# CVEs published 2025-05-07

305 CVEs were published on May 7, 2025: 11 critical, 83 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2024-55651](https://cve.now/CVE-2024-55651.md): i-Educar Stored Cross-Site Scripting vulnerability (CVSS 2.0, portabilis i-educar)
- [CVE-2025-46727](https://cve.now/CVE-2025-46727.md): Unbounded-Parameter DoS in Rack::QueryParser (CVSS 7.5, rack)
- [CVE-2025-32441](https://cve.now/CVE-2025-32441.md): Rack session gets restored after deletion (CVSS 4.2, rack)
- [CVE-2025-0936](https://cve.now/CVE-2025-0936.md): On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possibly (CVSS 6.5, Arista Networks EOS)
- [CVE-2025-35939](https://cve.now/CVE-2025-35939.md): Craft CMS stores user-provided content in session files (CVSS 5.3, KEV, Craft CMS · craftcms/cms)
- [CVE-2025-41431](https://cve.now/CVE-2025-41431.md): TMM Vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2025-31644](https://cve.now/CVE-2025-31644.md): Appliance mode BIG-IP iControl REST and tmsh vulnerability (CVSS 8.7, F5 BIG-IP)
- [CVE-2025-35995](https://cve.now/CVE-2025-35995.md): BIG-IP PEM vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2025-36525](https://cve.now/CVE-2025-36525.md): BIG-IP APM PingAccess Virtual Server Vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2025-36504](https://cve.now/CVE-2025-36504.md): BIG-IP HTTP/2 vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2025-41414](https://cve.now/CVE-2025-41414.md): BIG-IP HTTP/2 vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2025-41433](https://cve.now/CVE-2025-41433.md): BIG-IP SIP ALG profile vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2025-46265](https://cve.now/CVE-2025-46265.md): F5OS vulnerability (CVSS 8.8, F5OS - Appliance · F5OS - Chassis)
- [CVE-2025-43878](https://cve.now/CVE-2025-43878.md): F5OS-A/C CLI vulnerability (CVSS 6.0, F5OS - Appliance · F5OS - Chassis)
- [CVE-2025-36546](https://cve.now/CVE-2025-36546.md): F5OS Appliance Mode vulnerability (CVSS 8.1, F5OS - Appliance · F5OS - Chassis)
- [CVE-2025-36557](https://cve.now/CVE-2025-36557.md): BIG-IP HTTP vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2025-41399](https://cve.now/CVE-2025-41399.md): SCTP Vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-7303](https://cve.now/CVE-2023-7303.md): q2apro q2apro-on-site-notifications q2apro-onsitenotifications-page.php process\_request cross site scripting (CVSS 5.1, q2apro-on-site-notifications)
- [CVE-2025-46826](https://cve.now/CVE-2025-46826.md): insa-auth Open-Redirect on provided CAS server login endpoint (CVSS 1.3, INSAgenda insa-auth)
- [CVE-2025-46821](https://cve.now/CVE-2025-46821.md): Envoy vulnerable to bypass of RBAC uri\_template permission (CVSS 5.3, envoyproxy envoy)
- [CVE-2025-31177](https://cve.now/CVE-2025-31177.md): Gnuplot: gnuplot heap-buffer overflow on utf8\_copy\_one (CVSS 5.5, gnuplot · Red Hat Enterprise Linux)
- [CVE-2025-4043](https://cve.now/CVE-2025-4043.md): Milesight UG65-868M-EA Improper Access Control for Volatile Memory Containing Boot Code (CVSS 6.8, Milesight UG65-868M-EA)
- [CVE-2025-3925](https://cve.now/CVE-2025-3925.md): BrightSign Players Execution with Unnecessary Privileges (CVSS 7.8, BrightSign OS series 4 players · BrightSign OS series 5 pla…)
- [CVE-2025-3272](https://cve.now/CVE-2025-3272.md): Incorrect user authorization vulnerability has been identified in Open Text Operations Bridge Manager. (CVSS 6.7, OpenText™ Operations Bridge Manager)
- [CVE-2025-3476](https://cve.now/CVE-2025-3476.md): Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. (CVSS 9.4, OpenText™ Operations Bridge Manager)
- [CVE-2025-30147](https://cve.now/CVE-2025-30147.md): ALTBN128\_ADD, ALTBN128\_MUL, ALTBN128\_PAIRING precompile functions do not check if points are on curve (CVSS 8.7, hyperledger besu-native)
- [CVE-2025-20195](https://cve.now/CVE-2025-20195.md): A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a (CVSS 4.3, Cisco IOS XE Software)
- [CVE-2025-20194](https://cve.now/CVE-2025-20194.md): A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attacker (CVSS 5.4, Cisco IOS XE Software)
- [CVE-2025-20193](https://cve.now/CVE-2025-20193.md): A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attacker (CVSS 6.5, Cisco IOS XE Software)
- [CVE-2025-20201](https://cve.now/CVE-2025-20201.md): A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileg (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2025-20200](https://cve.now/CVE-2025-20200.md): A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileg (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2025-20199](https://cve.now/CVE-2025-20199.md): A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileg (CVSS 4.6, Cisco IOS XE Software)
- [CVE-2025-20198](https://cve.now/CVE-2025-20198.md): A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileg (CVSS 4.6, Cisco IOS XE Software)
- [CVE-2025-20197](https://cve.now/CVE-2025-20197.md): A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileg (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2025-20221](https://cve.now/CVE-2025-20221.md): A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass L (CVSS 5.3, Cisco IOS XE Software)
- [CVE-2025-20162](https://cve.now/CVE-2025-20162.md): A vulnerability in the DHCP snooping security feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a fu (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2025-20196](https://cve.now/CVE-2025-20196.md): A vulnerability in the Cisco IOx application hosting environment of Cisco IOS Software and Cisco IOS XE Software could allow an unauthentica (CVSS 5.3, Cisco IOS)
- [CVE-2025-46824](https://cve.now/CVE-2025-46824.md): Discourse Code Review Plugin vulnerable to XSS via auto link commits (CVSS 3.1, discourse-code-review)
- [CVE-2025-20186](https://cve.now/CVE-2025-20186.md): A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authent (CVSS 8.8, Cisco IOS XE Software)
- [CVE-2025-20223](https://cve.now/CVE-2025-20223.md): A vulnerability in Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to read and modify data i (CVSS 4.7, Cisco Digital Network Architecture Center)
- [CVE-2025-20155](https://cve.now/CVE-2025-20155.md): A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to a (CVSS 6.0, Cisco IOS XE Software)
- [CVE-2025-20140](https://cve.now/CVE-2025-20140.md): A vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an un (CVSS 7.4, Cisco IOS XE Software)
- [CVE-2025-20164](https://cve.now/CVE-2025-20164.md): A vulnerability in the Cisco Industrial Ethernet Switch Device Manager (DM) of Cisco IOS Software could allow an authenticated, remote attac (CVSS 8.3, Cisco IOS)
- [CVE-2025-20192](https://cve.now/CVE-2025-20192.md): A vulnerability in the Internet Key Exchange version 1 (IKEv1) implementation of Cisco IOS XE Software could allow an authenticated, remote (CVSS 7.7, Cisco IOS XE Software)
- [CVE-2025-20189](https://cve.now/CVE-2025-20189.md): A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers with R (CVSS 7.4, Cisco IOS XE Software)
- [CVE-2025-20181](https://cve.now/CVE-2025-20181.md): A vulnerability in Cisco IOS Software for Cisco Catalyst 2960X, 2960XR, 2960CX, and 3560CX Series Switches could allow an authenticated, loc (CVSS 6.8, Cisco IOS)
- [CVE-2025-20202](https://cve.now/CVE-2025-20202.md): A vulnerability in Cisco IOS XE Wireless Controller Software could allow an unauthenticated, adjacent attacker to cause a denial of service (CVSS 7.4, Cisco IOS XE Software)
- [CVE-2025-20190](https://cve.now/CVE-2025-20190.md): A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote atta (CVSS 6.5, Cisco IOS XE Software)
- [CVE-2025-46828](https://cve.now/CVE-2025-46828.md): Unauthenticated SQL Injection on get\_socios.php endpoint (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-20188](https://cve.now/CVE-2025-20188.md): A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features (CVSS 10.0, Cisco IOS XE Software)
- [CVE-2025-20214](https://cve.now/CVE-2025-20214.md): A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an authenticated, remote atta (CVSS 4.3, Cisco IOS XE Software)
- [CVE-2025-20137](https://cve.now/CVE-2025-20137.md): A vulnerability in the access control list (ACL) programming of Cisco IOS Software that is running on Cisco Catalyst 1000 Switches and Cisco (CVSS 4.7, Cisco IOS)
- [CVE-2025-32821](https://cve.now/CVE-2025-32821.md): A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell com (CVSS 7.1, SonicWall SMA100)
- [CVE-2025-32820](https://cve.now/CVE-2025-32820.md): A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make an (CVSS 8.3, SonicWall SMA100)
- [CVE-2025-20147](https://cve.now/CVE-2025-20147.md): Cisco SD-WAN vManage Stored Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Catalyst SD-WAN Manager)
- [CVE-2025-20216](https://cve.now/CVE-2025-20216.md): Cisco Catalyst SD-WAN Manager Reflected HTML Injection Vulnerability (CVSS 4.7, Cisco Catalyst SD-WAN Manager)
- [CVE-2025-20154](https://cve.now/CVE-2025-20154.md): Cisco IOS, IOS XE and IOS XR Software TWAMP Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XR Software)
- [CVE-2025-20151](https://cve.now/CVE-2025-20151.md): Cisco IOS and IOS XE Software SNMPv3 Configuration Restriction Vulnerability (CVSS 4.3, Cisco IOS XE Catalyst SD-WAN)
- [CVE-2025-20191](https://cve.now/CVE-2025-20191.md): Multiple Cisco Products Denial of Service Vulnerability (CVSS 7.4, Cisco NX-OS Software · Cisco Wireless LAN Controller)
- [CVE-2025-20187](https://cve.now/CVE-2025-20187.md): Cisco SD-WAN Manager Software Arbitrary File Creation Vulnerability (CVSS 6.5, Cisco Catalyst SD-WAN Manager)
- [CVE-2025-20122](https://cve.now/CVE-2025-20122.md): Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability (CVSS 7.8, Cisco Catalyst SD-WAN Manager)
- [CVE-2025-32819](https://cve.now/CVE-2025-32819.md): A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete (CVSS 8.8, SonicWall SMA100)
- [CVE-2025-20213](https://cve.now/CVE-2025-20213.md): Cisco Catalyst SDWAN Manager Arbitrary File Overwrite Vulnerability (CVSS 5.5, Cisco Catalyst SD-WAN Manager)
- [CVE-2025-20182](https://cve.now/CVE-2025-20182.md): Cisco Adaptive Security Appliance Software, Firepower Threat Defense Software and IOS XE Software IKEv2 Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-20157](https://cve.now/CVE-2025-20157.md): Cisco Catalyst vManage Certificate Validation Vulnerability (CVSS 5.9, Cisco Catalyst SD-WAN Manager)
- [CVE-2025-20210](https://cve.now/CVE-2025-20210.md): Cisco Catalyst Center Unprotected API Endpoint (CVSS 7.3, Cisco Digital Network Architecture Center)
- [CVE-2025-46551](https://cve.now/CVE-2025-46551.md): JRuby-OpenSSL has hostname verification disabled by default (CVSS 5.7, jruby-openssl · rubygems:jruby-openssl +1)
- [CVE-2025-46827](https://cve.now/CVE-2025-46827.md): Graylog Allows Session Takeover via Insufficient HTML Sanitization (CVSS 8.0, graylog2-server · org.graylog2:graylog2-server)
- [CVE-2024-47619](https://cve.now/CVE-2024-47619.md): tranport: TLS host name wildcard matching too lax (CVSS 7.5, syslog-ng)
- [CVE-2025-2777](https://cve.now/CVE-2025-2777.md): SysAid On-Prem \<= 23.3.40 lshw Proceessing XML External Entity Injection (CVSS 9.3, SysAid On-Prem)
- [CVE-2025-2776](https://cve.now/CVE-2025-2776.md): SysAid On-Prem \<= 23.3.40 serverurl Proceessing XML External Entity Injection (CVSS 9.3, KEV, SysAid On-Prem)
- [CVE-2025-2775](https://cve.now/CVE-2025-2775.md): SysAid On-Prem \<= 23.3.40 Checkin Proceessing XML External Entity Injection (CVSS 9.3, KEV, SysAid On-Prem)
- [CVE-2025-47692](https://cve.now/CVE-2025-47692.md): WordPress ContentStudio plugin \<= 1.3.5 - Broken Access Control Vulnerability (CVSS 4.3, Contentstudio)
- [CVE-2025-47691](https://cve.now/CVE-2025-47691.md): WordPress Ultimate Member plugin \<= 2.10.3 - Arbitrary Function Call vulnerability (CVSS 5.5, Ultimate Member)
- [CVE-2025-47688](https://cve.now/CVE-2025-47688.md): WordPress Advanced File Manager plugin \<= 5.3.1 - Broken Access Control to Notice Dismissal vulnerability (CVSS 5.3, Saad Iqbal Advanced File Manager)
- [CVE-2025-47686](https://cve.now/CVE-2025-47686.md): WordPress DELUCKS SEO plugin \<= 2.5.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, DELUCKS SEO)
- [CVE-2025-47685](https://cve.now/CVE-2025-47685.md): WordPress Contribuinte Checkout plugin \<= 2.0.03 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, Moloni Contribuinte Checkout)
- [CVE-2025-47684](https://cve.now/CVE-2025-47684.md): WordPress Smaily for WP plugin \<= 3.1.7 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, Smaily for WP)
- [CVE-2025-47683](https://cve.now/CVE-2025-47683.md): WordPress WP Maintenance plugin \<= 6.1.9.7 - PHP Object Injection Vulnerability (CVSS 7.2, Florent Maillefaud WP Maintenance)
- [CVE-2025-47681](https://cve.now/CVE-2025-47681.md): WordPress Web Accessibility with Max Access plugin \<= 2.0.9 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Ability Web Accessibility with Max Access)
- [CVE-2025-47679](https://cve.now/CVE-2025-47679.md): WordPress RS WP Book Showcase plugin \<= 6.7.59 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RS WP THEMES RS WP Book Showcase)
- [CVE-2025-47677](https://cve.now/CVE-2025-47677.md): WordPress Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery plugin \<= 2.7.7.25 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, gt3themes Photo Gallery)
- [CVE-2025-47676](https://cve.now/CVE-2025-47676.md): WordPress User Login History plugin \<= 2.1.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Faiyaz Alam User Login History)
- [CVE-2025-47675](https://cve.now/CVE-2025-47675.md): WordPress Woobox plugin \<= 1.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Woobox)
- [CVE-2025-47674](https://cve.now/CVE-2025-47674.md): WordPress Credova\_Financial plugin \<= 2.5.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Credova Financial Credova\_Financial)
- [CVE-2025-47669](https://cve.now/CVE-2025-47669.md): WordPress CBX Map for Google Map & OpenStreetMap plugin \<= 1.1.12 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Sabuj Kundu CBX Map for Google Map & OpenStreetMap)
- [CVE-2025-47668](https://cve.now/CVE-2025-47668.md): WordPress CookieCode plugin \<= 2.4.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, CookieCode)
- [CVE-2025-47667](https://cve.now/CVE-2025-47667.md): WordPress LiveAgent plugin \<= 4.4.7 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, qusupport LiveAgent)
- [CVE-2025-47665](https://cve.now/CVE-2025-47665.md): WordPress N360 | Splash Screen plugin \<= 1.0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, bistromatic N360 | Splash Screen)
- [CVE-2025-47664](https://cve.now/CVE-2025-47664.md): WordPress WP Pipes \<= 1.4.2 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.4, ThimPress WP Pipes)
- [CVE-2025-47662](https://cve.now/CVE-2025-47662.md): WordPress Woobox plugin \<= 1.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Woobox)
- [CVE-2025-47661](https://cve.now/CVE-2025-47661.md): WordPress 워드프레스 결제 심플페이 plugin \<= 5.2.11 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, codemstory 워드프레스 결제 심플페이)
- [CVE-2025-47659](https://cve.now/CVE-2025-47659.md): WordPress WPBakery Visual Composer WHMCS Elements plugin \<= 1.0.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, voidcoders WPBakery Visual Composer WHMCS Elements)
- [CVE-2025-47657](https://cve.now/CVE-2025-47657.md): WordPress Productive Commerce plugin \<= 1.1.40 - SQL Injection vulnerability (CVSS 9.3, Productive Minds Productive Commerce)
- [CVE-2025-47656](https://cve.now/CVE-2025-47656.md): WordPress Spiraclethemes Site Library plugin \<= 1.5.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Spiracle Themes Spiraclethemes Site Library)
- [CVE-2025-47655](https://cve.now/CVE-2025-47655.md): WordPress theMarketer plugin \<= 1.4.7 - CSRF to Stored XSS vulnerability (CVSS 7.1, themarketer2023 theMarketer)
- [CVE-2025-47653](https://cve.now/CVE-2025-47653.md): WordPress WP-Recall \<= 16.26.14 - Local File Inclusion Vulnerability (CVSS 7.5, tggfref WP-Recall)
- [CVE-2025-47649](https://cve.now/CVE-2025-47649.md): WordPress Open Close WooCommerce Store plugin \<= 4.9.9 - Local File Inclusion vulnerability (CVSS 8.8, StackWC Open Close WooCommerce Store)
- [CVE-2025-47648](https://cve.now/CVE-2025-47648.md): WordPress Pays – WooCommerce Payment Gateway plugin \<= 2.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, axima Pays – WooCommerce Payment Gateway)
- [CVE-2025-47647](https://cve.now/CVE-2025-47647.md): WordPress Sidebar Manager Light plugin \<= 1.18 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, OTWthemes Sidebar Manager Light)
- [CVE-2025-47644](https://cve.now/CVE-2025-47644.md): WordPress Integrations of Zoho CRM with Elementor form plugin \<= 1.0.8 - Open Redirection Vulnerability (CVSS 4.7, formsintegrations Integrations of Zoho CRM with Elementor f…)
- [CVE-2025-47643](https://cve.now/CVE-2025-47643.md): WordPress ELEX Product Feed for WooCommerce \<= 3.1.2 - SQL Injection Vulnerability (CVSS 7.6, ELEXtensions ELEX Product Feed for WooCommerce)
- [CVE-2025-47639](https://cve.now/CVE-2025-47639.md): WordPress Supertext Translation and Proofreading plugin \<= 4.26 - CSRF to Stored XSS vulnerability (CVSS 7.1, Supertext Translation and Proofreading)
- [CVE-2025-47638](https://cve.now/CVE-2025-47638.md): WordPress WP Discord Invite plugin \<= 2.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Sarvesh M Rao WP Discord Invite)
- [CVE-2025-47636](https://cve.now/CVE-2025-47636.md): WordPress List category posts plugin \<= 0.91.0 - Local File Inclusion Vulnerability (CVSS 7.5, Fernando Briano List category posts)
- [CVE-2025-47635](https://cve.now/CVE-2025-47635.md): WordPress WebinarPress plugin \<= 1.33.28 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 5.5, WPWebinarSystem WebinarPress)
- [CVE-2025-47633](https://cve.now/CVE-2025-47633.md): WordPress Awin – Advertiser Tracking for WooCommerce plugin \<= 2.0.0 - CSRF to Product Feed Regeneration vulnerability (CVSS 4.3, Awin – Advertiser Tracking for WooCommerce)
- [CVE-2025-47632](https://cve.now/CVE-2025-47632.md): WordPress Awesome Gallery plugin \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Raihanul Islam Awesome Gallery)
- [CVE-2025-47630](https://cve.now/CVE-2025-47630.md): WordPress Ajax Load More plugin \<= 7.3.1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Darren Cooney Ajax Load More)
- [CVE-2025-47629](https://cve.now/CVE-2025-47629.md): WordPress WP-CRM System plugin \<= 3.4.5 - PHP Object Injection vulnerability (CVSS 7.2, Mario Peshev WP-CRM System)
- [CVE-2025-47628](https://cve.now/CVE-2025-47628.md): WordPress QS Dark Mode plugin \<= 3.0 - Broken Access Control Vulnerability (CVSS 5.4, quomodosoft QS Dark Mode)
- [CVE-2025-47626](https://cve.now/CVE-2025-47626.md): WordPress Submission DOM tracking for Contact Form 7 plugin \<= 2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, apasionados Submission DOM tracking for Contact Form)
- [CVE-2025-47625](https://cve.now/CVE-2025-47625.md): WordPress DoFollow Case by Case plugin \<= 3.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, apasionados DoFollow Case by Case)
- [CVE-2025-47624](https://cve.now/CVE-2025-47624.md): WordPress DoFollow Case by Case plugin \<= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, apasionados DoFollow Case by Case)
- [CVE-2025-47623](https://cve.now/CVE-2025-47623.md): WordPress Easy PayPal Buy Now Button plugin \<= 2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Scott Paterson Easy PayPal Buy Now Button)
- [CVE-2025-47622](https://cve.now/CVE-2025-47622.md): WordPress Email Notification on Login plugin \<= 1.7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, apasionados Email Notification on Login)
- [CVE-2025-47621](https://cve.now/CVE-2025-47621.md): WordPress Meks Flexible Shortcodes plugin \<= 1.3.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Meks Flexible Shortcodes)
- [CVE-2025-47620](https://cve.now/CVE-2025-47620.md): WordPress Martins Free Monetized Ad Exchange Network plugin \<= 1.0.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, bundgaard Martins Free Monetized Ad Exchange Network)
- [CVE-2025-47617](https://cve.now/CVE-2025-47617.md): WordPress WP Front User Submit / Front Editor plugin \<= 5.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, aharonyan WP Front User Submit / Front Editor)
- [CVE-2025-47616](https://cve.now/CVE-2025-47616.md): WordPress aBlocks plugin \<= 1.9.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Kodezen aBlocks)
- [CVE-2025-47615](https://cve.now/CVE-2025-47615.md): WordPress Amazon Product in a Post plugin \<= 5.2.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, flowdee Amazon Product in a Post)
- [CVE-2025-47614](https://cve.now/CVE-2025-47614.md): WordPress LessButtons Social Sharing and Statistics plugin \<= 1.6.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, Chris Clark LessButtons Social Sharing and Statistics)
- [CVE-2025-47612](https://cve.now/CVE-2025-47612.md): WordPress ClickWhale plugin \<= 2.4.6 - Broken Access Control Vulnerability (CVSS 5.4, ClickWhale)
- [CVE-2025-47609](https://cve.now/CVE-2025-47609.md): WordPress EasyMe Connect plugin \<= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, easymebiz EasyMe Connect)
- [CVE-2025-47607](https://cve.now/CVE-2025-47607.md): WordPress Show All Comments plugin \<= 7.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, AppJetty Show All Comments)
- [CVE-2025-47606](https://cve.now/CVE-2025-47606.md): WordPress Simple Giveaways plugin \<= 2.49.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Igor Benic Simple Giveaways)
- [CVE-2025-47605](https://cve.now/CVE-2025-47605.md): WordPress WP jQuery DataTable plugin \<= 4.1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, AppJetty WP jQuery DataTable)
- [CVE-2025-47604](https://cve.now/CVE-2025-47604.md): WordPress Inline Related Posts plugin \<= 3.8.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Data443 Risk Mitigation Inline Related Posts)
- [CVE-2025-47602](https://cve.now/CVE-2025-47602.md): WordPress Calculate Prices based on Distance For WooCommerce plugin \<= 1.3.5 - Broken Access Control vulnerability (CVSS 5.4, ammarahmad786 Calculate Prices based on Distance For WooCom…)
- [CVE-2025-47597](https://cve.now/CVE-2025-47597.md): WordPress WP Podcasts Manager plugin \<= 1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Maulik Vora WP Podcasts Manager)
- [CVE-2025-47596](https://cve.now/CVE-2025-47596.md): WordPress Beacon Lead Magnets and Lead Capture plugin \<= 1.5.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Syed Balkhi Beacon Lead Magnets and Lead Capture)
- [CVE-2025-47595](https://cve.now/CVE-2025-47595.md): WordPress Color Your Bar plugin \<= 2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Darshan Saroya Color Your Bar)
- [CVE-2025-47594](https://cve.now/CVE-2025-47594.md): WordPress Soccer Live Scores \<= 1.0.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, DAEXT Soccer Live Scores)
- [CVE-2025-47593](https://cve.now/CVE-2025-47593.md): WordPress Really Simple Under Construction Page plugin \<= 1.4.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Jonas Hjalmarsson Really Simple Under Construction Page)
- [CVE-2025-47592](https://cve.now/CVE-2025-47592.md): WordPress Legal Terms and Conditions Popup for User Login and WooCommerce Checkout – TPUL plugin \<= 2.0.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Árpád Lehel Mátyus Terms Popup On User Login)
- [CVE-2025-47591](https://cve.now/CVE-2025-47591.md): WordPress Bulk Featured Image plugin \<= 1.2.4 - Broken Access Control vulnerability (CVSS 4.3, CreedAlly Bulk Featured Image)
- [CVE-2025-47590](https://cve.now/CVE-2025-47590.md): WordPress WPSpeed plugin \<= 2.6.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, JExtensions Store WPSpeed)
- [CVE-2025-47589](https://cve.now/CVE-2025-47589.md): WordPress Ebook Store plugin \<= 5.8009 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, motov.net Ebook Store)
- [CVE-2025-47587](https://cve.now/CVE-2025-47587.md): WordPress YaySMTP plugin \<= 2.6.4 - SQL Injection Vulnerability (CVSS 7.6, YayCommerce YaySMTP)
- [CVE-2025-47551](https://cve.now/CVE-2025-47551.md): WordPress Wiki Embed plugin \<= 1.4.6 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, ctltwp Wiki Embed)
- [CVE-2025-47550](https://cve.now/CVE-2025-47550.md): WordPress Instantio plugin \<= 3.3.16 - Arbitrary File Upload Vulnerability (CVSS 6.6, Themefic Instantio)
- [CVE-2025-47549](https://cve.now/CVE-2025-47549.md): WordPress BEAF plugin \<= 4.6.10 - Arbitrary File Upload Vulnerability (CVSS 9.1, Themefic BEAF)
- [CVE-2025-47548](https://cve.now/CVE-2025-47548.md): WordPress Wbcom Designs - Activity Link Preview For BuddyPress plugin \<= 1.4.4 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 5.4, Varun Dubey Wbcom Designs - Activity Link Preview For Buddy…)
- [CVE-2025-47547](https://cve.now/CVE-2025-47547.md): WordPress SendPulse Email Marketing Newsletter plugin \<= 2.1.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, SendPulse Email Marketing Newsletter)
- [CVE-2025-47546](https://cve.now/CVE-2025-47546.md): WordPress WP Compress plugin \<= 6.30.30 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, AresIT WP Compress)
- [CVE-2025-47545](https://cve.now/CVE-2025-47545.md): WordPress Poll Maker plugin \<= 5.7.7 - Race Condition Vulnerability (CVSS 5.3, Ays Pro Poll Maker)
- [CVE-2025-47544](https://cve.now/CVE-2025-47544.md): WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin \<= 4.5.8 - SQL Injection Vulnerability (CVSS 7.6, acowebs Dynamic Pricing With Discount Rules for WooCommerce)
- [CVE-2025-47543](https://cve.now/CVE-2025-47543.md): WordPress TrueBooker plugin \<= 1.0.7 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, themetechmount TrueBooker)
- [CVE-2025-47542](https://cve.now/CVE-2025-47542.md): WordPress Simple calendar for Elementor plugin \<= 1.6.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Michael Simple calendar for Elementor)
- [CVE-2025-47540](https://cve.now/CVE-2025-47540.md): WordPress weMail plugin \<= 1.14.13 - Sensitive Data Exposure Vulnerability (CVSS 5.3, weDevs weMail)
- [CVE-2025-47538](https://cve.now/CVE-2025-47538.md): WordPress Cart tracking for WooCommerce plugin \<= 1.0.17 - SQL Injection Vulnerability (CVSS 7.6, wpdever Cart tracking for WooCommerce)
- [CVE-2025-47537](https://cve.now/CVE-2025-47537.md): WordPress PDF Invoice Builder for WooCommerce plugin \<= 5.3.8 - SQL Injection Vulnerability (CVSS 7.6, add-ons.org PDF Invoice Builder for WooCommerce)
- [CVE-2025-47533](https://cve.now/CVE-2025-47533.md): WordPress Graphina plugin \<= 3.0.4 - Cross Site Request Forgery (CSRF) to Local File Inclusion vulnerability (CVSS 8.1, Iqonic Design Graphina)
- [CVE-2025-47531](https://cve.now/CVE-2025-47531.md): WordPress XT Event Widget for Social Events plugin \<= 1.1.7 - Local File Inclusion Vulnerability (CVSS 7.5, Xylus Themes XT Event Widget for Social Events)
- [CVE-2025-47528](https://cve.now/CVE-2025-47528.md): WordPress Ovation Elements plugin \<= 1.1.2 - Broken Access Control Vulnerability (CVSS 4.3, pewilliams Ovation Elements)
- [CVE-2025-47526](https://cve.now/CVE-2025-47526.md): WordPress GS Variation Swatches for WooCommerce plugin \<= 3.0.4 - Broken Access Control Vulnerability (CVSS 5.4, GS Plugins GS Variation Swatches for WooCommerce)
- [CVE-2025-47525](https://cve.now/CVE-2025-47525.md): WordPress Bold Page Builder plugin \<= 5.3.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, boldthemes Bold Page Builder)
- [CVE-2025-47524](https://cve.now/CVE-2025-47524.md): WordPress Quran multilanguage Text & Audio plugin \<= 2.3.23 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, karim42 Quran multilanguage Text & Audio)
- [CVE-2025-47523](https://cve.now/CVE-2025-47523.md): WordPress Seznam Webmaster plugin \<= 1.4.7 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Lukáš Hartmann Seznam Webmaster)
- [CVE-2025-47522](https://cve.now/CVE-2025-47522.md): WordPress AWEOS WP Lock plugin \<= 1.4.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, AWEOS WP Lock)
- [CVE-2025-47521](https://cve.now/CVE-2025-47521.md): WordPress Robo Gallery plugin \<= 5.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, robosoft Robo Gallery)
- [CVE-2025-47520](https://cve.now/CVE-2025-47520.md): WordPress Charitable plugin \<= 1.8.5.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Syed Balkhi Charitable)
- [CVE-2025-47519](https://cve.now/CVE-2025-47519.md): WordPress Easy PayPal Events plugin \<= 1.2.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Scott Paterson Easy PayPal Events)
- [CVE-2025-47518](https://cve.now/CVE-2025-47518.md): WordPress Contact Form 7 – PayPal & Stripe Add-on plugin \<= 2.3.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Scott Paterson Contact Form 7 – PayPal & Stripe Add-on)
- [CVE-2025-47517](https://cve.now/CVE-2025-47517.md): WordPress Accept Donations with PayPal plugin \<= 1.4.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Scott Paterson Accept Donations with PayPal & Stripe)
- [CVE-2025-47516](https://cve.now/CVE-2025-47516.md): WordPress Time Clock plugin \<= 1.2.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Scott Paterson Time Clock)
- [CVE-2025-47515](https://cve.now/CVE-2025-47515.md): WordPress WP DPE-GES plugin \<= 1.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Seb WP DPE-GES)
- [CVE-2025-47514](https://cve.now/CVE-2025-47514.md): WordPress ELI's Related Posts Footer Links and Widget plugin \<= 1.2.04.20 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, ELI's Related Posts Footer Links and Widget)
- [CVE-2025-47510](https://cve.now/CVE-2025-47510.md): WordPress Display Eventbrite Events plugin \< 6.3 - Local File Inclusion Vulnerability (CVSS 7.5, fullworks Display Eventbrite Events)
- [CVE-2025-47509](https://cve.now/CVE-2025-47509.md): WordPress Top 10 plugin \<= 4.1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ajay Top)
- [CVE-2025-47508](https://cve.now/CVE-2025-47508.md): WordPress GamiPress plugin \<= 7.3.7 - Local File Inclusion Vulnerability (CVSS 7.5, Ruben Garcia GamiPress)
- [CVE-2025-47507](https://cve.now/CVE-2025-47507.md): WordPress Better Search plugin \<= 4.1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ajay Better Search)
- [CVE-2025-47506](https://cve.now/CVE-2025-47506.md): WordPress Contextual Related Posts plugin \<= 4.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ajay Contextual Related Posts)
- [CVE-2025-47505](https://cve.now/CVE-2025-47505.md): WordPress Product Time Countdown for WooCommerce plugin \<= 1.6.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, ProWCPlugins Product Time Countdown for WooCommerce)
- [CVE-2025-47504](https://cve.now/CVE-2025-47504.md): WordPress Custom Checkout Fields for WooCommerce plugin \<= 1.8.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPFactory Custom Checkout Fields for WooCommerce)
- [CVE-2025-47503](https://cve.now/CVE-2025-47503.md): WordPress NGG Smart Image Search plugin \<= 3.3.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, wpo-HR NGG Smart Image Search)
- [CVE-2025-47502](https://cve.now/CVE-2025-47502.md): WordPress Mollie Forms plugin \<= 2.7.12 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Nick van Wobbie Mollie Forms)
- [CVE-2025-47501](https://cve.now/CVE-2025-47501.md): WordPress Content Control plugin \<= 2.6.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Daniel Iser Content Control)
- [CVE-2025-47499](https://cve.now/CVE-2025-47499.md): WordPress Simple Blog Stats plugin \<= 20250416 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Jeff Starr Simple Blog Stats)
- [CVE-2025-47498](https://cve.now/CVE-2025-47498.md): WordPress Hotel Booking plugin \<= 3.6 - Local File Inclusion Vulnerability (CVSS 7.5, nicdark Hotel Booking)
- [CVE-2025-47497](https://cve.now/CVE-2025-47497.md): WordPress Logo Showcase plugin \<= 3.0.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Themepoints Logo Showcase)
- [CVE-2025-47496](https://cve.now/CVE-2025-47496.md): WordPress PublishPress Authors plugin \<= 4.7.5 - Local File Inclusion Vulnerability (CVSS 7.5, PublishPress Authors)
- [CVE-2025-47495](https://cve.now/CVE-2025-47495.md): WordPress Blockspare plugin \<= 3.2.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Blockspare)
- [CVE-2025-47494](https://cve.now/CVE-2025-47494.md): WordPress EventON plugin \<= 2.4.1 - Local File Inclusion Vulnerability (CVSS 7.5, Ashan Perera EventON)
- [CVE-2025-47493](https://cve.now/CVE-2025-47493.md): WordPress Ultimate Blocks plugin \<= 3.2.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ultimate Blocks)
- [CVE-2025-47491](https://cve.now/CVE-2025-47491.md): WordPress Contact Form Widget plugin \<= 1.4.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.4, A WP Life Contact Form Widget)
- [CVE-2025-47490](https://cve.now/CVE-2025-47490.md): WordPress Ultimate WP Mail plugin \<= 1.3.4 - SQL Injection Vulnerability (CVSS 8.5, Rustaurius Ultimate WP Mail)
- [CVE-2025-47489](https://cve.now/CVE-2025-47489.md): WordPress Beds24 Online Booking plugin \<= 2.0.29 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, markkinchin Beds24 Online Booking)
- [CVE-2025-47488](https://cve.now/CVE-2025-47488.md): WordPress Bold Page Builder plugin \<= 5.3.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, boldthemes Bold Page Builder)
- [CVE-2025-47486](https://cve.now/CVE-2025-47486.md): WordPress Gutenberg & Elementor Templates Importer For Responsive plugin \<= 3.1.9 - Broken Access Control Vulnerability (CVSS 5.3, CyberChimps Responsive Plus)
- [CVE-2025-47485](https://cve.now/CVE-2025-47485.md): WordPress Cozy Blocks plugin \<= 2.1.22 - Broken Access Control Vulnerability (CVSS 5.3, CozyThemes Cozy Blocks)
- [CVE-2025-47484](https://cve.now/CVE-2025-47484.md): WordPress Display Remote Posts Block plugin \<= 1.1.0 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 6.4, Oliver Campion Display Remote Posts Block)
- [CVE-2025-47483](https://cve.now/CVE-2025-47483.md): WordPress Easy Replace Image plugin \<= 3.5.0 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.9, Iulia Cazan Easy Replace Image)
- [CVE-2025-47482](https://cve.now/CVE-2025-47482.md): WordPress SKT Skill Bar plugin \<= 2.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, sonalsinha21 SKT Skill Bar)
- [CVE-2025-47481](https://cve.now/CVE-2025-47481.md): WordPress GS Testimonial Slider plugin \<= 3.2.9 - Content Injection vulnerability (CVSS 5.3, GS Plugins GS Testimonial Slider)
- [CVE-2025-47480](https://cve.now/CVE-2025-47480.md): WordPress Graphina plugin \<= 3.0.4 - Broken Access Control Vulnerability (CVSS 5.4, Iqonic Design Graphina)
- [CVE-2025-47476](https://cve.now/CVE-2025-47476.md): WordPress Cost Calculator for Elementor plugin \<= 1.3.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, add-ons.org Cost Calculator for Elementor)
- [CVE-2025-47475](https://cve.now/CVE-2025-47475.md): WordPress JupiterX Core plugin \<= 4.8.11 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, artbees JupiterX Core)
- [CVE-2025-47473](https://cve.now/CVE-2025-47473.md): WordPress PW WooCommerce Bulk Edit plugin \<= 2.134 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, pimwick PW WooCommerce Bulk Edit)
- [CVE-2025-47472](https://cve.now/CVE-2025-47472.md): WordPress Music Player for WooCommerce plugin \<= 1.5.1 - Broken Access Control Vulnerability (CVSS 5.4, codepeople Music Player for WooCommerce)
- [CVE-2025-47471](https://cve.now/CVE-2025-47471.md): WordPress Envo Extra plugin \<= 1.9.9 - Broken Access Control Vulnerability (CVSS 4.3, EnvoThemes Envo Extra)
- [CVE-2025-47470](https://cve.now/CVE-2025-47470.md): WordPress GPT3 AI Content Writer plugin \<= 1.9.14 - Cross Site Request Forgery (CSRF) to Prompt Generation vulnerability (CVSS 4.3, senols GPT3 AI Content Writer)
- [CVE-2025-47469](https://cve.now/CVE-2025-47469.md): WordPress Media Hygiene plugin \<= 4.0.0 - Broken Access Control Vulnerability (CVSS 5.4, slui Media Hygiene)
- [CVE-2025-47468](https://cve.now/CVE-2025-47468.md): WordPress Hash Form plugin \<= 1.2.8 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, hashthemes Hash Form)
- [CVE-2025-47467](https://cve.now/CVE-2025-47467.md): WordPress GS Testimonial Slider plugin \<= 3.3.0 - Broken Access Control Vulnerability (CVSS 4.3, GS Plugins GS Testimonial Slider)
- [CVE-2025-47466](https://cve.now/CVE-2025-47466.md): WordPress Ultimate WP Mail plugin \<= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, Rustaurius Ultimate WP Mail)
- [CVE-2025-47465](https://cve.now/CVE-2025-47465.md): WordPress Blocksy theme \<= 2.0.97 - Broken Access Control Vulnerability (CVSS 4.9, creativethemeshq Blocksy)
- [CVE-2025-47464](https://cve.now/CVE-2025-47464.md): WordPress Solace Extra plugin \<= 1.3.1 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.9, solacewp Solace Extra)
- [CVE-2025-47462](https://cve.now/CVE-2025-47462.md): WordPress Challan plugin \<= 3.7.58 - CSRF to Privilege Escalation vulnerability (CVSS 8.8, WebAppick Challan)
- [CVE-2025-47460](https://cve.now/CVE-2025-47460.md): WordPress TrackShip for WooCommerce plugin \<= 1.9.1 - SQL Injection Vulnerability (CVSS 7.6, TrackShip for WooCommerce)
- [CVE-2025-47459](https://cve.now/CVE-2025-47459.md): WordPress WP Fundraising Donation and Crowdfunding Platform plugin \<= 1.7.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Roxnor FundEngine)
- [CVE-2025-47457](https://cve.now/CVE-2025-47457.md): WordPress LocateAndFilter plugin \<= 1.6.16 - Broken Access Control Vulnerability (CVSS 5.3, dgamoni LocateAndFilter)
- [CVE-2025-47456](https://cve.now/CVE-2025-47456.md): WordPress WP Gravity Forms Zendesk plugin \<= 1.1.2 - Open Redirection Vulnerability (CVSS 4.7, CRM Perks WP Gravity Forms Zendesk)
- [CVE-2025-47455](https://cve.now/CVE-2025-47455.md): WordPress Integration for WooCommerce and Salesforce plugin \<= 1.7.5 - Open Redirection Vulnerability (CVSS 4.7, CRM Perks Integration for WooCommerce and Salesforce)
- [CVE-2025-47454](https://cve.now/CVE-2025-47454.md): WordPress WP Gravity Forms Dynamics CRM plugin \<= 1.1.4 - Open Redirection Vulnerability (CVSS 4.7, CRM Perks WP Gravity Forms Dynamics CRM)
- [CVE-2025-47451](https://cve.now/CVE-2025-47451.md): WordPress Product Quantity Dropdown For Woocommerce plugin \<= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, silverplugins217 Product Quantity Dropdown For Woocommerce)
- [CVE-2025-47450](https://cve.now/CVE-2025-47450.md): WordPress Simple File List plugin \<= 6.1.13 - Settings Change Vulnerability (CVSS 5.3, Mitchell Bennis Simple File List)
- [CVE-2025-47449](https://cve.now/CVE-2025-47449.md): WordPress Meow Gallery plugin \<= 5.2.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Jordy Meow Meow Gallery)
- [CVE-2025-47448](https://cve.now/CVE-2025-47448.md): WordPress WP Hotel Booking plugin \<= 2.1.9 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, ThimPress WP Hotel Booking)
- [CVE-2025-47447](https://cve.now/CVE-2025-47447.md): WordPress Cool Author Box plugin \<= 3.0.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Hossni Mubarak Cool Author Box)
- [CVE-2025-47446](https://cve.now/CVE-2025-47446.md): WordPress Listamester plugin \<= 2.3.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Listamester)
- [CVE-2025-47443](https://cve.now/CVE-2025-47443.md): WordPress Widget Countdown plugin \<= 2.7.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, wpdevart Widget Countdown)
- [CVE-2025-47442](https://cve.now/CVE-2025-47442.md): WordPress CC BMI Calculator plugin \<= 2.1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, CC BMI Calculator)
- [CVE-2025-47441](https://cve.now/CVE-2025-47441.md): WordPress Progress Bar plugin \<= 2.2.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Chris Reynolds Progress Bar)
- [CVE-2025-47440](https://cve.now/CVE-2025-47440.md): WordPress WPAdverts plugin \<= 2.2.2 - Local File Inclusion Vulnerability (CVSS 7.5, Greg Winiarski WPAdverts)
- [CVE-2025-47439](https://cve.now/CVE-2025-47439.md): WordPress Download Monitor plugin \<= 5.0.22 - Local File Inclusion Vulnerability (CVSS 7.5, WP Chill Download Monitor)
- [CVE-2020-36791](https://cve.now/CVE-2020-36791.md): net\_sched: keep alloc\_hash updated after hash allocation (CVSS 7.8, Linux)
- [CVE-2025-33093](https://cve.now/CVE-2025-33093.md): IBM Sterling Partner Engagement Manager information disclosure (CVSS 7.5, IBM Sterling Partner Engagement Manager)
- [CVE-2025-4104](https://cve.now/CVE-2025-4104.md): Frontend Dashboard 1.0 - 2.2.6 - Missing Authorization to Unauthenticated Privilege Escalation via fed\_wp\_ajax\_fed\_login\_form\_post Function (CVSS 9.8, vinoth06 Frontend Dashboard)
- [CVE-2025-39361](https://cve.now/CVE-2025-39361.md): WordPress Royal Elementor Addons plugin \<= 1.7.1017 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Royal Royal Elementor Addons)
- [CVE-2025-27533](https://cve.now/CVE-2025-27533.md): Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation (CVSS 6.9, Apache Software Foundation Apache ActiveMQ · org.apache.… +1)
- [CVE-2025-20980](https://cve.now/CVE-2025-20980.md): Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to cause memory corruption. (CVSS 4.0, Samsung Mobile libsavscmn)
- [CVE-2025-20979](https://cve.now/CVE-2025-20979.md): Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to execute arbitrary code. (CVSS 8.4, Samsung Mobile libsavscmn)
- [CVE-2025-20978](https://cve.now/CVE-2025-20978.md): Improper access control in PENUP prior to version 3.9.19.32 allows local attackers to access files with PENUP privilege. (CVSS 6.2, Samsung Mobile PENUP)
- [CVE-2025-20977](https://cve.now/CVE-2025-20977.md): Use of implicit intent for sensitive communication in translation in Samsung Notes prior to version 4.4.29.23 allows local attackers to get (CVSS 3.3, Samsung Mobile Samsung Notes)
- [CVE-2025-20976](https://cve.now/CVE-2025-20976.md): Out-of-bounds read in applying binary of text content in Samsung Notes prior to version 4.4.29.23 allows attackers to read out-of-bounds mem (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20975](https://cve.now/CVE-2025-20975.md): Improper Export of Android Application Components in AODService prior to version 8.8.28.12 allows local attackers to launch arbitrary activi (CVSS 5.5, Samsung Mobile AODService)
- [CVE-2025-20974](https://cve.now/CVE-2025-20974.md): Improper handling of insufficient permission in PackageInstallerCN prior to version 15.0.11.0 allows local attacker to bypass user interacti (CVSS 6.1, Samsung Mobile PackageInstallerCN)
- [CVE-2025-20973](https://cve.now/CVE-2025-20973.md): Improper authentication in Secure Folder prior to version 1.8.12.0 in Android 13, and 1.9.21.00 in Android 14 allows physical attackers to r (CVSS 5.4, Samsung Mobile Secure Folder)
- [CVE-2025-20972](https://cve.now/CVE-2025-20972.md): Improper verification of intent by broadcast receiver in Samsung Flow prior to version 4.9.17.6 allows local attackers to modify Samsung Flo (CVSS 6.2, Samsung Mobile Samsung Flow)
- [CVE-2025-20971](https://cve.now/CVE-2025-20971.md): Improper input validation in Samsung Flow prior to version 4.9.17.6 allows local attackers to access data within Samsung Flow. (CVSS 5.5, Samsung Mobile Samsung Flow)
- [CVE-2025-20970](https://cve.now/CVE-2025-20970.md): Improper access control in Bixby Vision prior to version 3.8.1 in Android 13, 3.8.3 in Android 14, 3.8.21 in Android 15 allows local attacke (CVSS 6.2, Samsung Mobile Bixby Vision)
- [CVE-2025-20969](https://cve.now/CVE-2025-20969.md): Improper input validation in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 i (CVSS 5.5, Samsung Mobile Samsung Gallery)
- [CVE-2025-20968](https://cve.now/CVE-2025-20968.md): Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in (CVSS 7.2, Samsung Mobile Samsung Gallery)
- [CVE-2025-20967](https://cve.now/CVE-2025-20967.md): Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in (CVSS 5.1, Samsung Mobile Samsung Gallery)
- [CVE-2025-20966](https://cve.now/CVE-2025-20966.md): Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in (CVSS 4.6, Samsung Mobile Samsung Gallery)
- [CVE-2025-20965](https://cve.now/CVE-2025-20965.md): Improper handling of insufficient permission in Bixby wakeup prior to version 2.3.74.8 allows local attackers to access sensitive data. (CVSS 6.2, Samsung Mobile Voice wake-up)
- [CVE-2025-20964](https://cve.now/CVE-2025-20964.md): Out-of-bounds write in parsing media files in libsavsvc.so prior to SMR May-2025 Release 1 allows local attackers to write out-of-bounds mem (CVSS 6.6, Samsung Mobile Devices)
- [CVE-2025-20963](https://cve.now/CVE-2025-20963.md): Out-of-bounds write in memory initialization in libsavsvc.so prior to SMR May-2025 Release 1 allows local attackers to write out-of-bounds m (CVSS 6.6, Samsung Mobile Devices)
- [CVE-2025-20962](https://cve.now/CVE-2025-20962.md): Improper handling of insufficient permission in SpenGesture service prior to SMR May-2025 Release 1 allows local attackers to track the S Pe (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-20961](https://cve.now/CVE-2025-20961.md): Improper handling of insufficient permission or privileges in sepunion service prior to SMR May-2025 Release 1 allows local privileged attac (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-20960](https://cve.now/CVE-2025-20960.md): Improper handling of insufficient permission in CocktailBarService prior to SMR May-2025 Release 1 allows local attackers to use the privile (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-20959](https://cve.now/CVE-2025-20959.md): Use of implicit intent for sensitive communication in Wi-Fi P2P service prior to SMR May-2025 Release 1 allows local attackers to access sen (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2025-20958](https://cve.now/CVE-2025-20958.md): Improper verification of intent by broadcast receiver in UnifiedWFC prior to SMR May-2025 Release 1 allows local attackers to manipulate VoW (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2025-20957](https://cve.now/CVE-2025-20957.md): Improper access control in SmartManagerCN prior to SMR May-2025 Release 1 allows local attackers to launch arbitrary activities with SmartMa (CVSS 7.3, Samsung Mobile Devices)
- [CVE-2025-20956](https://cve.now/CVE-2025-20956.md): Improper export of android application components in Settings in Galaxy Watch prior to SMR May-2025 Release 1 allows physical attackers to a (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2025-20955](https://cve.now/CVE-2025-20955.md): Improper Export of Android Application Components in NotificationHistoryImageProvider prior to SMR May-2025 Release 1 allows local attackers (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-20954](https://cve.now/CVE-2025-20954.md): Use of implicit intent for sensitive communication in EnrichedCall prior to SMR May-2025 Release 1 allows local attackers to access sensitiv (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-20953](https://cve.now/CVE-2025-20953.md): Improper access control in SmartManagerCN prior to SMR May-2025 Release 1 allows local attackers to launch activities within SmartManagerCN. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2025-20949](https://cve.now/CVE-2025-20949.md): Path traversal vulnerability in Samsung Members prior to version 5.0.00.11 allows attackers to read and write arbitrary file with the privil (CVSS 5.1, Samsung Mobile Samsung Members)
- [CVE-2025-20937](https://cve.now/CVE-2025-20937.md): Out-of-bounds write in Keymaster trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to write out-of-bounds memory. (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2025-0669](https://cve.now/CVE-2025-0669.md): BOINC Server Cross-Site Request Forgery (CVSS 8.6, BOINC Server)
- [CVE-2025-0668](https://cve.now/CVE-2025-0668.md): BOINC Server Multiple SQL Injections (CVSS 9.3, BOINC Server)
- [CVE-2025-0667](https://cve.now/CVE-2025-0667.md): BOINC Server Stored XSS Injection in pm.php (CVSS 8.7, BOINC Server)
- [CVE-2025-0666](https://cve.now/CVE-2025-0666.md): BOINC Server Stored XSS Injection in host\_venue\_action.php (CVSS 7.0, BOINC Server)
- [CVE-2024-12120](https://cve.now/CVE-2024-12120.md): Royal Elementor Addons and Templates \<= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2025-4171](https://cve.now/CVE-2025-4171.md): WZ Followed Posts – Display what visitors are reading \<= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ajay WZ Followed Posts – Display what visitors are reading)
- [CVE-2025-32405](https://cve.now/CVE-2025-32405.md): An Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the library by (CVSS 7.5, RT-Labs P-Net)
- [CVE-2025-32404](https://cve.now/CVE-2025-32404.md): An Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to corrupt the memory of IO devices that use the library (CVSS 4.8, RT-Labs P-Net)
- [CVE-2025-32403](https://cve.now/CVE-2025-32403.md): An Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to corrupt the memory of IO devices that use the library (CVSS 4.8, RT-Labs P-Net)
- [CVE-2025-32402](https://cve.now/CVE-2025-32402.md): An Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the library by (CVSS 7.5, RT-Labs P-Net)
- [CVE-2025-32401](https://cve.now/CVE-2025-32401.md): An Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to corrupt the memory of IO devices that use the (CVSS 4.8, RT-Labs P-Net)
- [CVE-2025-32400](https://cve.now/CVE-2025-32400.md): An Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the libr (CVSS 7.5, RT-Labs P-Net)
- [CVE-2025-32399](https://cve.now/CVE-2025-32399.md): An Unchecked Input for Loop Condition in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to cause IO devices that use the library (CVSS 5.3, RT-Labs P-Net)
- [CVE-2025-32398](https://cve.now/CVE-2025-32398.md): A NULL Pointer Dereference in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the library (CVSS 7.5, RT-Labs P-Net)
- [CVE-2025-32397](https://cve.now/CVE-2025-32397.md): An Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the libr (CVSS 7.5, RT-Labs P-Net)
- [CVE-2025-32396](https://cve.now/CVE-2025-32396.md): An Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the libr (CVSS 7.5, RT-Labs P-Net)
- [CVE-2025-1400](https://cve.now/CVE-2025-1400.md): Out-of-bounds Read in libplctag library (CVSS 3.1, libplctag)
- [CVE-2025-1399](https://cve.now/CVE-2025-1399.md): Out-of-bounds Read in libplctag library (CVSS 3.1, libplctag)
- [CVE-2025-3766](https://cve.now/CVE-2025-3766.md): Login Lockdown & Protection \<= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelisting (CVSS 5.4, webfactory Login Lockdown & Protection)
- [CVE-2025-4054](https://cve.now/CVE-2025-4054.md): Relevanssi \<= 4.24.3 (Free) and \<= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search Highlights (CVSS 6.1, Relevanssi Premium · comesio Relevanssi – A Better Search)
- [CVE-2025-4220](https://cve.now/CVE-2025-4220.md): Xavin's List Subpages \<= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, xavinnydek Xavin&#039;s List Subpages)
- [CVE-2025-3860](https://cve.now/CVE-2025-3860.md): CarDealerPress \<= 6.8.2505.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass Parameter (CVSS 6.4, dealertrend CarDealerPress)
- [CVE-2025-4055](https://cve.now/CVE-2025-4055.md): Multiple Post Type Order \<= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode (CVSS 6.4, josj404 Multiple Post Type Order)
- [CVE-2025-3921](https://cve.now/CVE-2025-3921.md): PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel\_ajax\_req Function (CVSS 8.2, PeproDev Ultimate Profile Solutions)
- [CVE-2025-3852](https://cve.now/CVE-2025-3852.md): WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover (CVSS 8.8, eoxia WPshop 2 – E-Commerce)
- [CVE-2025-4335](https://cve.now/CVE-2025-4335.md): Woocommerce Multiple Addresses \<= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, n3wnormal Woocommerce Multiple Addresses)
- [CVE-2025-3924](https://cve.now/CVE-2025-3924.md): PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Unauthenticated Email Enumeration (CVSS 5.3, PeproDev Ultimate Profile Solutions)
- [CVE-2025-3844](https://cve.now/CVE-2025-3844.md): PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account Takeover (CVSS 9.8, PeproDev Ultimate Profile Solutions)
- [CVE-2025-3851](https://cve.now/CVE-2025-3851.md): Download Manager and Payment Form WordPress Plugin – WP SmartPay 1.1.0 - 2.7.13 - Authenticated (Subscriber+) Information Exposure (CVSS 4.3, themesgrove Download Manager and Payment Form WordPress Plu…)
- [CVE-2025-2821](https://cve.now/CVE-2025-2821.md): Search Exclude \<= 2.4.9 - Missing Authorization to Unauthenticated Plugin Settings Modification (CVSS 5.3, quadlayers Search Exclude)
- [CVE-2025-3853](https://cve.now/CVE-2025-3853.md): WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation (CVSS 6.5, eoxia WPshop 2 – E-Commerce)
- [CVE-2025-3218](https://cve.now/CVE-2025-3218.md): IBM i improper certificate validation (CVSS 5.4, IBM i)
- [CVE-2025-26168](https://cve.now/CVE-2025-26168.md): IXON VPN Client before 1.4.4 on Linux and macOS allows Local Privilege Escalation to root because there is code execution from a configurati (CVSS 8.1, IXON VPN Client)
- [CVE-2025-26169](https://cve.now/CVE-2025-26169.md): IXON VPN Client before 1.4.4 on Windows allows Local Privilege Escalation to SYSTEM because there is code execution from a configuration fil (CVSS 8.1, IXON VPN Client)
- [CVE-2025-29152](https://cve.now/CVE-2025-29152.md): Cross-Site Scripting vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via multiple comp (CVSS 7.6)
- [CVE-2025-29153](https://cve.now/CVE-2025-29153.md): SQL Injection vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via the Data export, fil (CVSS 5.4)
- [CVE-2025-29154](https://cve.now/CVE-2025-29154.md): HTML injection vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via the .galera.app/ted (CVSS 6.5)
- [CVE-2025-29448](https://cve.now/CVE-2025-29448.md): Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, caus (CVSS 7.5, alextselegidis/easyappointments)
- [CVE-2025-29602](https://cve.now/CVE-2025-29602.md): flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories. (CVSS 6.1)
- [CVE-2025-29746](https://cve.now/CVE-2025-29746.md): Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and (CVSS 6.1, koillection/koillection)
- [CVE-2025-45388](https://cve.now/CVE-2025-45388.md): Wagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting (XSS) in the document upload functionality. (CVSS 6.1)
- [CVE-2025-45514](https://cve.now/CVE-2025-45514.md): Tenda FH451 V1.0.0.9 has a stack overflow vulnerability in the function.frmL7ImForm. (CVSS 6.5)
- [CVE-2025-47203](https://cve.now/CVE-2025-47203.md): dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used. (CVSS 4.5, Dropbear SSH Project Dropbear SSH)
- [CVE-2025-47423](https://cve.now/CVE-2025-47423.md): Personal Weather Station Dashboard 12\_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the (CVSS 5.8, pwsdashboard Personal Weather Station Dashboard)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.