# CVEs published 2025-04-24

171 CVEs were published on April 24, 2025: 14 critical, 66 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2025-2185](https://cve.now/CVE-2025-2185.md): ALBEDO Telecom Net.Time - PTP/NTP Clock Insufficient Session Expiration (CVSS 8.0, ALBEDO Telecom Net.Time - PTP/NTP clock)
- [CVE-2025-3606](https://cve.now/CVE-2025-3606.md): Vestel AC Charger Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVSS 7.5, Vestel AC Charger EVC04)
- [CVE-2025-46275](https://cve.now/CVE-2025-46275.md): Planet Technology Network Products Missing Authentication for Critical Function (CVSS 9.8, Planet Technology WGS-804HPT-V2 · Planet Technology WGS-421…)
- [CVE-2025-46274](https://cve.now/CVE-2025-46274.md): Planet Technology Network Products Use of Hard-coded Credentials (CVSS 9.8, Planet Technology UNI-NMS-Lite)
- [CVE-2025-46273](https://cve.now/CVE-2025-46273.md): Planet Technology Network Products Use of Hard-coded Credentials (CVSS 9.8, Planet Technology UNI-NMS-Lite)
- [CVE-2025-46272](https://cve.now/CVE-2025-46272.md): Planet Technology Network Products OS Command Injection (CVSS 9.1, Planet Technology WGS-804HPT-V2 · Planet Technology WGS-421…)
- [CVE-2025-46271](https://cve.now/CVE-2025-46271.md): Planet Technology Network Products OS Command Injection (CVSS 9.1, Planet Technology UNI-NMS-Lite)
- [CVE-2025-1294](https://cve.now/CVE-2025-1294.md): eForm \<= 4.18.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, WPQuark eForm - WordPress Form Builder)
- [CVE-2025-3749](https://cve.now/CVE-2025-3749.md): Breeze Display \<= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via cal\_size Parameter (CVSS 6.4, mgyura Breeze Display)
- [CVE-2025-43861](https://cve.now/CVE-2025-43861.md): ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection (CVSS 4.4, miraheze ManageWiki)
- [CVE-2022-44759](https://cve.now/CVE-2022-44759.md): HCL Leap is affected by Cross-site scripting (XSS) (CVSS 4.6, HCL Software HCL Leap)
- [CVE-2022-44760](https://cve.now/CVE-2022-44760.md): HCL Leap is affected by an unrestricted upload of file with dangerous type vulnerability (CVSS 4.6, HCL Software HCL Leap)
- [CVE-2023-37516](https://cve.now/CVE-2023-37516.md): HCL Leap is affected by missing "no cache" headers (CVSS 3.2, HCL Software HCL Leap)
- [CVE-2024-30127](https://cve.now/CVE-2024-30127.md): HCL Leap is affected by missing "no cache" headers (CVSS 3.2, HCL Software HCL Leap)
- [CVE-2025-26382](https://cve.now/CVE-2025-26382.md): Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool (CVSS 9.3, Johnson Controls iSTAR Configuration Utility)
- [CVE-2025-43859](https://cve.now/CVE-2025-43859.md): h11 accepts some malformed Chunked-Encoding bodies (CVSS 9.1, python-hyper h11 · h11)
- [CVE-2025-43858](https://cve.now/CVE-2025-43858.md): YoutubeDLSharp allows command injection on windows system due to non sanitized arguments (CVSS 9.2, Bluegrams YoutubeDLSharp · YoutubeDLSharp)
- [CVE-2025-31324](https://cve.now/CVE-2025-31324.md): Missing Authorization check in SAP NetWeaver (Visual Composer development server) (CVSS 10.0, KEV, SAP\_SE SAP NetWeaver)
- [CVE-2023-37534](https://cve.now/CVE-2023-37534.md): HCL Leap is affected by a Cross-site scripting (XSS) vulnerability (CVSS 7.1, HCL Software HCL Leap)
- [CVE-2023-45720](https://cve.now/CVE-2023-45720.md): HCL Leap is affected by a disclosure of private personal information vulnerability (CVSS 5.3, HCL Software HCL Leap)
- [CVE-2024-30113](https://cve.now/CVE-2024-30113.md): HCL Leap is affected by a cross-site scripting (XSS) vulnerability (CVSS 6.3, HCL Software HCL Leap)
- [CVE-2024-30114](https://cve.now/CVE-2024-30114.md): HCL Leap is affected by a cross-site scripting (XSS) vulnerability (CVSS 3.7, HCL Software HCL Leap)
- [CVE-2024-30147](https://cve.now/CVE-2024-30147.md): HCL Leap is affected by a cross-site scripting (XSS) vulnerability (CVSS 6.5, HCL Software HCL Leap)
- [CVE-2024-30148](https://cve.now/CVE-2024-30148.md): HCL Leap is affected by improper access control (CVSS 4.1, HCL Software HCL Leap)
- [CVE-2025-46498](https://cve.now/CVE-2025-46498.md): WordPress Zalo Official Live Chat plugin \<= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, nghialuu Zalo Official Live Chat)
- [CVE-2025-46473](https://cve.now/CVE-2025-46473.md): WordPress Social Counter plugin \<= 2.0.5 - PHP Object Injection Vulnerability (CVSS 7.2, Prisna Social Counter)
- [CVE-2025-46523](https://cve.now/CVE-2025-46523.md): WordPress COVID-19 (Coronavirus) Update Your Customers plugin \<= 1.5.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, devignstudiosltd COVID-19 (Coronavirus) Update Your Custome…)
- [CVE-2025-46507](https://cve.now/CVE-2025-46507.md): WordPress Unsafe Mimetypes plugin \<= 0.1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, ldrumm Unsafe Mimetypes)
- [CVE-2025-46481](https://cve.now/CVE-2025-46481.md): WordPress Flickr Shortcode Importer plugin \<= 2.2.3 - PHP Object Injection Vulnerability (CVSS 7.2, Michael Cannon Flickr Shortcode Importer)
- [CVE-2025-46447](https://cve.now/CVE-2025-46447.md): WordPress Fable Extra plugin \<= 1.0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPFable Fable Extra)
- [CVE-2025-46531](https://cve.now/CVE-2025-46531.md): WordPress WP AVCL Automation Helper (formerly WPFlyLeads) plugin \<= 3.4 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.9, Ankur Vishwakarma WP AVCL Automation Helper)
- [CVE-2025-46519](https://cve.now/CVE-2025-46519.md): WordPress Media Library Downloader plugin \<= 1.3.1 - Broken Access Control Vulnerability (CVSS 4.3, M.Code Media Library Downloader)
- [CVE-2025-46511](https://cve.now/CVE-2025-46511.md): WordPress BeerXML Shortcode plugin \<= 0.7.1 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 6.4, Derek Springer BeerXML Shortcode)
- [CVE-2025-46503](https://cve.now/CVE-2025-46503.md): WordPress Simple Google Photos Grid plugin \<= 1.5 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.9, josheli Simple Google Photos Grid)
- [CVE-2025-46489](https://cve.now/CVE-2025-46489.md): WordPress Bulk Assign Linked Products For WooCommerce plugin \<= 2.1 - Broken Access Control Vulnerability (CVSS 5.3, vinodvaswani9 Bulk Assign Linked Products For WooCommerce)
- [CVE-2025-46485](https://cve.now/CVE-2025-46485.md): WordPress WP Customize Login Page plugin \<= 1.6.5 - Broken Access Control Vulnerability (CVSS 5.3, Carlo La Pera WP Customize Login Page)
- [CVE-2025-46477](https://cve.now/CVE-2025-46477.md): WordPress WP Customize Login Page plugin \<= 1.6.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Carlo La Pera WP Customize Login Page)
- [CVE-2025-46469](https://cve.now/CVE-2025-46469.md): WordPress Send From plugin \<= 2.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Benjamin Buddle Send From)
- [CVE-2025-46459](https://cve.now/CVE-2025-46459.md): WordPress Confirm User Registration plugin \<= 2.1.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Ralf Hortt Confirm User Registration)
- [CVE-2025-46451](https://cve.now/CVE-2025-46451.md): WordPress Floating Social Bar plugin \<= 1.1.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Syed Balkhi Floating Social Bar)
- [CVE-2025-46442](https://cve.now/CVE-2025-46442.md): WordPress Loan Calculator plugin \<= 1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, Casey Johnson Loan Calculator)
- [CVE-2025-46541](https://cve.now/CVE-2025-46541.md): WordPress WP-reCAPTCHA-bp plugin \<= 4.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, elrata\_ WP-reCAPTCHA-bp)
- [CVE-2025-46533](https://cve.now/CVE-2025-46533.md): WordPress Landing pages and Domain aliases for WordPress plugin \<= 0.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, wpdrift.no Landing pages and Domain aliases for WordPress)
- [CVE-2025-46529](https://cve.now/CVE-2025-46529.md): WordPress Business Contact Widget plugin \<= 2.7.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, StressFree Sites Business Contact Widget)
- [CVE-2025-46525](https://cve.now/CVE-2025-46525.md): WordPress WP Cookie Consent plugin \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, msmitley WP Cookie Consent)
- [CVE-2025-46521](https://cve.now/CVE-2025-46521.md): WordPress WS Force Login Page plugin \<= 3.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Silver Muru WS Force Login Page)
- [CVE-2025-46517](https://cve.now/CVE-2025-46517.md): WordPress Blog Manager WP plugin \<= 1.0.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, wpdiscover Blog Manager WP)
- [CVE-2025-46513](https://cve.now/CVE-2025-46513.md): WordPress All in One Time Clock Lite plugin \< 1.3.326 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Codebangers All in One Time Clock Lite)
- [CVE-2025-46509](https://cve.now/CVE-2025-46509.md): WordPress 360 View plugin \<= 1.1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Andrey Mikhalchuk 360 View)
- [CVE-2025-46505](https://cve.now/CVE-2025-46505.md): WordPress Peekaboo plugin \<= 1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, farinspace Peekaboo)
- [CVE-2025-46501](https://cve.now/CVE-2025-46501.md): WordPress Mixcloud Embed plugin \<= 2.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, biancardi Mixcloud Embed)
- [CVE-2025-46496](https://cve.now/CVE-2025-46496.md): WordPress Mini twitter feed plugin \<= 3.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, oniswap Mini twitter feed)
- [CVE-2025-46491](https://cve.now/CVE-2025-46491.md): WordPress Multi-Column Taxonomy List plugin \<= 1.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Matthew Muro Multi-Column Taxonomy List)
- [CVE-2025-46483](https://cve.now/CVE-2025-46483.md): WordPress Peadig’s Google +1 Button plugin \<= 0.1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Alex Moss Peadig’s Google +1 Button)
- [CVE-2025-46479](https://cve.now/CVE-2025-46479.md): WordPress BBCode Deluxe plugin \<= 2020.08.01.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, DevynCJohnson BBCode Deluxe)
- [CVE-2025-46475](https://cve.now/CVE-2025-46475.md): WordPress Able Player plugin \<= 1.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Joe Dolson Able Player)
- [CVE-2025-46471](https://cve.now/CVE-2025-46471.md): WordPress WP Custom Post Popup plugin \<= 1.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, gnanavelshenll WP Custom Post Popup)
- [CVE-2025-46467](https://cve.now/CVE-2025-46467.md): WordPress RAphicon plugin \<= 2.1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Rahendra Putra K™ RAphicon)
- [CVE-2025-46461](https://cve.now/CVE-2025-46461.md): WordPress RRSSB plugin \<= 1.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Relentless Apps RRSSB)
- [CVE-2025-46457](https://cve.now/CVE-2025-46457.md): WordPress Wp Custom CMS Block plugin \<= 2.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Ahsanullah Akanda Wp Custom CMS Block)
- [CVE-2025-46453](https://cve.now/CVE-2025-46453.md): WordPress Zoho Creator Forms \<= 1.0.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, CreatorTeam Zoho Creator Forms)
- [CVE-2025-46449](https://cve.now/CVE-2025-46449.md): WordPress WoWHead Tooltips plugin \<= 2.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Novium WoWHead Tooltips)
- [CVE-2025-46445](https://cve.now/CVE-2025-46445.md): WordPress External Markdown plugin \<= 0.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, pReya External Markdown)
- [CVE-2025-46438](https://cve.now/CVE-2025-46438.md): WordPress GTDB Guitar Tuners plugin \<= 4.2.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, warmwhisky GTDB Guitar Tuners)
- [CVE-2025-46542](https://cve.now/CVE-2025-46542.md): WordPress Xpert Tab plugin \<= 1.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, ThemeXpert Xpert Tab)
- [CVE-2025-46540](https://cve.now/CVE-2025-46540.md): WordPress GNA Search Shortcode plugin \<= 0.9.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Chris Mok GNA Search Shortcode)
- [CVE-2025-46538](https://cve.now/CVE-2025-46538.md): WordPress Inline Text Popup plugin \<= 1.0.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, webplanetsoft Inline Text Popup)
- [CVE-2025-46536](https://cve.now/CVE-2025-46536.md): WordPress Carousel-of-post-images plugin \<= 1.07 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, RichardHarrison Carousel-of-post-images)
- [CVE-2025-46534](https://cve.now/CVE-2025-46534.md): WordPress Image Style Hover plugin \<= 1.0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, DanielRiera Image Style Hover)
- [CVE-2025-46532](https://cve.now/CVE-2025-46532.md): WordPress Tooltip plugin \<= 1.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Haris Zulfiqar Tooltip)
- [CVE-2025-46530](https://cve.now/CVE-2025-46530.md): WordPress Hacklog Remote Attachment plugin \<= 1.3.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, HuangYe WuDeng Hacklog Remote Attachment)
- [CVE-2025-46528](https://cve.now/CVE-2025-46528.md): WordPress Availability Calendar plugin \<= 0.2.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Steve Availability Calendar)
- [CVE-2025-46524](https://cve.now/CVE-2025-46524.md): WordPress WP Filter Post Category plugin \<= 2.1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, stesvis WP Filter Post Category)
- [CVE-2025-46522](https://cve.now/CVE-2025-46522.md): WordPress Tabs plugin \<= 4.0.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, Billy Bryant Tabs)
- [CVE-2025-46520](https://cve.now/CVE-2025-46520.md): WordPress Related Posts via Taxonomies plugin \<= 1.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, alphasis Related Posts via Taxonomies)
- [CVE-2025-46516](https://cve.now/CVE-2025-46516.md): WordPress Twitter Card Generator plugin \<= 1.0.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, silencecm Twitter Card Generator)
- [CVE-2025-46514](https://cve.now/CVE-2025-46514.md): WordPress Milat jQuery Automatic Popup plugin \<= 1.3.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Milat jQuery Automatic Popup)
- [CVE-2025-46512](https://cve.now/CVE-2025-46512.md): WordPress Custom Functions Plugin plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Shamim Hasan Custom Functions Plugin)
- [CVE-2025-46510](https://cve.now/CVE-2025-46510.md): WordPress Contact Form 7 Calendar plugin \<= 3.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, harrysudana Contact Form 7 Calendar)
- [CVE-2025-46508](https://cve.now/CVE-2025-46508.md): WordPress Advanced lazy load plugin \<= 1.6.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, kasonzhao Advanced lazy load)
- [CVE-2025-46506](https://cve.now/CVE-2025-46506.md): WordPress WpZon – Amazon Affiliate Plugin plugin \<= 1.3 - CSRF to XSS vulnerability (CVSS 7.1, Lora77 WpZon – Amazon Affiliate Plugin)
- [CVE-2025-46504](https://cve.now/CVE-2025-46504.md): WordPress Vasaio QR Code plugin \<= 1.2.5 - CSRF to XSS vulnerability (CVSS 7.1, Olar Marius Vasaio QR Code)
- [CVE-2025-46502](https://cve.now/CVE-2025-46502.md): WordPress LSD Custom taxonomy and category meta plugin \<= 1.3.2 - CSRF to XSS vulnerability (CVSS 7.1, Bas Matthee LSD Custom taxonomy and category meta)
- [CVE-2025-46499](https://cve.now/CVE-2025-46499.md): WordPress PayPal Express Checkout plugin \<= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, hccoder PayPal Express Checkout)
- [CVE-2025-46497](https://cve.now/CVE-2025-46497.md): WordPress Navegg Analytics plugin \<= 3.3.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Navegg Analytics)
- [CVE-2025-46495](https://cve.now/CVE-2025-46495.md): WordPress Drop Caps plugin \<= 2.1 - CSRF to XSS vulnerability (CVSS 6.5, tomontoast Drop Caps)
- [CVE-2025-46492](https://cve.now/CVE-2025-46492.md): WordPress Call Now PHT Blog plugin \<= 2.4.1 - CSRF to XSS vulnerability (CVSS 7.1, Pham Thanh Call Now PHT Blog)
- [CVE-2025-46484](https://cve.now/CVE-2025-46484.md): WordPress Image Hover Effects For WPBakery Page Builder plugin \<= 2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, nasir179125 Image Hover Effects For WPBakery Page Builder)
- [CVE-2025-46480](https://cve.now/CVE-2025-46480.md): WordPress Nepali Post Date plugin \<= 5.1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Padam Shankhadev Nepali Post Date)
- [CVE-2025-46478](https://cve.now/CVE-2025-46478.md): WordPress Dropdown Content plugin \<= 1.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, metaloha Dropdown Content)
- [CVE-2025-46476](https://cve.now/CVE-2025-46476.md): WordPress Awesome Wp Image Gallery plugin \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, nayon46 Awesome Wp Image Gallery)
- [CVE-2025-46472](https://cve.now/CVE-2025-46472.md): WordPress The Pack Elementor addons plugin \<= 2.1.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, webangon The Pack Elementor addons)
- [CVE-2025-46470](https://cve.now/CVE-2025-46470.md): WordPress Smart Hashtags \[#hashtagger\] plugin \<= 7.2.3 - Broken Access Control Vulnerability (CVSS 4.3, Peter Raschendorfer Smart Hashtags \[#hashtagger\])
- [CVE-2025-46466](https://cve.now/CVE-2025-46466.md): WordPress Modern Polls plugin \<= 1.0.10 - CSRF to Stored XSS vulnerability (CVSS 7.1, felixtz Modern Polls)
- [CVE-2025-46465](https://cve.now/CVE-2025-46465.md): WordPress Print Science Designer plugin \<= 1.3.155 - CSRF to Stored XSS vulnerability (CVSS 7.1, John Weissberg Print Science Designer)
- [CVE-2025-46462](https://cve.now/CVE-2025-46462.md): WordPress WPVN plugin \<= 0.7.8 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Trân Minh-Quân WPVN)
- [CVE-2025-46452](https://cve.now/CVE-2025-46452.md): WordPress Google News plugin \<= 2.5.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Olav Kolbu Google News)
- [CVE-2025-46450](https://cve.now/CVE-2025-46450.md): WordPress occupancyplan plugin \<= 1.0.3.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, x000x occupancyplan)
- [CVE-2025-46443](https://cve.now/CVE-2025-46443.md): WordPress Animate plugin \<= 0.5 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.9, Adam Pery Animate)
- [CVE-2025-46436](https://cve.now/CVE-2025-46436.md): WordPress SCSS-Library plugin \<= 0.4.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Sebastian Echeverry SCSS-Library)
- [CVE-2025-46439](https://cve.now/CVE-2025-46439.md): WordPress Plugin Central plugin \<= 2.5.1 - CSRF to Arbitrary File Deletion vulnerability (CVSS 7.4, Vladimir Prelovac Plugin Central)
- [CVE-2025-46435](https://cve.now/CVE-2025-46435.md): WordPress Time Based Greeting plugin \<= 2.2.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Yash Binani Time Based Greeting)
- [CVE-2025-32921](https://cve.now/CVE-2025-32921.md): WordPress Arrival theme \<= 1.4.5 - Local File Inclusion vulnerability (CVSS 7.5, wpoperations Arrival)
- [CVE-2025-39359](https://cve.now/CVE-2025-39359.md): WordPress CWW Portfolio theme \<= 1.3.1 - Local File Inclusion vulnerability (CVSS 7.5, codeworkweb CWW Portfolio)
- [CVE-2025-39360](https://cve.now/CVE-2025-39360.md): WordPress Grace Mag theme \<= 1.1.5 - Local File Inclusion vulnerability (CVSS 7.5, everestthemes Grace Mag)
- [CVE-2025-39377](https://cve.now/CVE-2025-39377.md): WordPress Appsero Helper plugin \<= 1.3.4 - SQL Injection vulnerability (CVSS 8.5, weDevs Appsero Helper)
- [CVE-2025-39378](https://cve.now/CVE-2025-39378.md): WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin \<= 2.4.37 - Local File Inclusion vulnerability (CVSS 7.5, Holest Engineering Spreadsheet Price Changer for WooCommerc…)
- [CVE-2025-39379](https://cve.now/CVE-2025-39379.md): WordPress Capturly plugin \<= 2.0.1 - Local File Inclusion vulnerability (CVSS 7.5, Capturly)
- [CVE-2025-39381](https://cve.now/CVE-2025-39381.md): WordPress KiotViet Sync plugin \<= 1.8.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, KiotViet Sync)
- [CVE-2025-39382](https://cve.now/CVE-2025-39382.md): WordPress ACF: Google Font Selector plugin \<= 3.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, danielpataki ACF: Google Font Selector)
- [CVE-2025-39383](https://cve.now/CVE-2025-39383.md): WordPress Xews Lite plugin \<= 1.0.9 - Local File Inclusion vulnerability (CVSS 7.5, codeworkweb Xews Lite)
- [CVE-2025-39384](https://cve.now/CVE-2025-39384.md): WordPress Product Lister for eBay plugin \<= 2.0.9 - Local File Inclusion vulnerability (CVSS 7.5, cedcommerce Product Lister for eBay)
- [CVE-2025-39385](https://cve.now/CVE-2025-39385.md): WordPress Sirat theme \<= 1.5.1 - Broken Access Control vulnerability (CVSS 4.3, vowelweb Sirat)
- [CVE-2025-39387](https://cve.now/CVE-2025-39387.md): WordPress Opstore theme \<= 1.4.5 - Local File Inclusion vulnerability (CVSS 7.5, wpoperations Opstore)
- [CVE-2025-39390](https://cve.now/CVE-2025-39390.md): WordPress Booking and Rental Manager plugin \<= 2.3.6 - Broken Access Control vulnerability (CVSS 5.3, magepeopleteam Booking and Rental Manager)
- [CVE-2025-39391](https://cve.now/CVE-2025-39391.md): WordPress Checkout Field Visibility for WooCommerce plugin \<= 1.3.0 - Local File Inclusion vulnerability (CVSS 7.5, zamartz Checkout Field Visibility for WooCommerce)
- [CVE-2025-39397](https://cve.now/CVE-2025-39397.md): WordPress Anything Popup plugin \<= 7.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, gopiplus@hotmail.com Anything Popup)
- [CVE-2025-39399](https://cve.now/CVE-2025-39399.md): WordPress License For Envato plugin \<= 1.0.0 - Local File Inclusion vulnerability (CVSS 7.5, Ashraful Sarkar Naiem License For Envato)
- [CVE-2025-39400](https://cve.now/CVE-2025-39400.md): WordPress User Registration plugin \< 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpeverest User Registration)
- [CVE-2025-39404](https://cve.now/CVE-2025-39404.md): WordPress Sassy Social Share plugin \<= 3.3.73 - Open Redirection vulnerability (CVSS 4.7, Heateor Support Sassy Social Share)
- [CVE-2025-39408](https://cve.now/CVE-2025-39408.md): WordPress BruteGuard – Brute Force Login Protection plugin \<= 0.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, EverPress BruteGuard – Brute Force Login Protection)
- [CVE-2025-46264](https://cve.now/CVE-2025-46264.md): WordPress PowerPress Podcasting \<= 11.12.5 - Arbitrary File Upload Vulnerability (CVSS 9.9, blubrry PowerPress Podcasting)
- [CVE-2025-46230](https://cve.now/CVE-2025-46230.md): WordPress Popup Builder plugin \<= 1.1.35 - Local File Inclusion Vulnerability (CVSS 7.5, GhozyLab Popup Builder)
- [CVE-2025-46234](https://cve.now/CVE-2025-46234.md): WordPress Control Listings plugin \<= 1.0.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Habibur Rahman Razib Control Listings)
- [CVE-2025-46248](https://cve.now/CVE-2025-46248.md): WordPress Frontend Dashboard plugin \<= 2.2.5 - SQL Injection Vulnerability (CVSS 9.3, M A Vinoth Kumar Frontend Dashboard)
- [CVE-2025-46260](https://cve.now/CVE-2025-46260.md): WordPress Sky Addons for Elementor plugin \<= 3.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wowDevs Sky Addons for Elementor)
- [CVE-2025-46261](https://cve.now/CVE-2025-46261.md): WordPress Seriously Simple Podcasting plugin \<= 3.9.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Craig Hewitt Seriously Simple Podcasting)
- [CVE-2025-43855](https://cve.now/CVE-2025-43855.md): tRPC 11 WebSocket DoS Vulnerability (CVSS 8.7, trpc · @trpc/server)
- [CVE-2025-30409](https://cve.now/CVE-2025-30409.md): Denial of service due to allocation of resources without limits. (CVSS 5.5, Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect)
- [CVE-2025-30408](https://cve.now/CVE-2025-30408.md): Local privilege escalation due to insecure folder permissions. (CVSS 6.7, Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect)
- [CVE-2025-46421](https://cve.now/CVE-2025-46421.md): Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server (CVSS 6.8, libsoup · Red Hat Enterprise Linux)
- [CVE-2025-46420](https://cve.now/CVE-2025-46420.md): Libsoup: memory leak on soup\_header\_parse\_quality\_list() via soup-headers.c (CVSS 6.5, libsoup · Red Hat Enterprise Linux)
- [CVE-2025-27820](https://cve.now/CVE-2025-27820.md): Apache HttpComponents: PSL (Public Suffix List) validation bypass (CVSS 7.5, Apache Software Foundation Apache HttpComponents · org.apac…)
- [CVE-2021-47664](https://cve.now/CVE-2021-47664.md): Enumeration of valid user names (CVSS 5.3, Franka Robotics Franka Emika Robot)
- [CVE-2021-47663](https://cve.now/CVE-2021-47663.md): Improper session handling (CVSS 8.1, Franka Robotics Franka Emika Robot)
- [CVE-2021-47662](https://cve.now/CVE-2021-47662.md): Unauthenticated remote shutdown of the cobot (CVSS 7.5, Franka Robotics Franka Emika Robot)
- [CVE-2025-3872](https://cve.now/CVE-2025-3872.md): Privilege escalation by altering payload in contact form (CVSS 7.2, Centreon)
- [CVE-2025-3603](https://cve.now/CVE-2025-3603.md): Flynax Bridge \<= 2.2.0 - Unauthenticated Privilege Escalation via Password Update (CVSS 9.8, v1rustyle Flynax Bridge)
- [CVE-2025-3776](https://cve.now/CVE-2025-3776.md): Verification SMS with TargetSMS \<= 1.5 - Unauthenticated Limited Remote Code Execution (CVSS 8.3, cajka Verification SMS with TargetSMS)
- [CVE-2025-3793](https://cve.now/CVE-2025-3793.md): Buddypress Force Password Change \<= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update (CVSS 4.2, lamarant Buddypress Force Password Change)
- [CVE-2025-3280](https://cve.now/CVE-2025-3280.md): ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes \<= 1.4.9 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, elextensions ELEX WooCommerce Bulk Edit Products, Prices &…)
- [CVE-2024-13307](https://cve.now/CVE-2024-13307.md): Reales WP - Real Estate WordPress Theme \<= 2.1.2 - Missing Authorization to Unauthenticated Attachment Deletion and Favorite Property Updates (CVSS 5.3, pixel\_prime Reales WP - Real Estate WordPress Theme)
- [CVE-2025-3300](https://cve.now/CVE-2025-3300.md): WPMasterToolKit (WPMTK) – All in one plugin \<= 2.5.2 - Authenticated (Administrator+) to Arbitrary File Read and Write (CVSS 7.2, ludwigyou WPMasterToolKit (WPMTK) – All in one plugin)
- [CVE-2025-3832](https://cve.now/CVE-2025-3832.md): FuseDesk \<= 6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via successredirect Parameter (CVSS 6.4, jeremyshapiro FuseDesk)
- [CVE-2025-2579](https://cve.now/CVE-2025-2579.md): Lottie Player \<= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload (CVSS 6.4, bplugins Lottie Player – Add Interactive Lottie Animations…)
- [CVE-2025-3607](https://cve.now/CVE-2025-3607.md): Frontend Login and Registration Blocks \<= 1.0.8 - Authenticated (Subscriber+) Privilege Escalation via Password Reset (CVSS 8.8, arkenon Login, Registration and Lost Password Blocks)
- [CVE-2025-3604](https://cve.now/CVE-2025-3604.md): Flynax Bridge \<= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover (CVSS 9.8, v1rustyle Flynax Bridge)
- [CVE-2025-2543](https://cve.now/CVE-2025-2543.md): Advanced Accordion Gutenberg Block \<= 5.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, spiderdevs Advanced Accordion Gutenberg Block – Create Beau…)
- [CVE-2025-1284](https://cve.now/CVE-2025-1284.md): Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) \<= 4.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information Disclosure (CVSS 4.3, xpertsclub Woocommerce Automatic Order Printing |)
- [CVE-2025-3101](https://cve.now/CVE-2025-3101.md): Configurator Theme Core \<= 1.4.7 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, wp-configurator Configurator Theme Core)
- [CVE-2025-3058](https://cve.now/CVE-2025-3058.md): Xelion Webchat \<= 9.1.0 - Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, jauharixelion Xelion Webchat)
- [CVE-2025-3065](https://cve.now/CVE-2025-3065.md): Database Toolset \<= 1.8.4 - Unauthenticated Arbitrary File Deletion (CVSS 9.1, neoslab Database Toolset)
- [CVE-2024-12244](https://cve.now/CVE-2024-12244.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-0639](https://cve.now/CVE-2025-0639.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-1908](https://cve.now/CVE-2025-1908.md): Business Logic Errors in GitLab (CVSS 7.7, GitLab)
- [CVE-2025-3761](https://cve.now/CVE-2025-3761.md): My Tickets – Accessible Event Ticketing \<= 2.0.16 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, joedolson My Tickets – Accessible Event Ticketing)
- [CVE-2025-41423](https://cve.now/CVE-2025-41423.md): Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin (CVSS 3.1, Mattermost · github.com/mattermost/mattermost-plugin-pla… +4)
- [CVE-2025-35965](https://cve.now/CVE-2025-35965.md): DoS in Mattermost Playbooks via Excessive Task Actions (CVSS 6.5, Mattermost · github.com/mattermost/mattermost/server/v8 +4)
- [CVE-2025-41395](https://cve.now/CVE-2025-41395.md): Webapp DoS via malicious retrospective post in Playbooks (CVSS 6.5, Mattermost · github.com/mattermost/mattermost-plugin-pla… +4)
- [CVE-2025-32730](https://cve.now/CVE-2025-32730.md): Use of hard-coded cryptographic key vulnerability in i-PRO Configuration Tool affects the network system for i-PRO Co., Ltd. (CVSS 5.5, i-PRO Co. i-PRO Configuration Tool)
- [CVE-2025-2558](https://cve.now/CVE-2025-2558.md): The Wound \<= 0.0.1 - Unauthenticated LFI (CVSS 8.6, the-wound)
- [CVE-2025-1453](https://cve.now/CVE-2025-1453.md): Category Posts Widget \< 4.9.20 - Admin+ Stored XSS (CVSS 4.8, Category Posts Widget)
- [CVE-2025-3435](https://cve.now/CVE-2025-3435.md): MangBoard WP \<= 1.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Board Header And Footer (CVSS 4.4, kitae-park Mang Board WP)
- [CVE-2025-1976](https://cve.now/CVE-2025-1976.md): Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6 (CVSS 8.6, KEV, Brocade Fabric OS)
- [CVE-2025-25777](https://cve.now/CVE-2025-25777.md): Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles. (CVSS 8.0)
- [CVE-2025-29529](https://cve.now/CVE-2025-29529.md): ITC Systems Multiplan/Matrix OneCard platform v3.7.4.1002 was discovered to contain a SQL injection vulnerability via the component Forgotpa (CVSS 6.5)
- [CVE-2025-29568](https://cve.now/CVE-2025-29568.md): A vulnerability has been discovered in the code-projects Online Class and Exam Scheduling System 1.0. (CVSS 4.8)
- [CVE-2025-44134](https://cve.now/CVE-2025-44134.md): A vulnerability was found in Code-Projects Online Class and Exam Scheduling System 1.0 in the file /Scheduling/pages/class\_save.php. (CVSS 6.5)
- [CVE-2025-44135](https://cve.now/CVE-2025-44135.md): A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0 in /Scheduling/pages/profile\_update.php. (CVSS 6.5)
- [CVE-2025-46417](https://cve.now/CVE-2025-46417.md): The unsafe globals in Picklescan before 0.0.25 do not include ssl. (CVSS 6.8, Picklescan)
- [CVE-2025-46419](https://cve.now/CVE-2025-46419.md): Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet. (CVSS 5.9, Westermo WeOS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.