025-39456.md): WordPress WP Logger plugin \<= 2.2 - Broken Access Control vulnerability (CVSS 5.4, iTRON WP Logger)
- [CVE-2025-39457](https://cve.now/CVE-2025-39457.md): WordPress Booking and Rental Manager plugin \<= 2.2.8 - Broken Access Control vulnerability (CVSS 5.3, magepeopleteam Booking and Rental Manager)
- [CVE-2025-39461](https://cve.now/CVE-2025-39461.md): WordPress Docket Cache plugin \<= 24.07.02 - Local File Inclusion vulnerability (CVSS 7.5, Nawawi Jamili Docket Cache)
- [CVE-2025-39462](https://cve.now/CVE-2025-39462.md): WordPress Smart Agreements plugin \<= 1.0.3 - Local File Inclusion vulnerability (CVSS 7.5, teamzt Smart Agreements)
- [CVE-2025-39464](https://cve.now/CVE-2025-39464.md): WordPress AdminQuickbar plugin \<= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, rtowebsites AdminQuickbar)
- [CVE-2025-25234](https://cve.now/CVE-2025-25234.md): Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability. (CVSS 7.1, Omnissa Unified Access Gateway)
- [CVE-2025-3651](https://cve.now/CVE-2025-3651.md): Command Injection in iManage Work Desktop for Mac's Agent Service (CVSS 9.3, iManage Work Desktop for Mac)
- [CVE-2022-26323](https://cve.now/CVE-2022-26323.md): Incorrect Use of Privileged vulnerability has been discovered on OpenText™ UCMDB and Operation Bridge Manager product. (CVSS 8.7, OpenText™ Operations Bridge Manager · OpenText™ Operatio… +1)
- [CVE-2025-3760](https://cve.now/CVE-2025-3760.md): A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and (CVSS 4.8, Liferay Portal · Liferay DXP +2)
- [CVE-2025-26477](https://cve.now/CVE-2025-26477.md): Dell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability. (CVSS 4.3, Dell ECS)
- [CVE-2025-26478](https://cve.now/CVE-2025-26478.md): Dell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. (CVSS 3.1, Dell ECS)
- [CVE-2025-3479](https://cve.now/CVE-2025-3479.md): Forminator \<= 1.42.0 - Order Replay Vulnerability (CVSS 5.3, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2025-3487](https://cve.now/CVE-2025-3487.md): Forminator \<= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit' (CVSS 6.4, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2025-3453](https://cve.now/CVE-2025-3453.md): Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products \<= 2.7.7 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, saadiqbal Password Protected — Lock Entire Site, Pages, Pos…)
- [CVE-2025-29931](https://cve.now/CVE-2025-29931.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 3.7, Siemens TeleControl Server Basic)
- [CVE-2025-1532](https://cve.now/CVE-2025-1532.md): Code Injection Vulnerability in Phoneservice (CVSS 8.1, com.hihonor.phoneservice)
- [CVE-2025-2188](https://cve.now/CVE-2025-2188.md): Whitelist bypass Vulnerability in GameCenter (CVSS 8.1, com.hihonor.gamecenter)
- [CVE-2025-2197](https://cve.now/CVE-2025-2197.md): Type Confusion Vulnerability in Browser (CVSS 4.3, com. hihonor.baidu.browser)
- [CVE-2025-3615](https://cve.now/CVE-2025-3615.md): Fluent Forms \<= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2025-2903](https://cve.now/CVE-2025-2903.md): Privilege Chaining in Delphix (CVSS 8.5, Perforce Delphix)
- [CVE-2025-3113](https://cve.now/CVE-2025-3113.md): Improper Access Control in Delphix Masking Engine (CVSS 9.0, Perforce Delphix)
- [CVE-2025-1525](https://cve.now/CVE-2025-1525.md): Ultimate Dashboard \< 3.8.6 - Admin+ Stored XSS (CVSS 3.5, Ultimate Dashboard)
- [CVE-2025-1524](https://cve.now/CVE-2025-1524.md): Ultimate Dashboard \< 3.8.6 - Admin+ Stored XSS (CVSS 3.5, Ultimate Dashboard)
- [CVE-2025-1523](https://cve.now/CVE-2025-1523.md): Ultimate Dashboard \< 3.8.6 - Admin+ Stored XSS (CVSS 3.5, Ultimate Dashboard)
- [CVE-2024-13925](https://cve.now/CVE-2024-13925.md): Klarna Checkout for WooCommerce \< 2.13.5 - DoS via Excessive Logging (CVSS 7.5, Klarna Checkout for WooCommerce)
- [CVE-2024-11924](https://cve.now/CVE-2024-11924.md): Email Subscribers \< 5.7.52 - Admin+ Stored XSS (CVSS 3.5, Icegram Express formerly known as Email Subscribers)
- [CVE-2025-3294](https://cve.now/CVE-2025-3294.md): WP Editor \<= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Update (CVSS 7.2, benjaminprojas WP Editor)
- [CVE-2025-3295](https://cve.now/CVE-2025-3295.md): WP Editor \<= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read (CVSS 4.9, benjaminprojas WP Editor)
- [CVE-2025-31338](https://cve.now/CVE-2025-31338.md): Wisdom Master Pro - Missing Authorization (CVSS 6.9, SUNNET Technology Co. Wisdom Master Pro)
- [CVE-2025-31339](https://cve.now/CVE-2025-31339.md): Wisdom Master Pro - Unrestricted Upload of File with Dangerous Type (CVSS 5.3, SUNNET Technology Co. Wisdom Master Pro)
- [CVE-2025-31340](https://cve.now/CVE-2025-31340.md): Wisdom Master Pro - Improper Control of Filename for Include/Require Statement in PHP Program (CVSS 9.9, SUNNET Technology Co. Wisdom Master Pro)
- [CVE-2025-1290](https://cve.now/CVE-2025-1290.md): A race condition Use-After-Free vulnerability exists in the virtio\_transport\_space\_update function within the Kernel 5.4 on ChromeOS. (CVSS 8.1, Google ChromeOS)
- [CVE-2024-40124](https://cve.now/CVE-2024-40124.md): Pydio Core \<= 8.2.5 is vulnerable to Cross Site Scripting (XSS) via the New URL Bookmark feature. (CVSS 5.4)
- [CVE-2024-53924](https://cve.now/CVE-2024-53924.md): Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginni (CVSS 9.8, pycel)
- [CVE-2024-55211](https://cve.now/CVE-2024-55211.md): An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie. (CVSS 8.4)
- [CVE-2024-55238](https://cve.now/CVE-2024-55238.md): OpenMetadata \<=1.4.1 is vulnerable to SQL Injection. (CVSS 7.1, org.open-metadata:openmetadata-service)
- [CVE-2024-56518](https://cve.now/CVE-2024-56518.md): Hazelcast Management Center through 6.0 allows remote code execution via a JndiLoginModule user.provider.url in a hazelcast-client XML docum (CVSS 9.8)
- [CVE-2025-25454](https://cve.now/CVE-2025-25454.md): Tenda AC10 V4.0si\_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanSpeed2. (CVSS 7.5)
- [CVE-2025-25455](https://cve.now/CVE-2025-25455.md): Tenda AC10 V4.0si\_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanMTU2. (CVSS 7.5)
- [CVE-2025-25457](https://cve.now/CVE-2025-25457.md): Tenda AC10 V4.0si\_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via cloneType2. (CVSS 7.5)
- [CVE-2025-26268](https://cve.now/CVE-2025-26268.md): DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service (daemon crash) via a crafted Redis command. (CVSS 3.3, DragonflyDB Dragonfly)
- [CVE-2025-26269](https://cve.now/CVE-2025-26269.md): DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua libr (CVSS 3.3, DragonflyDB Dragonfly)
- [CVE-2025-28009](https://cve.now/CVE-2025-28009.md): A SQL Injection vulnerability exists in the \`u\` parameter of the progress-body-weight.php endpoint of Dietiqa App v1.0.20. (CVSS 9.8)
- [CVE-2025-28101](https://cve.now/CVE-2025-28101.md): An arbitrary file deletion vulnerability in the /post/{postTitle} component of flaskBlog v2.6.1 allows attackers to delete article titles cr (CVSS 6.5)
- [CVE-2025-29015](https://cve.now/CVE-2025-29015.md): Code Astro Internet Banking System 2.0.0 is vulnerable to Cross Site Scripting (XSS) via the name parameter in /admin/pages\_account.php. (CVSS 6.1)
- [CVE-2025-29039](https://cve.now/CVE-2025-29039.md): An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x41dda8 (CVSS 7.2)
- [CVE-2025-29040](https://cve.now/CVE-2025-29040.md): An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target\_addr key value and the function 0x41737c (CVSS 9.8)
- [CVE-2025-29041](https://cve.now/CVE-2025-29041.md): An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target\_addr key value and the function 0x41710c (CVSS 9.8)
- [CVE-2025-29042](https://cve.now/CVE-2025-29042.md): An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the macaddr key value to the function 0x42232c (CVSS 9.8)
- [CVE-2025-29043](https://cve.now/CVE-2025-29043.md): An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x417234 (CVSS 9.8)
- [CVE-2025-29044](https://cve.now/CVE-2025-29044.md): Buffer Overflow vulnerability in Netgear- R61 router V1.0.1.28 allows a remote attacker to execute arbitrary code via the QUERY\_STRING key v (CVSS 9.8)
- [CVE-2025-29045](https://cve.now/CVE-2025-29045.md): Buffer Overflow vulnerability in ALFA\_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the newap\_text\_0 key value (CVSS 9.8)
- [CVE-2025-29046](https://cve.now/CVE-2025-29046.md): Buffer Overflow vulnerability inALFA WiFi CampPro router ALFA\_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the GAPS (CVSS 9.8)
- [CVE-2025-29047](https://cve.now/CVE-2025-29047.md): Buffer Overflow vulnerability inALFA WiFi CampPro router ALFA\_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the hidd (CVSS 9.8)
- [CVE-2025-29180](https://cve.now/CVE-2025-29180.md): In FOXCMS \<=1.25, the installdb.php file has a time - based blind SQL injection vulnerability. (CVSS 7.2)
- [CVE-2025-29181](https://cve.now/CVE-2025-29181.md): FOXCMS \<= V1.25 is vulnerable to SQL Injection via $param\['title'\] in /admin/util/Field.php. (CVSS 7.2)
- [CVE-2025-29316](https://cve.now/CVE-2025-29316.md): An issue in DataPatrol Screenshot watermark, printing watermark agent v.3.5.2.0 allows a physically proximate attacker to obtain sensitive i (CVSS 6.2)
- [CVE-2025-29449](https://cve.now/CVE-2025-29449.md): An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the link identification function. (CVSS 6.5)
- [CVE-2025-29450](https://cve.now/CVE-2025-29450.md): An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the site settings component. (CVSS 6.5)
- [CVE-2025-29451](https://cve.now/CVE-2025-29451.md): An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Mail Setting component. (CVSS 7.6)
- [CVE-2025-29452](https://cve.now/CVE-2025-29452.md): An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Proxy Manager component. (CVSS 7.6)
- [CVE-2025-29453](https://cve.now/CVE-2025-29453.md): An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the my (CVSS 6.5)
- [CVE-2025-29454](https://cve.now/CVE-2025-29454.md): An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Up (CVSS 6.5)
- [CVE-2025-29455](https://cve.now/CVE-2025-29455.md): An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Tr (CVSS 6.5)
- [CVE-2025-29456](https://cve.now/CVE-2025-29456.md): An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the cr (CVSS 6.5)
- [CVE-2025-29457](https://cve.now/CVE-2025-29457.md): An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function. (CVSS 7.6)
- [CVE-2025-29458](https://cve.now/CVE-2025-29458.md): An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. (CVSS 7.6)
- [CVE-2025-29459](https://cve.now/CVE-2025-29459.md): An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function. (CVSS 7.6)
- [CVE-2025-29460](https://cve.now/CVE-2025-29460.md): An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add Mycode function. (CVSS 7.6)
- [CVE-2025-29461](https://cve.now/CVE-2025-29461.md): An issue in a-blogcms 3.1.15 allows a remote attacker to obtain sensitive information via the /bid/1/admin/entry-edit/ path. (CVSS 7.6)
- [CVE-2025-29661](https://cve.now/CVE-2025-29661.md): Litepubl CMS \<= 7.0.9 is vulnerable to RCE in admin/service/run. (CVSS 7.2)
- [CVE-2025-29662](https://cve.now/CVE-2025-29662.md): A RCE vulnerability in the core application in LandChat 3.25.12.18 allows an unauthenticated attacker to execute system code via remote netw (CVSS 9.8)
- [CVE-2025-29722](https://cve.now/CVE-2025-29722.md): A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users. (CVSS 6.3)
- [CVE-2025-32415](https://cve.now/CVE-2025-32415.md): In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. (CVSS 2.9, xmlsoft libxml2)
- [CVE-2025-43708](https://cve.now/CVE-2025-43708.md): VisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowError (CVSS 3.3, VisiCut)
- [CVE-2025-43715](https://cve.now/CVE-2025-43715.md): Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, (CVSS 8.1, Nullsoft Scriptable Install System)
- [CVE-2025-43717](https://cve.now/CVE-2025-43717.md): In PEAR HTTP\_Request2 before 2.7.0, multiple files in the tests directory, notably tests/\_network/getparameters.php and tests/\_network/postp (CVSS 5.4, avb HTTP\_Request2 · pear/http\_request2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.