CVEs published April 26, 2025
22 CVEs were published on April 26, 2025: 1 critical, 8 high.
- Published
- 22
- Critical
- 1
- High
- 8
- Medium
- 11
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- GL.iNet GL-A1300 Slate Plus · GL.iNet GL-AR300M16 Shadow +21
- 3
- Aeropage Sync for Airtable
- 2
- HackMD CodiMD
- 2
- Anps Theme plugin
- 1
- artbees Jupiter X Core
- 1
- Artifex Ghostscript
- 1
- bdthemes Element Pack – Widgets, Templates & Addons for Ele…
- 1
- ChurchCRM
- 1
- dorinabc Create custom forms for WordPress with a smart for…
- 1
- felipe152 Integração entre Eduzz e Woocommerce
- 1
Critical 1
High 8
- CVE-2025-2101Edumall <= 4.2.4 - Unauthenticated Local File InclusionThemeMove EduMall - Professional LMS Education Center WordP…
- CVE-2025-2851GL.iNet GL-A1300 Slate Plus RPC plugins.so buffer overflowGL.iNet GL-A1300 Slate Plus · GL.iNet GL-AR300M16 Shadow +21
- CVE-2025-3906Integração entre Eduzz e Woocommerce 1.5.0 - 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalationfelipe152 Integração entre Eduzz e Woocommerce
- CVE-2025-3914Aeropage Sync for Airtable <= 3.2.0 - Authenticated (Subscriber+) Arbitrary File UploadAeropage Sync for Airtable
- CVE-2025-3491Add custom page template <= 2.0.1 - Authenticated (Administrator+) PHP Code Injection to Remote Code Executionkiranpatil353 Add custom page template
- CVE-2025-2105Jupiter X Core <= 4.8.11 - Unauthenticated PHP Object Injection via PHARartbees Jupiter X Core
- CVE-2024-13808Xpro Elementor Addons - Pro <= 1.4.9 - Authenticated (Contributor+) Remote Code ExecutionWPXpro Xpro Elementor Addons - Pro
- CVE-2025-2801Create custom forms for WordPress with a smart form plugin for smart businesses <= 1.2.4 - Unauthenticated Arbitrary Shortcode Executiondorinabc Create custom forms for WordPress with a smart for…
Medium, low and unrated 13
- CVE-2025-3954ChurchCRM Referer server-side request forgeryChurchCRM
- CVE-2024-13812Anps Theme plugin <= 1.1.1 - Unauthenticated Arbitrary Shortcode ExecutionAnps Theme plugin
- CVE-2025-2850GL.iNet GL-A1300 Slate Plus Download Interface improper authorizationGL.iNet GL-A1300 Slate Plus · GL.iNet GL-AR300M16 Shadow +21
- CVE-2025-2811GL.iNet GL-A1300 Slate Plus API redosGL.iNet GL-A1300 Slate Plus · GL.iNet GL-AR300M16 Shadow +21
- CVE-2025-3915Aeropage Sync for Airtable <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post DeletionAeropage Sync for Airtable
- CVE-2025-1458Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scriptingbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2024-53636An arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information System (SIS) EagleR-1.0.118 allows attackeSerosoft Academia Student Information System
- CVE-2025-46646In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding.Artifex Ghostscript
- CVE-2025-46652In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability.IZArc
- CVE-2025-46653Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable cnode-formidable Formidable · formidable
- CVE-2025-46654CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploadiHackMD CodiMD
- CVE-2025-46655CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be byHackMD CodiMD
- CVE-2025-46656python-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as <h9999999> in addition to <h1> through <h6>.python-markdownify · markdownify