# CVEs published 2025-05-15

306 CVEs were published on May 15, 2025: 11 critical, 39 high. Days are UTC.

- [CVE-2025-4729](https://cve.now/CVE-2025-4729.md): TOTOLINK A3002R/A3002RU HTTP POST Request formMapDelDevice command injection (CVSS 5.3, TOTOLINK A3002R · TOTOLINK A3002RU)
- [CVE-2025-47930](https://cve.now/CVE-2025-47930.md): Zulip Server has access control bypass for restrictions on creation of specific channel types (CVSS 5.3, zulip)
- [CVE-2025-4728](https://cve.now/CVE-2025-4728.md): SourceCodester Best Online News Portal search.php sql injection (CVSS 6.9, SourceCodester Best Online News Portal)
- [CVE-2025-4727](https://cve.now/CVE-2025-4727.md): Meteor livedata\_server.js Object.assign redos (CVSS 6.3, Meteor)
- [CVE-2025-0921](https://cve.now/CVE-2025-0921.md): Information Tampering Vulnerability in Multiple Services of GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, GENESIS, GENESIS32, and BizViz (CVSS 6.5, Mitsubishi Electric GENESIS64 · Mitsubishi Electric ICO… +17)
- [CVE-2025-4726](https://cve.now/CVE-2025-4726.md): itsourcecode Placement Management System view\_student.php sql injection (CVSS 6.9, itsourcecode Placement Management System)
- [CVE-2025-4725](https://cve.now/CVE-2025-4725.md): itsourcecode Placement Management System view\_drive.php sql injection (CVSS 6.9, itsourcecode Placement Management System)
- [CVE-2025-4724](https://cve.now/CVE-2025-4724.md): itsourcecode Placement Management System student\_profile.php sql injection (CVSS 6.9, itsourcecode Placement Management System)
- [CVE-2025-4723](https://cve.now/CVE-2025-4723.md): itsourcecode Placement Management System all\_student.php sql injection (CVSS 6.9, itsourcecode Placement Management System)
- [CVE-2025-4722](https://cve.now/CVE-2025-4722.md): itsourcecode Placement Management System edit\_profile.php sql injection (CVSS 6.9, itsourcecode Placement Management System)
- [CVE-2025-47287](https://cve.now/CVE-2025-47287.md): Tornado vulnerable to excessive logging caused by malformed multipart form data (CVSS 7.5, tornadoweb tornado · tornado)
- [CVE-2025-47275](https://cve.now/CVE-2025-47275.md): Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK (CVSS 9.1, auth0-PHP · auth0/auth0-php)
- [CVE-2025-4721](https://cve.now/CVE-2025-4721.md): itsourcecode Placement Management System drive.php sql injection (CVSS 6.9, itsourcecode Placement Management System)
- [CVE-2025-4720](https://cve.now/CVE-2025-4720.md): SourceCodester Student Result Management System drop\_student.php path traversal (CVSS 5.3, SourceCodester Student Result Management System)
- [CVE-2025-4719](https://cve.now/CVE-2025-4719.md): Campcodes Sales and Inventory System cash\_transaction.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-4718](https://cve.now/CVE-2025-4718.md): Campcodes Sales and Inventory System customer\_add.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-47929](https://cve.now/CVE-2025-47929.md): DumbDrop vulnerable to DOM XSS via file upload (CVSS 2.1, DumbWareio DumbDrop)
- [CVE-2025-1138](https://cve.now/CVE-2025-1138.md): IBM Information Server information disclosure (CVSS 4.3, IBM InfoSphere Information Server)
- [CVE-2025-47928](https://cve.now/CVE-2025-47928.md): Spotipy repo vulnerable to secrets exfiltration via \`pull\_request\_target\` (CVSS 9.1, spotipy-dev spotipy)
- [CVE-2024-8009](https://cve.now/CVE-2024-8009.md): Sensei LMS \< 4.20.0 - Teacher+ Users Email Address Disclosure (CVSS 4.3, Sensei LMS)
- [CVE-2024-6711](https://cve.now/CVE-2024-6711.md): Event Tickets with Ticket Scanner \< 2.3.8 - Admin+ Stored XSS (CVSS 3.5, Event Tickets with Ticket Scanner)
- [CVE-2024-4665](https://cve.now/CVE-2024-4665.md): EventPrime – Events Calendar, Bookings and Tickets \< 3.5.0 - Subscriber+ Arbitrary booking settings update (CVSS 6.4, EventPrime)
- [CVE-2024-4091](https://cve.now/CVE-2024-4091.md): Responsive Gallery Grid \< 2.3.15 - Admin+ Stored XSS (CVSS 3.5, Responsive Gallery Grid)
- [CVE-2024-4004](https://cve.now/CVE-2024-4004.md): Advanced Cron Manager \< 2.5.7 - Admin+ Stored XSS (CVSS 3.5, Advanced Cron Manager)
- [CVE-2024-4002](https://cve.now/CVE-2024-4002.md): Carousel, Slider, Gallery by WP Carousel \< 2.6.9 - Editor+ Stored XSS (CVSS 3.5, Carousel, Slider, Gallery by WP Carousel)
- [CVE-2024-3996](https://cve.now/CVE-2024-3996.md): Post Grid, Post Carousel, & List Category Posts \< 2.4.28 - Editor+ Stored XSS (CVSS 3.5, Smart Post Show)
- [CVE-2024-3901](https://cve.now/CVE-2024-3901.md): Genesis Blocks \<= 3.1.3 - Contributor+ Stored XSS (CVSS 6.8, Genesis Blocks)
- [CVE-2024-3062](https://cve.now/CVE-2024-3062.md): Save as PDF by Pdfcrowd \< 3.2.2 - Admin+ Stored XSS (CVSS 4.8, Save as Image Plugin by Pdfcrowd)
- [CVE-2024-2869](https://cve.now/CVE-2024-2869.md): Easy Property Listings \<= 3.5.3 - Admin+ Stored XSS (CVSS 4.8, Easy Property Listings)
- [CVE-2024-2643](https://cve.now/CVE-2024-2643.md): My Sticky Bar \< 2.6.8 - Admin+ Stored XSS (CVSS 4.8, Floating Notification Bar, Sticky Menu on Scroll, Announcem…)
- [CVE-2024-1663](https://cve.now/CVE-2024-1663.md): Ultimate Noindex Nofollow Tool II \< 1.3.6 - Admin+ Stored XSS (CVSS 4.8, Ultimate Noindex Nofollow Tool II)
- [CVE-2024-12767](https://cve.now/CVE-2024-12767.md): BuddyBoss platform \< 2.7.60 - Private Comment Exposure via IDOR (CVSS 3.5, buddyboss-platform)
- [CVE-2024-0970](https://cve.now/CVE-2024-0970.md): User Activity Tracking and Log \< 4.1.4 - IP Spoofing (CVSS 5.3, User Activity Tracking and Log)
- [CVE-2024-0852](https://cve.now/CVE-2024-0852.md): coreActivity \< 1.8.1 - Unauthenticated Stored XSS (CVSS 8.8, coreActivity: Activity Logging for WordPress)
- [CVE-2024-0249](https://cve.now/CVE-2024-0249.md): Advanced Schedule Posts \<= 2.1.8 - Reflected XSS (CVSS 7.1, Advanced Schedule Posts)
- [CVE-2023-7297](https://cve.now/CVE-2023-7297.md): TwitterPosts \<= 1.0.2 - Settings Update via CSRF (CVSS 3.5, TwitterPosts)
- [CVE-2023-7239](https://cve.now/CVE-2023-7239.md): wp-dashboard-notes \< 1.0.11 - Contributor+ Arbitrary Private Notes Update via IDOR (CVSS 7.5, WP Dashboard Notes)
- [CVE-2023-7231](https://cve.now/CVE-2023-7231.md): illi Link Party! \<= 1.0 - Unauthenticated Arbitrary Link Deletion (CVSS 7.3, illi Link Party!)
- [CVE-2023-7230](https://cve.now/CVE-2023-7230.md): illi Link Party! \<= 1.0 - Admin+ Stored Cross-Site Scripting (CVSS 6.1, illi Link Party!)
- [CVE-2023-7229](https://cve.now/CVE-2023-7229.md): illi Link Party! \<= 1.0 - Settings Update via CSRF (CVSS 5.5, illi Link Party!)
- [CVE-2023-7228](https://cve.now/CVE-2023-7228.md): illi Link Party! \<= 1.0 - Unauthenticated Stored XSS (CVSS 6.1, illi Link Party!)
- [CVE-2023-7197](https://cve.now/CVE-2023-7197.md): Marketing Twitter Bot \<= 1.11 - Settings Update to Stored XSS via CSRF (CVSS 7.1, Marketing Twitter Bot)
- [CVE-2023-7196](https://cve.now/CVE-2023-7196.md): Ultimate Noindex Nofollow Tool \<= 1.1.2 - Settings Update via CSRF (CVSS 4.3, Ultimate Noindex Nofollow Tool)
- [CVE-2023-7195](https://cve.now/CVE-2023-7195.md): WP-Reply Notify \<= 1.1 - Settings Update via CSRF (CVSS 4.3, WP-Reply Notify)
- [CVE-2023-7174](https://cve.now/CVE-2023-7174.md): aBitGone CommentSafe \<= 1.0.0 - Settings Update to Stored XSS via CSRF (CVSS 7.1, aBitGone CommentSafe)
- [CVE-2023-7168](https://cve.now/CVE-2023-7168.md): Better Follow Button for Jetpack \<= 8.0 - Admin+ Stored XSS (CVSS 4.8, Better Follow Button for Jetpack)
- [CVE-2023-7088](https://cve.now/CVE-2023-7088.md): Add SVG Support for Media Uploader | inventivo \<= 1.0.5 - Author+ Stored XSS via SVG (CVSS 5.4, Add SVG Support for Media Uploader | inventivo)
- [CVE-2023-7086](https://cve.now/CVE-2023-7086.md): SVG Uploads Support \<= 2.1.1 - Author+ Stored XSS via SVG (CVSS 5.4, SVG Uploads Support)
- [CVE-2023-6786](https://cve.now/CVE-2023-6786.md): Payment Gateway for Telcell \<= 2.0.1 - Unauthenticated Open Redirect (CVSS 6.1, Payment Gateway for Telcell)
- [CVE-2023-6783](https://cve.now/CVE-2023-6783.md): WolfNet IDX for WordPress \<= 1.19.1 - Admin+ Stored XSS (CVSS 4.8, WolfNet IDX for WordPress)
- [CVE-2023-6541](https://cve.now/CVE-2023-6541.md): Allow SVG \< 1.2.0 - Author+ Stored XSS via SVG (CVSS 6.1, Allow SVG)
- [CVE-2023-6030](https://cve.now/CVE-2023-6030.md): LogDash Activity Log \< 1.1.4 - Unauthenticated SQLi (CVSS 5.4, LogDash Activity Log)
- [CVE-2023-5934](https://cve.now/CVE-2023-5934.md): Travelpayouts \< 1.1.13 - Settings Update via CSRF (CVSS 7.3, Travelpayouts: All Travel Brands in One Place)
- [CVE-2023-5932](https://cve.now/CVE-2023-5932.md): Travelpayouts \< 1.1.14 - Reflected XSS (CVSS 4.8, Travelpayouts: All Travel Brands in One Place)
- [CVE-2023-5529](https://cve.now/CVE-2023-5529.md): Advanced Page Visit Counter \<= 8.0.6 - Admin+ Stored XSS (CVSS 4.8, Advanced Page Visit Counter)
- [CVE-2023-2334](https://cve.now/CVE-2023-2334.md): Easy Digital Downloads Google Sheet Connector \< 1.6.6 - Access Code Update via CSRF (CVSS 5.4, edd-google-sheet-connector-pro · Easy Digital Downloads Goo…)
- [CVE-2025-2248](https://cve.now/CVE-2025-2248.md): WP-PManager \<= 1.2 - Admin+ SQL Injection (CVSS 5.4, WP-PManager)
- [CVE-2025-2247](https://cve.now/CVE-2025-2247.md): WP-PManager \<= 1.2 - Category Deletion via CSRF (CVSS 5.4, WP-PManager)
- [CVE-2025-2203](https://cve.now/CVE-2025-2203.md): WooCommerce Checkout & Funnel Builder by FunnelKit \< 3.10.2 - Admin+ SQL Injection (CVSS 6.1, FunnelKit)
- [CVE-2025-1454](https://cve.now/CVE-2025-1454.md): Ninja Pages \<= 1.4.2 - Admin+ Stored XSS (CVSS 5.4, Ninja Pages)
- [CVE-2025-1303](https://cve.now/CVE-2025-1303.md): Plugin Oficial – Getnet para WooCommerce \<= 1.7.3 - Unauthenticated Reflected XSS (CVSS 6.1, Plugin Oficial)
- [CVE-2025-1289](https://cve.now/CVE-2025-1289.md): Plugin Oficial – Getnet para WooCommerce \<= 1.7.3 - Admin+ Stored XSS (CVSS 4.8, Plugin Oficial)
- [CVE-2025-1288](https://cve.now/CVE-2025-1288.md): wooexim \<= 5.0.0 - CSRF to Reflected XSS (CVSS 6.1, WOOEXIM)
- [CVE-2025-1286](https://cve.now/CVE-2025-1286.md): Download HTML TinyMCE Button \<= 1.2 - Reflected XSS (CVSS 6.1, Download HTML TinyMCE Button)
- [CVE-2025-1033](https://cve.now/CVE-2025-1033.md): Badgearoo \<= 1.0.14 - Admin+ Stored XSS (CVSS 4.8, Badgearoo)
- [CVE-2025-0688](https://cve.now/CVE-2025-0688.md): Spiritual Gifts Survey \<= 0.9.10 - Unauthenticated CSRF to XSS (CVSS 6.1, Spiritual Gifts Survey)
- [CVE-2025-0687](https://cve.now/CVE-2025-0687.md): Spiritual Gifts Survey \<= 0.9.10 - Unauthenticated CSRF to XSS (CVSS 6.1, Spiritual Gifts Survey)
- [CVE-2025-0329](https://cve.now/CVE-2025-0329.md): AI ChatBot for WordPress – WPBot \< 6.2.4 - Admin+ Stored XSS (CVSS 4.8, AI ChatBot for WordPress)
- [CVE-2024-9882](https://cve.now/CVE-2024-9882.md): Salon Booking System \< 10.9.4 - Admin+ Stored XSS (CVSS 4.8, Salon Booking System, Appointment Scheduling for Salons, Sp…)
- [CVE-2024-9879](https://cve.now/CVE-2024-9879.md): Website File Changes \< 2.1.1 - Authenticated SQL Injection (CVSS 5.4, Melapress File Monitor)
- [CVE-2024-9838](https://cve.now/CVE-2024-9838.md): Auto Affiliate Links \< 6.4.7 - Admin+ SQL Injection (CVSS 5.4, Auto Affiliate Links)
- [CVE-2024-9831](https://cve.now/CVE-2024-9831.md): Taskbuilder \< 3.0.9 - Admin+ SQL Injection (CVSS 7.2, Taskbuilder)
- [CVE-2024-9765](https://cve.now/CVE-2024-9765.md): EKC Tournament Manager \< 2.2.2 - Local File Download Vulnerability (CVSS 6.5, EKC Tournament Manager)
- [CVE-2024-9711](https://cve.now/CVE-2024-9711.md): EKC Tournament Manager \< 2.2.2 - Delete Tournaments via CSRF (CVSS 5.4, EKC Tournament Manager)
- [CVE-2024-9709](https://cve.now/CVE-2024-9709.md): EKC Tournament Manager \< 2.2.2 - Create Tournaments/Teams via CSRF (CVSS 5.4, EKC Tournament Manager)
- [CVE-2024-9663](https://cve.now/CVE-2024-9663.md): CYAN Backup \< 2.5.3 - Admin+ Stored XSS via Remote Storage Settings (CVSS 5.4, CYAN Backup)
- [CVE-2024-9662](https://cve.now/CVE-2024-9662.md): CYAN Backup \< 2.5.3 - Admin+ Stored XSS via General Settings (CVSS 5.4, CYAN Backup)
- [CVE-2024-9645](https://cve.now/CVE-2024-9645.md): Post Grid and Gutenberg Blocks \< 2.2.93 - Contributor+ Stored XSS (CVSS 5.4, Post Grid, Posts Slider, Posts Carousel, Post Filter, Post…)
- [CVE-2024-9599](https://cve.now/CVE-2024-9599.md): Popup Box \< 4.7.8 - Admin+ Stored XSS (CVSS 5.4, Popup Box)
- [CVE-2024-9450](https://cve.now/CVE-2024-9450.md): Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking \< 1.3.15 - Subscriber+ PayPal Settings Update (CVSS 6.5, Free Booking Plugin for Hotels, Restaurants and Car Rentals)
- [CVE-2024-9390](https://cve.now/CVE-2024-9390.md): RegistrationMagic \< 6.0.2.1 - Stored XSS (CVSS 4.8, RegistrationMagic)
- [CVE-2024-9238](https://cve.now/CVE-2024-9238.md): AVIF & SVG Uploader \<= 1.1.0 - Author+ Stored XSS via SVG Uplaod (CVSS 5.4, AVIF Uploader)
- [CVE-2024-9236](https://cve.now/CVE-2024-9236.md): Team Members Showcase \< 4.4.2 - Editor+ Stored XSS (CVSS 4.8, Team)
- [CVE-2024-9233](https://cve.now/CVE-2024-9233.md): GS Logo Slider \< 3.7.1 - Settings Update via Cross-Site Request Forgery (CVSS 4.3, Logo Slider)
- [CVE-2024-9227](https://cve.now/CVE-2024-9227.md): PowerPress Podcasting \< 11.9.18 - Author+ XSS (CVSS 4.8, PowerPress Podcasting plugin by Blubrry)
- [CVE-2024-9182](https://cve.now/CVE-2024-9182.md): Maspik - Advanced Spam protection \< 2.1.3 - Admin+ Stored XSS (CVSS 4.8, Maspik)
- [CVE-2024-8854](https://cve.now/CVE-2024-8854.md): Polls CP \<= 1.0.75 - Admin+ Stored XSS via Custom Styles (CVSS 5.4, Polls CP)
- [CVE-2024-8851](https://cve.now/CVE-2024-8851.md): Polls CP \<= 1.0.75 - Admin+ Stored Cross-Site Scripting (CVSS 5.4, Polls CP)
- [CVE-2024-8759](https://cve.now/CVE-2024-8759.md): Nested Pages \<= 3.2.8 - Editor+ Stored XSS (CVSS 4.8, Nested Pages)
- [CVE-2024-8703](https://cve.now/CVE-2024-8703.md): Z-Downloads \< 1.11.6 - Unauthenticated Stored XSS (CVSS 6.1, Z-Downloads)
- [CVE-2024-8702](https://cve.now/CVE-2024-8702.md): Backup Database \<= 4.9 - Admin+ Stored XSS (CVSS 4.8, Backup Database)
- [CVE-2024-8701](https://cve.now/CVE-2024-8701.md): Event Calendar \<= 1.0.4 - Admin+ Stored XSS (CVSS 4.8, events-calendar)
- [CVE-2024-8700](https://cve.now/CVE-2024-8700.md): Event Calendar \<= 1.0.4 - Unauthenticated Arbitrary Calendar Deletion (CVSS 7.5, Event Calendar)
- [CVE-2024-8699](https://cve.now/CVE-2024-8699.md): Z-Downloads \< 1.11.5 - Admin+ Arbitrary File Upload (CVSS 7.2, Z-Downloads)
- [CVE-2024-8673](https://cve.now/CVE-2024-8673.md): Z-Downloads \< 1.11.7 - Admin+ Stored XSS via SVG Upload (CVSS 9.1, Z-Downloads)
- [CVE-2024-8670](https://cve.now/CVE-2024-8670.md): Photo Gallery by 10Web \< 1.8.29 - Admin+ Stored XSS (CVSS 4.8, Photo Gallery by 10Web)
- [CVE-2024-8620](https://cve.now/CVE-2024-8620.md): MapPress Maps for WordPress \< 2.93 - Admin+ Stored XSS via Map Settings (CVSS 4.8, MapPress Maps for WordPress)
- [CVE-2024-8619](https://cve.now/CVE-2024-8619.md): Ajax Search Lite \<= 4.12.2 - Admin+ Stored XSS (CVSS 4.8, Ajax Search Lite)
- [CVE-2024-8618](https://cve.now/CVE-2024-8618.md): Page Builder: Pagelayer \< 1.9.0- Admin+ Stored XSS (CVSS 4.8, Page Builder: Pagelayer)
- [CVE-2024-8617](https://cve.now/CVE-2024-8617.md): Quiz Maker \<= 6.5.9.8 - Admin+ Stored XSS (CVSS 4.8, Quiz Maker)
- [CVE-2024-8542](https://cve.now/CVE-2024-8542.md): Everest Forms \< 3.0.3.1 - Admin+ Stored XSS (CVSS 4.8, Everest Forms)
- [CVE-2024-8493](https://cve.now/CVE-2024-8493.md): The Events Calendar \< 6.6.4 - Admin+ Stored XSS (CVSS 4.8, The Events Calendar)
- [CVE-2024-8492](https://cve.now/CVE-2024-8492.md): Hustle \< 7.8.5 - Admin+ Stored XSS (CVSS 4.8, Hustle)
- [CVE-2024-8426](https://cve.now/CVE-2024-8426.md): Pagelayer \< 1.8.8 - Admin+ Stored XSS (CVSS 4.8, Page Builder: Pagelayer)
- [CVE-2024-8398](https://cve.now/CVE-2024-8398.md): Simple Nav Archives \<= 2.1.3 - Settings Update via CSRF (CVSS 4.3, Simple Nav Archives)
- [CVE-2024-8397](https://cve.now/CVE-2024-8397.md): GDPR Cookie Consent \<= 2.6.0 - Unauthenticated Stored XSS (CVSS 5.4, webtoffee-gdpr-cookie-consent)
- [CVE-2024-8286](https://cve.now/CVE-2024-8286.md): GDPR Cookie Consent \<= 2.6.0 - Bulk Delete via CSRF (CVSS 6.5, webtoffee-gdpr-cookie-consent)
- [CVE-2024-8284](https://cve.now/CVE-2024-8284.md): Download Manager \<= 3.2.98 - Admin+ Stored XSS (CVSS 4.8, Download Manager)
- [CVE-2024-8245](https://cve.now/CVE-2024-8245.md): GamiPress - Reset User \<= 1.0.0 - GamiPress User Data Removal via CSRF (CVSS 4.3, GamiPress)
- [CVE-2024-8187](https://cve.now/CVE-2024-8187.md): Smart Post Show \<= 3.0.0 - Editor+ Stored XSS (CVSS 4.8, Smart Post Show)
- [CVE-2024-8095](https://cve.now/CVE-2024-8095.md): BabelZ – Google Translate Widget \<= 1.1.5 - CSRF to Stored XSS (CVSS 6.1, BabelZ)
- [CVE-2024-8094](https://cve.now/CVE-2024-8094.md): Ntz Antispam \<= 2.0e - Settings Update via CSRF (CVSS 6.5, Ntz Antispam)
- [CVE-2024-8090](https://cve.now/CVE-2024-8090.md): JavaScript Logic \<= 0.1 - CSRF to Stored XSS (CVSS 6.1, JavaScript Logic)
- [CVE-2024-8085](https://cve.now/CVE-2024-8085.md): PeoplePond \<= 1.1.9 - CSRF to Stored XSS (CVSS 6.1, PeoplePond)
- [CVE-2024-8082](https://cve.now/CVE-2024-8082.md): Widgets Reset \<= 0.1 - Settings Update via CSRF (CVSS 4.3, Widgets Reset)
- [CVE-2024-8050](https://cve.now/CVE-2024-8050.md): Custom Author Base \<= 1.1.1 - Settings Update via CSRF (CVSS 4.3, Custom Author Base)
- [CVE-2024-8032](https://cve.now/CVE-2024-8032.md): Smooth Gallery Replacement \<= 1.0 - CSRF to Stored XSS (CVSS 6.1, Smooth Gallery Replacement)
- [CVE-2024-8031](https://cve.now/CVE-2024-8031.md): Secure Downloads \< 1.2.3 - Admin+ Arbitrary File Download (CVSS 6.5, Secure Downloads)
- [CVE-2024-7984](https://cve.now/CVE-2024-7984.md): Joy Of Text Lite – SMS messaging for WordPress \<= 2.3.1 - Settings Update via CSRF (CVSS 4.3, Joy Of Text Lite)
- [CVE-2024-7769](https://cve.now/CVE-2024-7769.md): Wordpress Clicksold IDX Plugin \<= 1.90 - Admin+ XSS (CVSS 4.8, ClickSold IDX)
- [CVE-2024-7762](https://cve.now/CVE-2024-7762.md): Simple Job Board \< 2.12.6 - Unauthenticated Resumes Download (CVSS 3.7, Simple Job Board)
- [CVE-2024-7761](https://cve.now/CVE-2024-7761.md): Simple Job Board \< 2.12.2 - Admin+ Stored XSS (CVSS 6.1, Simple Job Board)
- [CVE-2024-7759](https://cve.now/CVE-2024-7759.md): PWA For WP & AMP \< 1.7.72 Administrator+ Stored XSS (CVSS 4.8, PWA for WP)
- [CVE-2024-7758](https://cve.now/CVE-2024-7758.md): Stylish Price List \< 7.1.8 - Contributor+ Stored XSS (CVSS 4.8, Stylish Price List)
- [CVE-2024-7556](https://cve.now/CVE-2024-7556.md): Wordpress Simple Share Plugin \<=0.5.3 - Admin+ XSS (CVSS 4.8, Simple Share)
- [CVE-2024-6809](https://cve.now/CVE-2024-6809.md): Simple Video Directory \< 1.4.3 - Unauthenticated SQLi (CVSS 9.8, Simple Video Directory)
- [CVE-2024-6798](https://cve.now/CVE-2024-6798.md): DL Verification \<= 1.2 - Admin+ Stored XSS (CVSS 4.8, DL Verification)
- [CVE-2024-6797](https://cve.now/CVE-2024-6797.md): DL Robots.txt \<= 1.2 - Admin+ Stored XSS (CVSS 4.8, DL Robots.txt)
- [CVE-2024-6719](https://cve.now/CVE-2024-6719.md): Offload Videos – Bunny.net, AWS S3 \<= 1.0.1 Subscriber+ CSRF (CVSS 8.1, Offload Videos)
- [CVE-2024-6718](https://cve.now/CVE-2024-6718.md): PVN Auth Popup \<= 1.0.0 - Contributor+ XSS via Shortcode (CVSS 5.4, PVN Auth Popup)
- [CVE-2024-6713](https://cve.now/CVE-2024-6713.md): PVN Auth Popup \<= 1.0.0 - Admin+ Stored XSS (CVSS 4.8, PVN Auth Popup)
- [CVE-2024-6712](https://cve.now/CVE-2024-6712.md): MapFig Studio \<= 0.2.1 - Stored XSS via CSRF (CVSS 6.1, MapFig Studio)
- [CVE-2024-6708](https://cve.now/CVE-2024-6708.md): Profile Builder \<= 3.12.0 - Admin+ Stored Cross Site Scripting (CVSS 4.8, User Profile Builder)
- [CVE-2024-6693](https://cve.now/CVE-2024-6693.md): WP Content Copy Protection & No Right Click (premium) \<= 15.0 - Admin+ Stored XSS (CVSS 4.8, wccp-pro)
- [CVE-2024-6690](https://cve.now/CVE-2024-6690.md): WP Content Copy Protection & No Right Click (premium) \< 15.3 - Open Redirect (CVSS 6.1, wccp-pro)
- [CVE-2024-6668](https://cve.now/CVE-2024-6668.md): profilepro \<= 1.3 - Subscriber+ Stored Cross Site Scripting (CVSS 5.4, ProfilePro)
- [CVE-2024-6667](https://cve.now/CVE-2024-6667.md): kbucket \< 4.1.5 - Reflected XSS (CVSS 6.1, KBucket: Your Curated Content in WordPress)
- [CVE-2024-6665](https://cve.now/CVE-2024-6665.md): kbucket \< 4.1.6 - Admin+ Stored XSS (CVSS 4.8, KBucket: Your Curated Content in WordPress)
- [CVE-2024-6584](https://cve.now/CVE-2024-6584.md): Jetpack Boost \< 3.4.7 - Admin+ SSRF (CVSS 9.1, Jetpack Boost)
- [CVE-2024-6486](https://cve.now/CVE-2024-6486.md): ImageMagick Engine \< 1.7.11 - Administrator+ OS Command Injection (CVSS 7.2, ImageMagick Engine)
- [CVE-2024-6478](https://cve.now/CVE-2024-6478.md): CTT Expresso para WooCommerce \< 3.2.13 - Admin+ Stored XSS (CVSS 4.8, CTT Expresso para WooCommerce)
- [CVE-2024-6462](https://cve.now/CVE-2024-6462.md): DL Yandex Metrika \<= 1.2 - Admin+ Stored XSS (CVSS 4.8, DL Yandex Metrika)
- [CVE-2024-6335](https://cve.now/CVE-2024-6335.md): Tracking Code Manager \< 2.3.0- Admin+ Stored Cross-Site Scripting (CVSS 4.8, Tracking Code Manager)
- [CVE-2024-6159](https://cve.now/CVE-2024-6159.md): Push Notification for Post and BuddyPress \<=1.93 - Multiple Unauthenticated SQLi (CVSS 9.8, Push Notification for Post and BuddyPress)
- [CVE-2024-5440](https://cve.now/CVE-2024-5440.md): If-So Dynamic Content Personalization \< 1.8.0.3 - Contributor+ Shortcode Stored XSS (CVSS 5.4, If-So Dynamic Content Personalization)
- [CVE-2024-5026](https://cve.now/CVE-2024-5026.md): CM Tooltip Glossary \< 4.3.4 - Admin+ Stored XSS (CVSS 4.8, CM Tooltip Glossary)
- [CVE-2024-13865](https://cve.now/CVE-2024-13865.md): drm-protected-video-streaming \<= 4.2.1 - Reflected XSS (CVSS 6.1, S3Player)
- [CVE-2024-13828](https://cve.now/CVE-2024-13828.md): Badgearoo \<= 1.0.14 - Reflected XSS (CVSS 6.1, Badgearoo)
- [CVE-2024-13823](https://cve.now/CVE-2024-13823.md): 360 Product Rotation \<= 1.5.8 - Reflected XSS (CVSS 6.1, 360 Product Rotation)
- [CVE-2024-13730](https://cve.now/CVE-2024-13730.md): Podlove Podcast Publisher \< 4.2.1 - Admin+ Stored XSS (CVSS 4.8, Podlove Podcast Publisher)
- [CVE-2024-13729](https://cve.now/CVE-2024-13729.md): Podlove Podcast Publisher \< 4.1.24 - Admin+ Stored XSS (CVSS 4.8, Podlove Podcast Publisher)
- [CVE-2024-13727](https://cve.now/CVE-2024-13727.md): MemberSpace – Membership Plugin and Paid Subscriptions \< 2.1.14 - Reflected XSS (CVSS 6.1, MemberSpace)
- [CVE-2024-13621](https://cve.now/CVE-2024-13621.md): The GDPR Framework By Data443 \< 2.2.0 - Admin+ Stored XSS (CVSS 4.8, The GDPR Framework By Data443)
- [CVE-2024-13619](https://cve.now/CVE-2024-13619.md): LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes \< 8.0.1 - Reflected XSS (CVSS 6.1, LifterLMS)
- [CVE-2024-13616](https://cve.now/CVE-2024-13616.md): VikBooking \< 1.7.2 - Admin+ Stored XSS (CVSS 4.8, VikBooking Hotel Booking Engine & PMS)
- [CVE-2024-13486](https://cve.now/CVE-2024-13486.md): Icegram Engage \< 3.1.32 - Admin+ Stored XSS (CVSS 4.8, Icegram Engage)
- [CVE-2024-13482](https://cve.now/CVE-2024-13482.md): Icegram Engage \< 3.1.32 - Admin+ Stored XSS (CVSS 4.8, Icegram Engage)
- [CVE-2024-13384](https://cve.now/CVE-2024-13384.md): Photo Gallery, Images, Slider in Rbs Image Gallery \< 3.2.24 - Admin+ Stored XSS (CVSS 4.8, Photo Gallery, Images, Slider in Rbs Image Gallery)
- [CVE-2024-13383](https://cve.now/CVE-2024-13383.md): HD Quiz \< 2.0.0 - Editor+ Stored XSS (CVSS 4.8, HD Quiz)
- [CVE-2024-13382](https://cve.now/CVE-2024-13382.md): Calculated Fields Form \< 5.2.64 - Admin+ Stored XSS (CVSS 4.8, Calculated Fields Form)
- [CVE-2024-13357](https://cve.now/CVE-2024-13357.md): Ditty – Responsive News Tickers, Sliders, and Lists \< 3.1.52 - Author+ Stored XSS (CVSS 4.8, Ditty)
- [CVE-2024-13313](https://cve.now/CVE-2024-13313.md): AWeber \<= 7.3.20 - Admin+ Stored XSS (CVSS 4.8, AWeber)
- [CVE-2024-13128](https://cve.now/CVE-2024-13128.md): LearnPress – WordPress LMS Plugin \< 4.2.7.5.1 - Admin+ Stored XSS (CVSS 4.8, LearnPress)
- [CVE-2024-13127](https://cve.now/CVE-2024-13127.md): LearnPress – WordPress LMS Plugin \< 4.2.7.5.1 - Admin+ Stored XSS (CVSS 4.8, LearnPress)
- [CVE-2024-13053](https://cve.now/CVE-2024-13053.md): Form Maker by 10Web \< 1.15.33 - Admin+ Stored XSS via Theme Title (CVSS 4.8, Form Maker by 10Web)
- [CVE-2024-12874](https://cve.now/CVE-2024-12874.md): Top Comments \<= 1.0 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, Top Comments)
- [CVE-2024-12873](https://cve.now/CVE-2024-12873.md): Custom Field Manager \<= 1.0 - Reflected XSS Vulnerability (CVSS 6.1, Custom Field Manager)
- [CVE-2024-12812](https://cve.now/CVE-2024-12812.md): WP ERP \< 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information (CVSS 7.5, WP ERP | Complete HR solution with recruitment & job listin…)
- [CVE-2024-12808](https://cve.now/CVE-2024-12808.md): WP ERP | Complete HR solution with recruitment \< 1.13.4 - Admin+ Stored XSS (CVSS 4.8, WP ERP | Complete HR solution with recruitment & job listin…)
- [CVE-2024-12800](https://cve.now/CVE-2024-12800.md): IP Based Login \< 2.4.1 - Admin+ Stored XSS (CVSS 4.8, IP Based Login)
- [CVE-2024-12770](https://cve.now/CVE-2024-12770.md): WP ULike \< 4.7.6 - Admin+ Stored XSS (CVSS 4.8, WP ULike)
- [CVE-2024-12750](https://cve.now/CVE-2024-12750.md): Competition Form \<= 2.0 - Competition Deletion via CSRF (CVSS 4.3, Competition Form)
- [CVE-2024-12743](https://cve.now/CVE-2024-12743.md): MailPoet \< 5.5.2 - Admin+ Stored XSS (CVSS 4.8, MailPoet)
- [CVE-2024-12739](https://cve.now/CVE-2024-12739.md): Mobile Contact Bar \< 3.0.5 - Admin+ Stored XSS (CVSS 4.8, Mobile Contact Bar)
- [CVE-2024-12735](https://cve.now/CVE-2024-12735.md): Advance Post Prefix \<= 1.1.1 - Admin+ SQL Injection (CVSS 7.2, Advance Post Prefix)
- [CVE-2024-12734](https://cve.now/CVE-2024-12734.md): Advance Post Prefix \<= 1.1.1 - Reflected XSS (CVSS 6.1, Advance Post Prefix)
- [CVE-2024-12733](https://cve.now/CVE-2024-12733.md): AffiliateImporterEb \<= 1.0.6 - Reflected XSS via Search (CVSS 6.1, AffiliateImporterEb)
- [CVE-2024-12732](https://cve.now/CVE-2024-12732.md): AffiliateImporterEb \<= 1.0.6 - Reflected XSS (CVSS 6.1, AffiliateImporterEb)
- [CVE-2024-12726](https://cve.now/CVE-2024-12726.md): ClipArt \<= 0.2 - Reflected XSS (CVSS 6.1, ClipArt)
- [CVE-2024-12725](https://cve.now/CVE-2024-12725.md): Clasify Classified Listing \<= 1.0.7 - Reflected XSS (CVSS 6.1, Clasify Classified Listing)
- [CVE-2024-12724](https://cve.now/CVE-2024-12724.md): WP DeskLite \<= 1.0.0 - Reflected XSS (CVSS 6.1, WP DeskLite)
- [CVE-2024-12722](https://cve.now/CVE-2024-12722.md): Twitter Bootstrap Collapse aka Accordian Shortcode \<= 1.0 - Stored XSS via Shortcode (CVSS 5.4, Twitter Bootstrap Collapse aka Accordian Shortcode)
- [CVE-2024-12716](https://cve.now/CVE-2024-12716.md): Simple Basic Contact Form \< 20250114 - Admin+ Stored XSS (CVSS 4.8, Simple Basic Contact Form)
- [CVE-2024-12680](https://cve.now/CVE-2024-12680.md): Prisna GWT \< 1.4.14 - Admin+ Stored XSS (CVSS 4.8, Prisna GWT)
- [CVE-2024-12679](https://cve.now/CVE-2024-12679.md): Prisna GWT \< 1.4.14 - Admin+ Stored XSS (CVSS 4.8, Prisna GWT)
- [CVE-2024-12301](https://cve.now/CVE-2024-12301.md): JSP Store Locator \<= 1.0 - Deletion via Missing CSRF (CVSS 6.5, JSP Store Locator)
- [CVE-2024-12282](https://cve.now/CVE-2024-12282.md): WordPress连接微博 \<= 2.5.6 - Stored XSS via CSRF (CVSS 6.1, WordPress连接微博)
- [CVE-2024-11843](https://cve.now/CVE-2024-11843.md): Panorama – WordPress Project Management Plugin \<= 1.5.1 - Admin+ Stored XSS (CVSS 4.8, Panorama)
- [CVE-2024-11719](https://cve.now/CVE-2024-11719.md): tarteaucitron.js for WordPress \< 0.3.0 - Stored XSS via CSRF (CVSS 6.1, tarteaucitron-wp)
- [CVE-2024-11718](https://cve.now/CVE-2024-11718.md): tarteaucitron.js for WordPress \< 0.3.0 - Author+ Stored XSS (CVSS 5.4, tarteaucitron-wp · couleurcitron/tarteaucitron-wp)
- [CVE-2024-11502](https://cve.now/CVE-2024-11502.md): Planning Center Online Giving \<= 1.0.0 - Contributor+ XSS via Shortcode (CVSS 5.4, Planning Center Online Giving)
- [CVE-2024-11373](https://cve.now/CVE-2024-11373.md): Connexion Logs \<= 3.0.2 - Log Deletion via CSRF (CVSS 4.3, Connexion Logs)
- [CVE-2024-11372](https://cve.now/CVE-2024-11372.md): Connexion Logs \<= 3.0.2 - Admin+ SQL Injection (CVSS 7.2, Connexion Logs)
- [CVE-2024-11269](https://cve.now/CVE-2024-11269.md): AHAthat Plugin \<= 1.6 - Admin+ SQL Injection (CVSS 7.2, AHAthat Plugin)
- [CVE-2024-11267](https://cve.now/CVE-2024-11267.md): JSP Store Locator \<= 1.0 - Contributor+ SQL Injection (CVSS 8.8, JSP Store Locator)
- [CVE-2024-11266](https://cve.now/CVE-2024-11266.md): Geocache Stat Bar Widget \<= 0.911 - Admin+ Stored XSS (CVSS 4.8, Geocache Stat Bar Widget)
- [CVE-2024-11221](https://cve.now/CVE-2024-11221.md): Full Screen (Page) Background Image Slideshow \<= 1.1 - Admin+ Stored XSS (CVSS 4.8, Full Screen (Page) Background Image Slideshow)
- [CVE-2024-11190](https://cve.now/CVE-2024-11190.md): jwp-a11y \<= 4.1.7 - Admin+ Stored XSS (CVSS 4.8, jwp-a11y)
- [CVE-2024-11189](https://cve.now/CVE-2024-11189.md): Social Share And Social Locker – ARSocial \< 1.4.2 - Admin+ Stored XSS (CVSS 4.8, Social Share And Social Locker)
- [CVE-2024-11141](https://cve.now/CVE-2024-11141.md): Sailthru Triggermail \< 1.1 - Subscriber+ Stored XSS (CVSS 6.1, Sailthru Triggermail)
- [CVE-2024-11140](https://cve.now/CVE-2024-11140.md): Real WP Shop Lite Ajax eCommerce Shopping Cart \<= 2.0.8 - Admin+ Stored XSS (CVSS 3.5, Real WP Shop Lite Ajax eCommerce Shopping Cart)
- [CVE-2024-11109](https://cve.now/CVE-2024-11109.md): WP Google Review Slider \< 15.6 - Admin+ Stored XSS (CVSS 4.8, WP Google Review Slider)
- [CVE-2024-10818](https://cve.now/CVE-2024-10818.md): JSFiddle Shortcode \< 1.1.3 - Contributor+ XSS via Shortcode (CVSS 5.4, JSFiddle Shortcode)
- [CVE-2024-10677](https://cve.now/CVE-2024-10677.md): BTEV \<= 2.0.2 - Settings Update via CSRF (CVSS 4.3, BTEV)
- [CVE-2024-10639](https://cve.now/CVE-2024-10639.md): Auto Prune Posts \< 3.0.0- Admin+ Stored XSS (CVSS 4.8, Auto Prune Posts)
- [CVE-2024-10634](https://cve.now/CVE-2024-10634.md): Nokaut Offers Box \<= 1.4.0 - Plugin Reset via CSRF (CVSS 4.3, Nokaut Offers Box)
- [CVE-2024-10632](https://cve.now/CVE-2024-10632.md): Nokaut Offers Box \<= 1.4.0 - Admin+ Stored XSS (CVSS 4.8, Nokaut Offers Box)
- [CVE-2024-10631](https://cve.now/CVE-2024-10631.md): Countdown Timer \<= 1.0.5 - Contributor+ Stored XSS (CVSS 6.5, Countdown Timer for WordPress Block Editor)
- [CVE-2024-10504](https://cve.now/CVE-2024-10504.md): ARForms Builder \< 1.7.1 - Unauthenticated Stored XSS (CVSS 5.4, Contact Form, Survey, Quiz & Popup Form Builder)
- [CVE-2024-10475](https://cve.now/CVE-2024-10475.md): Lead Form Builder \< 1.9.8 - Admin+ Stored XSS (CVSS 4.8, Responsive Contact Form Builder & Lead Generation Plugin)
- [CVE-2024-10362](https://cve.now/CVE-2024-10362.md): Social Media Share Buttons \< 2.9.0 - Admin+ Stored XSS (CVSS 4.8, Social Media Share Buttons & Social Sharing Icons)
- [CVE-2024-10149](https://cve.now/CVE-2024-10149.md): Social Slider Feed \< 2.2.9 - Admin+ Stored XSS via Widgets (CVSS 4.8, Social Slider Feed)
- [CVE-2024-10145](https://cve.now/CVE-2024-10145.md): Hubbub Lite \< 1.34.4 - Admin+ Stored XSS (CVSS 4.8, Hubbub Lite)
- [CVE-2024-10144](https://cve.now/CVE-2024-10144.md): Photo Gallery, Images, Slider in Rbs Image Gallery \< 3.2.22 - Contributor+ Stored XSS (CVSS 4.8, Photo Gallery, Images, Slider in Rbs Image Gallery)
- [CVE-2024-10143](https://cve.now/CVE-2024-10143.md): MB Custom Post Types & Custom Taxonomies \< 2.7.7 - Admin+ Stored XSS (CVSS 4.8, MB Custom Post Types & Custom Taxonomies)
- [CVE-2024-10107](https://cve.now/CVE-2024-10107.md): Giveaways and Contests by RafflePress \< 1.12.17 - Admin+ Stored XSS (CVSS 4.8, Giveaways and Contests by RafflePress)
- [CVE-2024-10098](https://cve.now/CVE-2024-10098.md): ApplyOnline – Application Form Builder and Manager \< 2.6.3 - Unauthenticated Application File Access (CVSS 2.7, ApplyOnline)
- [CVE-2024-10076](https://cve.now/CVE-2024-10076.md): Jetpack \< 13.8, Boost \< 3.4.8 - Contributor+ Stored XSS (CVSS 5.9, Jetpack)
- [CVE-2024-10075](https://cve.now/CVE-2024-10075.md): Jetpack \< 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution (CVSS 5.6, Jetpack)
- [CVE-2024-10054](https://cve.now/CVE-2024-10054.md): Happyforms \< 1.26.3 - Admin+ Stored XSS (CVSS 4.8, Happyforms)
- [CVE-2024-10009](https://cve.now/CVE-2024-10009.md): Website File Changes \< 2.1.0 - Admin+ Authenticated SQL Injection (CVSS 4.1, Melapress File Monitor)
- [CVE-2025-4717](https://cve.now/CVE-2025-4717.md): PHPGurukul Company Visitor Management System visitors-form.php sql injection (CVSS 6.9, PHPGurukul Company Visitor Management System)
- [CVE-2025-47789](https://cve.now/CVE-2025-47789.md): Horilla Open Redirect Vulnerability in Login (CVSS 6.1, horilla-opensource horilla)
- [CVE-2025-47788](https://cve.now/CVE-2025-47788.md): Missing Path Validation Enables Path Traversal in Controller.php (CVSS 9.4, Atheos)
- [CVE-2025-46834](https://cve.now/CVE-2025-46834.md): Alchemy's Modular Account can use executeUserOp to bypass allowlist prevalidation hook (CVSS 6.6, alchemyplatform modular-account)
- [CVE-2025-47786](https://cve.now/CVE-2025-47786.md): Emlog vulnerable to Stored Cross-site Scripting (CVSS 1.9, emlog)
- [CVE-2025-4716](https://cve.now/CVE-2025-4716.md): Campcodes Sales and Inventory System credit\_transaction\_add.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-4715](https://cve.now/CVE-2025-4715.md): Campcodes Sales and Inventory System view\_application.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-47785](https://cve.now/CVE-2025-47785.md): EMLOG SQL Injection Vulnerability (CVSS 8.3, emlog)
- [CVE-2025-47787](https://cve.now/CVE-2025-47787.md): Emlog Pro Contains a File Upload Vulnerability (CVSS 8.9, emlog)
- [CVE-2025-47161](https://cve.now/CVE-2025-47161.md): Microsoft Defender for Endpoint Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Defender for Endpoint for Linux)
- [CVE-2025-47784](https://cve.now/CVE-2025-47784.md): Emlog vulnerable to Deserialization of Untrusted Data (CVSS 6.6, emlog)
- [CVE-2025-26481](https://cve.now/CVE-2025-26481.md): Dell PowerScale OneFS, versions 9.4.0.0 through 9.9.0.0, contains an uncontrolled resource consumption vulnerability. (CVSS 7.5, Dell PowerScale OneFS)
- [CVE-2025-4714](https://cve.now/CVE-2025-4714.md): Campcodes Sales and Inventory System reprint.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-30476](https://cve.now/CVE-2025-30476.md): Dell PowerScale InsightIQ, version 5.2, contains an uncontrolled resource consumption vulnerability. (CVSS 5.3, Dell PowerScale InsightIQ)
- [CVE-2025-30475](https://cve.now/CVE-2025-30475.md): Dell PowerScale InsightIQ, versions 5.0 through 5.2, contains an improper privilege management vulnerability. (CVSS 8.1, Dell PowerScale InsightIQ)
- [CVE-2025-4713](https://cve.now/CVE-2025-4713.md): Campcodes Sales and Inventory System print.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-4712](https://cve.now/CVE-2025-4712.md): Campcodes Sales and Inventory System account\_summary.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2024-51666](https://cve.now/CVE-2024-51666.md): WordPress Tours plugin \<= 1.0.0 - Broken Access Control vulnerability (CVSS 4.3, Tosin Oguntuyi Tours)
- [CVE-2024-56006](https://cve.now/CVE-2024-56006.md): WordPress Jetpack Debug Tools plugin \< 2.0.1 - Broken Access Control vulnerability (CVSS 5.3, Automattic Jetpack Debug Tools)
- [CVE-2025-32922](https://cve.now/CVE-2025-32922.md): WordPress WP2LEADS plugin \<= 3.5.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Saleswonder Team: Tobias WP2LEADS)
- [CVE-2025-4711](https://cve.now/CVE-2025-4711.md): Campcodes Sales and Inventory System stockin\_add.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-47774](https://cve.now/CVE-2025-47774.md): Vyper's \`slice()\` may elide side-effects when output length is 0 (CVSS 2.9, vyperlang vyper · vyper)
- [CVE-2025-4710](https://cve.now/CVE-2025-4710.md): Campcodes Sales and Inventory System transaction.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-4709](https://cve.now/CVE-2025-4709.md): Campcodes Sales and Inventory System transaction\_del.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-47285](https://cve.now/CVE-2025-47285.md): Vyper's \`concat()\` builtin may elide side-effects for zero-length arguments (CVSS 2.9, vyperlang vyper · vyper)
- [CVE-2025-47279](https://cve.now/CVE-2025-47279.md): undici Denial of Service attack via bad certificate data (CVSS 3.1, nodejs undici · undici)
- [CVE-2025-43853](https://cve.now/CVE-2025-43853.md): iwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi feature (CVSS 7.0, bytecodealliance wasm-micro-runtime)
- [CVE-2025-47580](https://cve.now/CVE-2025-47580.md): WordPress Front End Users plugin \<= 3.2.35 - Broken Access Control vulnerability (CVSS 5.4, Rustaurius Front End Users)
- [CVE-2025-4708](https://cve.now/CVE-2025-4708.md): Campcodes Sales and Inventory System sales\_add.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-4707](https://cve.now/CVE-2025-4707.md): Campcodes Sales and Inventory System transaction\_add.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-30421](https://cve.now/CVE-2025-30421.md): Stack-based Buffer Overflow in DrObjectStorage::XML\_Serialize() in NI Circuit Design Suite (CVSS 8.5, NI Circuit Design Suite)
- [CVE-2025-4706](https://cve.now/CVE-2025-4706.md): projectworlds Online Examination System Procedure3b\_yearwiseVisit.php sql injection (CVSS 6.9, projectworlds Online Examination System)
- [CVE-2025-30420](https://cve.now/CVE-2025-30420.md): Out of Bounds Read in Bitmap::InternalDraw() in NI Circuit Design Suite (CVSS 7.8, NI Circuit Design Suite)
- [CVE-2025-30419](https://cve.now/CVE-2025-30419.md): Out of Bounds Read in GetSymbolBorderRectSize() in NI Circuit Design Suite (CVSS 7.8, NI Circuit Design Suite)
- [CVE-2025-1647](https://cve.now/CVE-2025-1647.md): XSS in Bootstrap title attribute for Tooltip and Popover (CVSS 5.6, Bootstrap)
- [CVE-2025-30418](https://cve.now/CVE-2025-30418.md): Out of Bounds Write in CheckPins() in NI Circuit Design Suite (CVSS 8.5, NI Circuit Design Suite)
- [CVE-2025-30417](https://cve.now/CVE-2025-30417.md): Out of Bounds Write in Library!DecodeBase64() in NI Circuit Design Suite (CVSS 7.8, NI Circuit Design Suite)
- [CVE-2025-4705](https://cve.now/CVE-2025-4705.md): PHPGurukul Vehicle Parking Management System view-incomingvehicle-detail.php sql injection (CVSS 6.9, PHPGurukul Vehicle Parking Management System)
- [CVE-2025-3440](https://cve.now/CVE-2025-3440.md): IBM Security Guardium cross-site scripting (CVSS 5.5, IBM Security Guardium)
- [CVE-2025-4704](https://cve.now/CVE-2025-4704.md): PHPGurukul Vehicle Parking Management System edit-category.php sql injection (CVSS 6.9, PHPGurukul Vehicle Parking Management System)
- [CVE-2025-4703](https://cve.now/CVE-2025-4703.md): PHPGurukul Vehicle Parking Management System admin-profile.php sql injection (CVSS 6.9, PHPGurukul Vehicle Parking Management System)
- [CVE-2025-2570](https://cve.now/CVE-2025-2570.md): System Admin Cannot Access Environment settings in System Console While System Manager Can (CVSS 2.7, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-2527](https://cve.now/CVE-2025-2527.md): Improper access control to group information (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-4702](https://cve.now/CVE-2025-4702.md): PHPGurukul Vehicle Parking Management System add-category.php sql injection (CVSS 6.9, PHPGurukul Vehicle Parking Management System)
- [CVE-2025-4701](https://cve.now/CVE-2025-4701.md): VITA-MLLM Freeze-Omni utils.py torch.load deserialization (CVSS 4.8, VITA-MLLM Freeze-Omni)
- [CVE-2025-4699](https://cve.now/CVE-2025-4699.md): PHPGurukul Apartment Visitors Management System visitors-form.php sql injection (CVSS 6.9, PHPGurukul Apartment Visitors Management System)
- [CVE-2025-4698](https://cve.now/CVE-2025-4698.md): PHPGurukul Directory Management System forget-password.php sql injection (CVSS 6.9, PHPGurukul Directory Management System)
- [CVE-2025-4516](https://cve.now/CVE-2025-4516.md): Use-after-free in "unicode\_escape" decoder with error handler (CVSS 5.9, Python Software Foundation CPython)
- [CVE-2025-4697](https://cve.now/CVE-2025-4697.md): PHPGurukul Directory Management System edit-directory.php sql injection (CVSS 6.9, PHPGurukul Directory Management System)
- [CVE-2025-4696](https://cve.now/CVE-2025-4696.md): PHPGurukul/Campcodes Cyber Cafe Management System search.php sql injection (CVSS 5.3, PHPGurukul Cyber Cafe Management System · Campcodes Cyber C…)
- [CVE-2025-4695](https://cve.now/CVE-2025-4695.md): PHPGurukul/Campcodes Cyber Cafe Management System add-users.php sql injection (CVSS 5.3, PHPGurukul Cyber Cafe Management System · Campcodes Cyber C…)
- [CVE-2025-4762](https://cve.now/CVE-2025-4762.md): Insecure Direct Object Reference (IDOR) vulnerability in eSignaViewer (CVSS 2.0, Lleidanet PKI eSigna)
- [CVE-2025-4564](https://cve.now/CVE-2025-4564.md): TicketBAI Facturas para WooCommerce \<= 3.18 - Unauthenticated Arbitrary File Deletion (CVSS 9.8, facturaone TicketBAI Facturas para WooCommerce)
- [CVE-2025-3446](https://cve.now/CVE-2025-3446.md): Members Without Guest Invite Permissions Can Add Guests to Teams (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-31947](https://cve.now/CVE-2025-31947.md): Repeated LDAP login failures can lock an LDAP account (CVSS 5.8, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2025-32738](https://cve.now/CVE-2025-32738.md): Missing authentication for critical function issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlie (CVSS 5.3, I-O DATA DEVICE HDL-TC1 · I-O DATA DEVICE HDL-TC500 +6)
- [CVE-2025-32002](https://cve.now/CVE-2025-32002.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard di (CVSS 9.8, I-O DATA DEVICE HDL-TC1 · I-O DATA DEVICE HDL-TC500 +6)
- [CVE-2025-4737](https://cve.now/CVE-2025-4737.md): Insufficient encryption vulnerability in the mobile application (com.transsion.aivoiceassistant) may lead to the risk of sensitive informati (CVSS 6.2, TECNO com.transsion.aivoiceassistant)
- [CVE-2025-27525](https://cve.now/CVE-2025-27525.md): Information Exposure vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager (CVSS 3.9, Hitachi JP1/IT Desktop Management 2 - Smart Device Manager)
- [CVE-2025-27524](https://cve.now/CVE-2025-27524.md): Weak encryption vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager (CVSS 5.3, Hitachi JP1/IT Desktop Management 2 - Smart Device Manager)
- [CVE-2025-27523](https://cve.now/CVE-2025-27523.md): XXE vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager (CVSS 8.7, Hitachi JP1/IT Desktop Management 2 - Smart Device Manager)
- [CVE-2025-3742](https://cve.now/CVE-2025-3742.md): Responsive Lightbox & Gallery \< 2.5.1 - Contributor+ Stored XSS (CVSS 6.8, Responsive Lightbox & Gallery)
- [CVE-2024-13914](https://cve.now/CVE-2024-13914.md): File Manager Advanced Shortcode \<= Multiple Versions - Authenticated (Administrator+) Local JavaScript File Inclusion via Shortcode (CVSS 7.2, WP Experts File Manager Advanced Shortcode)
- [CVE-2025-3053](https://cve.now/CVE-2025-3053.md): UiPress lite | Effortless custom dashboards, admin themes and pages \<= 3.5.07 - Authenticated (Subscriber+) Remote Code Execution (CVSS 8.8, admintwentytwenty UiPress lite | Effortless custom dashboar…)
- [CVE-2025-4591](https://cve.now/CVE-2025-4591.md): Weluka Lite \<= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, welukame Weluka Lite)
- [CVE-2025-4126](https://cve.now/CVE-2025-4126.md): EG-Series \<= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, emmanuelg EG-Series)
- [CVE-2025-3917](https://cve.now/CVE-2025-3917.md): 百度站长SEO合集(支持百度/神马/Bing/头条推送) \<= 2.0.6 - Unauthenticated Arbitrary File Upload (CVSS 9.8, kelerkgibo SEO合集)
- [CVE-2025-4589](https://cve.now/CVE-2025-4589.md): Bon Toolkit \<= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, nackle2k10 Bon Toolkit)
- [CVE-2025-4579](https://cve.now/CVE-2025-4579.md): WP Content Security Plugin \<= 2.3 - Unauthenticated Stored Cross-Site Scripting via CSP-Report Fields (CVSS 7.2, dyland WP Content Security Plugin)
- [CVE-2024-52877](https://cve.now/CVE-2024-52877.md): An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before versio (CVSS 7.5)
- [CVE-2024-52878](https://cve.now/CVE-2024-52878.md): An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before versio (CVSS 7.5)
- [CVE-2024-52879](https://cve.now/CVE-2024-52879.md): An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before versio (CVSS 7.5)
- [CVE-2024-52880](https://cve.now/CVE-2024-52880.md): An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before versio (CVSS 7.9)
- [CVE-2025-44110](https://cve.now/CVE-2025-44110.md): FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin\_forums.php. (CVSS 5.4)
- [CVE-2025-44180](https://cve.now/CVE-2025-44180.md): Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit-brand.php?bid={brandId}. (CVSS 6.1)
- [CVE-2025-44181](https://cve.now/CVE-2025-44181.md): Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/add-brand.php via the brandname param (CVSS 6.1)
- [CVE-2025-44182](https://cve.now/CVE-2025-44182.md): Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the vehiclename, modelnumber, regnumber, ve (CVSS 6.1)
- [CVE-2025-44183](https://cve.now/CVE-2025-44183.md): Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the name, email, and (CVSS 6.1)
- [CVE-2025-44185](https://cve.now/CVE-2025-44185.md): SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/change\_pass.php via the pas (CVSS 5.4)
- [CVE-2025-46052](https://cve.now/CVE-2025-46052.md): An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive (CVSS 9.8)
- [CVE-2025-46053](https://cve.now/CVE-2025-46053.md): A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a (CVSS 5.1)
- [CVE-2025-48024](https://cve.now/CVE-2025-48024.md): In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint. (CVSS 5.0, BlueWave Checkmate)
- [CVE-2025-48027](https://cve.now/CVE-2025-48027.md): The HttpAuth plugin in pGina.Fork through 3.9.9.12 allows authentication bypass when an adversary controls DNS resolution for pginaloginserv (CVSS 5.4, MutonUfoAI pGina.Fork)
- [CVE-2025-48050](https://cve.now/CVE-2025-48050.md): In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. (CVSS 7.5, Cure53 DOMPurify)
- [CVE-2025-48051](https://cve.now/CVE-2025-48051.md): powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extr (CVSS 4.7, Lichess Lila)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.