# CVEs published 2025-04-26

22 CVEs were published on April 26, 2025: 1 critical, 8 high. Days are UTC.

- [CVE-2025-3954](https://cve.now/CVE-2025-3954.md): ChurchCRM Referer server-side request forgery (CVSS 6.3, ChurchCRM)
- [CVE-2025-2101](https://cve.now/CVE-2025-2101.md): Edumall \<= 4.2.4 - Unauthenticated Local File Inclusion (CVSS 8.1, ThemeMove EduMall - Professional LMS Education Center WordP…)
- [CVE-2024-13812](https://cve.now/CVE-2024-13812.md): Anps Theme plugin \<= 1.1.1 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5, Anps Theme plugin)
- [CVE-2025-2851](https://cve.now/CVE-2025-2851.md): GL.iNet GL-A1300 Slate Plus RPC plugins.so buffer overflow (CVSS 8.6, GL.iNet GL-A1300 Slate Plus · GL.iNet GL-AR300M16 Shadow +21)
- [CVE-2025-2850](https://cve.now/CVE-2025-2850.md): GL.iNet GL-A1300 Slate Plus Download Interface improper authorization (CVSS 5.1, GL.iNet GL-A1300 Slate Plus · GL.iNet GL-AR300M16 Shadow +21)
- [CVE-2025-2811](https://cve.now/CVE-2025-2811.md): GL.iNet GL-A1300 Slate Plus API redos (CVSS 6.9, GL.iNet GL-A1300 Slate Plus · GL.iNet GL-AR300M16 Shadow +21)
- [CVE-2025-2907](https://cve.now/CVE-2025-2907.md): Order Delivery Date Pro for WooCommerce \< 12.3.1 - Unauthenticated Arbitrary Option Update (CVSS 9.8, Order Delivery Date)
- [CVE-2025-3915](https://cve.now/CVE-2025-3915.md): Aeropage Sync for Airtable \<= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion (CVSS 4.3, Aeropage Sync for Airtable)
- [CVE-2025-3906](https://cve.now/CVE-2025-3906.md): Integração entre Eduzz e Woocommerce 1.5.0 - 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, felipe152 Integração entre Eduzz e Woocommerce)
- [CVE-2025-3914](https://cve.now/CVE-2025-3914.md): Aeropage Sync for Airtable \<= 3.2.0 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, Aeropage Sync for Airtable)
- [CVE-2025-3491](https://cve.now/CVE-2025-3491.md): Add custom page template \<= 2.0.1 - Authenticated (Administrator+) PHP Code Injection to Remote Code Execution (CVSS 7.2, kiranpatil353 Add custom page template)
- [CVE-2025-1458](https://cve.now/CVE-2025-1458.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) \<= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2025-2105](https://cve.now/CVE-2025-2105.md): Jupiter X Core \<= 4.8.11 - Unauthenticated PHP Object Injection via PHAR (CVSS 8.1, artbees Jupiter X Core)
- [CVE-2024-13808](https://cve.now/CVE-2024-13808.md): Xpro Elementor Addons - Pro \<= 1.4.9 - Authenticated (Contributor+) Remote Code Execution (CVSS 8.8, WPXpro Xpro Elementor Addons - Pro)
- [CVE-2025-2801](https://cve.now/CVE-2025-2801.md): Create custom forms for WordPress with a smart form plugin for smart businesses \<= 1.2.4 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, dorinabc Create custom forms for WordPress with a smart for…)
- [CVE-2024-53636](https://cve.now/CVE-2024-53636.md): An arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information System (SIS) EagleR-1.0.118 allows attacke (CVSS 6.4, Serosoft Academia Student Information System)
- [CVE-2025-46646](https://cve.now/CVE-2025-46646.md): In Artifex Ghostscript before 10.05.0, decode\_utf8 in base/gp\_utf8.c mishandles overlong UTF-8 encoding. (CVSS 4.5, Artifex Ghostscript)
- [CVE-2025-46652](https://cve.now/CVE-2025-46652.md): In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. (CVSS 6.1, IZArc)
- [CVE-2025-46653](https://cve.now/CVE-2025-46653.md): Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable c (CVSS 3.1, node-formidable Formidable · formidable)
- [CVE-2025-46654](https://cve.now/CVE-2025-46654.md): CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploadi (CVSS 4.9, HackMD CodiMD)
- [CVE-2025-46655](https://cve.now/CVE-2025-46655.md): CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be by (CVSS 4.9, HackMD CodiMD)
- [CVE-2025-46656](https://cve.now/CVE-2025-46656.md): python-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as \<h9999999\> in addition to \<h1\> through \<h6\>. (CVSS 2.9, python-markdownify · markdownify)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.