# CVEs published 2025-05-23 183 CVEs were published on May 23, 2025: 47 critical, 80 high. Days are UTC. - [CVE-2025-5119](https://cve.now/CVE-2025-5119.md): Emlog Pro api\_controller.php sql injection (CVSS 6.9, Emlog Pro) - [CVE-2025-24917](https://cve.now/CVE-2025-24917.md): Improper Access Control leads to Local Privilege Escalation (CVSS 7.8, Tenable Network Monitor) - [CVE-2025-24916](https://cve.now/CVE-2025-24916.md): Improper Access Control leads to Local Priviledge Escalation (CVSS 7.0, Tenable Network Monitor) - [CVE-2025-48375](https://cve.now/CVE-2025-48375.md): Schule Missing Rate Limiting on OTP Email Requests – Susceptible to Abuse & DoS (CVSS 6.6, schule111 Schule) - [CVE-2025-48377](https://cve.now/CVE-2025-48377.md): Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode (CVSS 6.0, dnnsoftware Dnn.Platform · DotNetNuke.Web +1) - [CVE-2025-48378](https://cve.now/CVE-2025-48378.md): Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline (CVSS 6.1, dnnsoftware Dnn.Platform · DotNetNuke.Core) - [CVE-2025-48376](https://cve.now/CVE-2025-48376.md): Dnn.Platform's Site Import could use an external source with a crafted request (CVSS 3.5, dnnsoftware Dnn.Platform · DotNetNuke.SiteExportImport) - [CVE-2025-43860](https://cve.now/CVE-2025-43860.md): OpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient Demographics (CVSS 7.6, openemr) - [CVE-2025-32967](https://cve.now/CVE-2025-32967.md): OpenEMR doesn't log password administration properly (CVSS 5.4, openemr) - [CVE-2025-32794](https://cve.now/CVE-2025-32794.md): OpenEMR Stored XSS via Patient Name Field in Procedure Orders (CVSS 7.6, openemr) - [CVE-2022-31812](https://cve.now/CVE-2022-31812.md): A vulnerability has been identified in SiPass integrated (All versions \< V2.95.3.18). (CVSS 7.5, Siemens SiPass integrated) - [CVE-2022-31807](https://cve.now/CVE-2022-31807.md): A vulnerability has been identified in Building X - Security Manager Edge Controller (ACC-AP) (All versions). (CVSS 6.2, Siemens Building X - Security Manager Edge Controller) - [CVE-2018-25110](https://cve.now/CVE-2018-25110.md): Regular Expression Denial of Service (ReDoS) in markedjs/marked (CVSS 6.9, marked) - [CVE-2025-5114](https://cve.now/CVE-2025-5114.md): easysoft zentaopms Editor index.php edit deserialization (CVSS 5.3, easysoft zentaopms) - [CVE-2025-5112](https://cve.now/CVE-2025-5112.md): FreeFloat FTP Server MGET Command buffer overflow (CVSS 6.9, FreeFloat FTP Server) - [CVE-2025-5111](https://cve.now/CVE-2025-5111.md): FreeFloat FTP Server TYPE Command buffer overflow (CVSS 6.9, FreeFloat FTP Server) - [CVE-2025-3580](https://cve.now/CVE-2025-3580.md): An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server admini (CVSS 5.5, Grafana) - [CVE-2025-5110](https://cve.now/CVE-2025-5110.md): FreeFloat FTP Server VERBOSE Command buffer overflow (CVSS 6.9, FreeFloat FTP Server) - [CVE-2025-5109](https://cve.now/CVE-2025-5109.md): FreeFloat FTP Server STATUS Command buffer overflow (CVSS 6.9, FreeFloat FTP Server) - [CVE-2025-31049](https://cve.now/CVE-2025-31049.md): WordPress Dash \<= 1.3 - PHP Object Injection Vulnerability (CVSS 9.8, themeton Dash) - [CVE-2025-31053](https://cve.now/CVE-2025-31053.md): WordPress KBx Pro Ultimate plugin \< 8.0.5 - Arbitrary File Deletion Vulnerability (CVSS 7.7, quantumcloud KBx Pro Ultimate) - [CVE-2025-31056](https://cve.now/CVE-2025-31056.md): WordPress WhatsCart plugin \<= 1.1.0 - SQL Injection vulnerability (CVSS 9.3, Techspawn WhatsCart - Whatsapp Abandoned Cart Recovery, Ord…) - [CVE-2025-31060](https://cve.now/CVE-2025-31060.md): WordPress Capie theme \<= 1.0.40 - Local File Inclusion Vulnerability (CVSS 8.1, ApusTheme Capie) - [CVE-2025-31064](https://cve.now/CVE-2025-31064.md): WordPress Vizeon theme \< 1.2.1 - Local File Inclusion vulnerability (CVSS 8.1, gavias Vizeon - Business Consulting) - [CVE-2025-31069](https://cve.now/CVE-2025-31069.md): WordPress HotStar – Multi-Purpose Business Theme \<= 1.4 - PHP Object Injection Vulnerability (CVSS 9.8, themeton HotStar – Multi-Purpose Business Theme) - [CVE-2025-31397](https://cve.now/CVE-2025-31397.md): WordPress Bus Ticket Booking with Seat Reservation for WooCommerce plugin \<= 1.7 - SQL Injection vulnerability (CVSS 9.3, smartcms Bus Ticket Booking with Seat Reservation for WooCo…) - [CVE-2025-31423](https://cve.now/CVE-2025-31423.md): WordPress Umberto theme \<= 1.2.8 - PHP Object Injection Vulnerability (CVSS 9.8, AncoraThemes Umberto) - [CVE-2025-31430](https://cve.now/CVE-2025-31430.md): WordPress The Business \<= 1.6.1 - PHP Object Injection Vulnerability (CVSS 9.8, themeton The Business) - [CVE-2025-31631](https://cve.now/CVE-2025-31631.md): WordPress Fish House theme \<= 1.2.7 - PHP Object Injection Vulnerability (CVSS 9.8, AncoraThemes Fish House) - [CVE-2025-31632](https://cve.now/CVE-2025-31632.md): WordPress La Boom \<= 2.7 - Local File Inclusion Vulnerability (CVSS 8.1, SpyroPress La Boom) - [CVE-2025-31633](https://cve.now/CVE-2025-31633.md): WordPress Kiamo - Responsive Business Service WordPress Theme \<= 1.3.3 - Local File Inclusion Vulnerability (CVSS 8.1, gavias Kiamo - Responsive Business Service WordPress Theme) - [CVE-2025-31636](https://cve.now/CVE-2025-31636.md): WordPress WP Post Modules for Elementor plugin \<= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, SaurabhSharma WP Post Modules for Elementor) - [CVE-2025-31912](https://cve.now/CVE-2025-31912.md): WordPress Enzio - Responsive Business WordPress Theme theme \< 1.2.6 - Local File Inclusion vulnerability (CVSS 8.1, gavias Enzio - Responsive Business WordPress Theme) - [CVE-2025-31913](https://cve.now/CVE-2025-31913.md): WordPress Ogami theme \<= 1.53 - Local File Inclusion Vulnerability (CVSS 8.1, ApusTheme Ogami) - [CVE-2025-31914](https://cve.now/CVE-2025-31914.md): WordPress Pixel Form BuilderPlugin & Autoresponder plugin \<= 1.0.2 - SQL Injection Vulnerability (CVSS 9.3, kamleshyadav Pixel WordPress Form BuilderPlugin & Autorespo…) - [CVE-2025-31916](https://cve.now/CVE-2025-31916.md): WordPress JP Students Result Management System Premium plugin 1.1.7 - Arbitrary File Upload vulnerability (CVSS 9.0, joy2012bd JP Students Result Management System Premium) - [CVE-2025-31918](https://cve.now/CVE-2025-31918.md): WordPress Simple Business Directory Pro plugin \< 15.6.9 - Privilege Escalation vulnerability (CVSS 9.8, quantumcloud Simple Business Directory Pro) - [CVE-2025-31924](https://cve.now/CVE-2025-31924.md): WordPress Crafts & Arts theme \<= 2.5 - PHP Object Injection Vulnerability (CVSS 8.8, designthemes Crafts & Arts) - [CVE-2025-31927](https://cve.now/CVE-2025-31927.md): WordPress Acerola \<= 1.6.5 - PHP Object Injection Vulnerability (CVSS 9.8, themeton Acerola) - [CVE-2025-32284](https://cve.now/CVE-2025-32284.md): WordPress Pet World theme \<= 2.8 - PHP Object Injection Vulnerability (CVSS 8.8, designthemes Pet World) - [CVE-2025-32285](https://cve.now/CVE-2025-32285.md): WordPress Butcher theme \< 2.54 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ApusTheme Butcher) - [CVE-2025-32286](https://cve.now/CVE-2025-32286.md): WordPress Butcher theme \<= 2.40 - Local File Inclusion Vulnerability (CVSS 8.1, ApusTheme Butcher) - [CVE-2025-32289](https://cve.now/CVE-2025-32289.md): WordPress Yozi theme \<= 2.0.63 - Local File Inclusion Vulnerability (CVSS 8.1, ApusTheme Yozi) - [CVE-2025-32292](https://cve.now/CVE-2025-32292.md): WordPress Jarvis – Night Club, Concert, Festival WordPress theme \<= 1.8.11 - PHP Object Injection Vulnerability (CVSS 9.8, AncoraThemes Jarvis – Night Club, Concert, Festival WordPre…) - [CVE-2025-32293](https://cve.now/CVE-2025-32293.md): WordPress Finance Consultant theme \<= 2.8 - PHP Object Injection Vulnerability (CVSS 8.8, designthemes Finance Consultant) - [CVE-2025-32294](https://cve.now/CVE-2025-32294.md): WordPress Oxpitan theme \<= 1.3.5 - Local File Inclusion Vulnerability (CVSS 8.1, gavias Oxpitan) - [CVE-2025-32302](https://cve.now/CVE-2025-32302.md): WordPress Winnex theme \<= 1.3.2 - Local File Inclusion Vulnerability (CVSS 8.1, gavias Winnex) - [CVE-2025-32309](https://cve.now/CVE-2025-32309.md): WordPress Healsoul theme \<= 2.2.3 - Local File Inclusion Vulnerability (CVSS 8.1, ThemeMove Healsoul) - [CVE-2025-39480](https://cve.now/CVE-2025-39480.md): WordPress Car Dealer theme \< 1.6.8 - PHP Object Injection vulnerability (CVSS 9.8, ThemeMakers Car Dealer) - [CVE-2025-39485](https://cve.now/CVE-2025-39485.md): WordPress GrandTour theme \<= 5.6 - PHP Object Injection vulnerability (CVSS 9.8, ThemeGoods Grand Tour) - [CVE-2025-39489](https://cve.now/CVE-2025-39489.md): WordPress CouponXL theme \<= 4.5.0 - Privilege Escalation Vulnerability (CVSS 9.8, pebas CouponXL) - [CVE-2025-39490](https://cve.now/CVE-2025-39490.md): WordPress Backpack Traveler theme \<= 2.10.2 - Local File Inclusion Vulnerability (CVSS 8.1, Mikado-Themes Backpack Traveler) - [CVE-2025-39494](https://cve.now/CVE-2025-39494.md): WordPress Wilmër theme \< 3.4.2 - Local File Inclusion Vulnerability (CVSS 8.1, Mikado-Themes Wilmër) - [CVE-2025-39495](https://cve.now/CVE-2025-39495.md): WordPress Avantage Theme \<= 2.4.9 - PHP Object Injection vulnerability (CVSS 9.8, BoldThemes Avantage) - [CVE-2025-39499](https://cve.now/CVE-2025-39499.md): WordPress Medicare Theme \<= 2.1.0 - PHP Object Injection vulnerability (CVSS 9.8, BoldThemes Medicare) - [CVE-2025-39500](https://cve.now/CVE-2025-39500.md): WordPress Goodlayers Hostel Plugin \<= 3.1.2 - PHP Object Injection vulnerability (CVSS 9.8, Goodlayers Hostel) - [CVE-2025-39501](https://cve.now/CVE-2025-39501.md): WordPress Goodlayers Hostel plugin \<= 3.1.4 - SQL Injection vulnerability (CVSS 9.3, Goodlayers Hostel) - [CVE-2025-39502](https://cve.now/CVE-2025-39502.md): WordPress Goodlayers Hostel Plugin \<= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Goodlayers Hostel) - [CVE-2025-39503](https://cve.now/CVE-2025-39503.md): WordPress Goodlayers Hotel plugin \<= 3.1.4 - PHP Object Injection vulnerability (CVSS 9.8, Goodlayers Hotel) - [CVE-2025-39504](https://cve.now/CVE-2025-39504.md): WordPress Goodlayers Hotel plugin \<= 3.1.4 - SQL Injection vulnerability (CVSS 9.3, Goodlayers Hotel) - [CVE-2025-39505](https://cve.now/CVE-2025-39505.md): WordPress Goodlayers Hotel plugin \<= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Goodlayers Hotel) - [CVE-2025-39506](https://cve.now/CVE-2025-39506.md): WordPress Nasa Core Plugin \<= 6.3.2 - Local File Inclusion vulnerability (CVSS 8.1, NasaTheme Nasa Core) - [CVE-2025-39536](https://cve.now/CVE-2025-39536.md): WordPress JobHunt Job Alerts \<= 3.6 - Arbitrary Content Deletion Vulnerability (CVSS 8.2, Chimpstudio JobHunt Job Alerts) - [CVE-2025-46437](https://cve.now/CVE-2025-46437.md): WordPress Tayori Form plugin \<= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tayoricom Tayori Form) - [CVE-2025-46440](https://cve.now/CVE-2025-46440.md): WordPress kStats Reloaded plugin \<= 0.7.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mark kStats Reloaded) - [CVE-2025-46444](https://cve.now/CVE-2025-46444.md): WordPress Ads Pro plugin \<= 4.89 - Local File Inclusion vulnerability (CVSS 8.1, scripteo Ads Pro) - [CVE-2025-46446](https://cve.now/CVE-2025-46446.md): WordPress Libro de Reclamaciones plugin \<= 1.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, ivanrojas Libro de Reclamaciones) - [CVE-2025-46448](https://cve.now/CVE-2025-46448.md): WordPress Document Management System plugin \<= 1.24 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, reifsnyderb Document Management System) - [CVE-2025-46454](https://cve.now/CVE-2025-46454.md): WordPress Meta Keywords & Description plugin \<= 0.8 - Local File Inclusion Vulnerability (CVSS 7.5, svil4ok Meta Keywords & Description) - [CVE-2025-46455](https://cve.now/CVE-2025-46455.md): WordPress WP HRM LITE plugin \<= 1.1 - SQL Injection Vulnerability (CVSS 9.3, IndigoThemes WP HRM LITE) - [CVE-2025-46456](https://cve.now/CVE-2025-46456.md): WordPress Theme Blvd Sliders plugin \<= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jason Theme Blvd Sliders) - [CVE-2025-46458](https://cve.now/CVE-2025-46458.md): WordPress occupancyplan plugin \<= 1.0.3.0 - CSRF to SQL Injection vulnerability (CVSS 8.2, x000x occupancyplan) - [CVE-2025-46460](https://cve.now/CVE-2025-46460.md): WordPress Easy Guide plugin \<= 1.0.0 - SQL Injection Vulnerability (CVSS 9.3, Detheme Easy Guide) - [CVE-2025-46463](https://cve.now/CVE-2025-46463.md): WordPress Mailing Group Listserv plugin \<= 3.0.4 - SQL Injection Vulnerability (CVSS 8.5, Yamna Khawaja Mailing Group Listserv) - [CVE-2025-46468](https://cve.now/CVE-2025-46468.md): WordPress Fable Extra plugin \<= 1.0.6 - Local File Inclusion Vulnerability (CVSS 9.8, WPFable Fable Extra) - [CVE-2025-46474](https://cve.now/CVE-2025-46474.md): WordPress SEUR Oficial plugin \<= 2.2.23 - Local File Inclusion Vulnerability (CVSS 8.1, SEUR Oficial) - [CVE-2025-46486](https://cve.now/CVE-2025-46486.md): WordPress Nomupay Payment Processing Gateway plugin \<= 7.1.7 - Arbitrary File Download Vulnerability (CVSS 4.9, totalprocessing Nomupay Payment Processing Gateway) - [CVE-2025-46487](https://cve.now/CVE-2025-46487.md): WordPress EC Authorize.net plugin \<= 0.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sftranna EC Authorize.net) - [CVE-2025-46488](https://cve.now/CVE-2025-46488.md): WordPress Visual Builder plugin \<= 1.2.2 - Broken Access Control vulnerability (CVSS 7.1, dastan800 Visual Builder) - [CVE-2025-46490](https://cve.now/CVE-2025-46490.md): WordPress Crossword Compiler Puzzles plugin \<= 5.2 - Arbitrary File Upload Vulnerability (CVSS 9.9, wordwebsoftware Crossword Compiler Puzzles) - [CVE-2025-46493](https://cve.now/CVE-2025-46493.md): WordPress Crossword Compiler Puzzles plugin \<= 14.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wordwebsoftware Crossword Compiler Puzzles) - [CVE-2025-46515](https://cve.now/CVE-2025-46515.md): WordPress Category Widget plugin \<= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, M A Vinoth Kumar Category Widget) - [CVE-2025-46518](https://cve.now/CVE-2025-46518.md): WordPress IGIT Related Posts With Thumb Image After Posts plugin \<= 4.5.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, phpaddicted IGIT Related Posts With Thumb Image After Posts) - [CVE-2025-46526](https://cve.now/CVE-2025-46526.md): WordPress My Custom Widgets plugin \<= 2.0.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, janekniefeldt My Custom Widgets) - [CVE-2025-46527](https://cve.now/CVE-2025-46527.md): WordPress Web3Press – Decentralize Publishing with Writing NFT plugin \<= 3.2.0 - Arbitrary File Read vulnerability (CVSS 6.5, LikeCoin Web3Press) - [CVE-2025-46537](https://cve.now/CVE-2025-46537.md): WordPress Section Widget plugin \<= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ctltwp Section Widget) - [CVE-2025-46539](https://cve.now/CVE-2025-46539.md): WordPress Fable Extra plugin \<= 1.0.6 - SQL Injection Vulnerability (CVSS 9.3, WPFable Fable Extra) - [CVE-2025-47438](https://cve.now/CVE-2025-47438.md): WordPress WP Job Portal plugin \<= 2.3.1 - Local File Inclusion vulnerability (CVSS 8.1, wpjobportal WP Job Portal) - [CVE-2025-47453](https://cve.now/CVE-2025-47453.md): WordPress WP Smart Import plugin \<= 1.1.3 - Local File Inclusion Vulnerability (CVSS 8.1, Xylus Themes WP Smart Import) - [CVE-2025-47458](https://cve.now/CVE-2025-47458.md): WordPress B2i Investor Tools plugin \<= 1.0.7.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, B2itech B2i Investor Tools) - [CVE-2025-47461](https://cve.now/CVE-2025-47461.md): WordPress Subaccounts for WooCommerce plugin \<= 1.6.6 - Account Takeover vulnerability (CVSS 8.8, mediaticus Subaccounts for WooCommerce) - [CVE-2025-47478](https://cve.now/CVE-2025-47478.md): WordPress ProfileGrid plugin \<= 5.9.5.0 - SQL Injection Vulnerability (CVSS 8.5, Metagauss ProfileGrid) - [CVE-2025-47492](https://cve.now/CVE-2025-47492.md): WordPress Drag and Drop File Upload for Elementor Forms plugin \<= 1.4.3 - Arbitrary File Deletion Vulnerability (CVSS 8.6, add-ons.org Drag and Drop File Upload for Elementor Forms) - [CVE-2025-47512](https://cve.now/CVE-2025-47512.md): WordPress Tainacan plugin \<= 0.21.14 - Arbitrary File Deletion vulnerability (CVSS 8.6, Tainacan) - [CVE-2025-47513](https://cve.now/CVE-2025-47513.md): WordPress Infocob CRM Forms plugin \<= 2.4.0 - Arbitrary File Download vulnerability (CVSS 4.9, James Laforge Infocob CRM Forms) - [CVE-2025-47529](https://cve.now/CVE-2025-47529.md): WordPress Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin \<= 1.1.1 - Settings Change Vulnerability (CVSS 6.5, UX Design Experts Experto CTA Widget – Call To Action, Stic…) - [CVE-2025-47530](https://cve.now/CVE-2025-47530.md): WordPress WPFunnels plugin \<= 3.5.18 - PHP Object Injection Vulnerability (CVSS 9.8, WPFunnels) - [CVE-2025-47532](https://cve.now/CVE-2025-47532.md): WordPress CoinPayments.net Payment Gateway for WooCommerce plugin \<= 1.0.17 - PHP Object Injection Vulnerability (CVSS 9.8, CoinPayments.net Payment Gateway for WooCommerce) - [CVE-2025-47535](https://cve.now/CVE-2025-47535.md): WordPress Opal Woo Custom Product Variation plugin \<= 1.2.0 - Arbitrary File Deletion Vulnerability (CVSS 8.6, wpopal Opal Woo Custom Product Variation) - [CVE-2025-47539](https://cve.now/CVE-2025-47539.md): WordPress Eventin plugin \<= 4.0.26 - Privilege Escalation Vulnerability (CVSS 9.8, Arraytics Eventin) - [CVE-2025-47541](https://cve.now/CVE-2025-47541.md): WordPress Mail Mint plugin \<= 1.17.7 - Sensitive Data Exposure Vulnerability (CVSS 7.5, WPFunnels Mail Mint) - [CVE-2025-47558](https://cve.now/CVE-2025-47558.md): WordPress MapSVG plugin \< 8.6.13 - Broken Access Control vulnerability (CVSS 7.5, RomanCode MapSVG) - [CVE-2025-47568](https://cve.now/CVE-2025-47568.md): WordPress ZoomSounds plugin \<= 6.91 - PHP Object Injection vulnerability (CVSS 9.8, ZoomIt ZoomSounds) - [CVE-2025-47575](https://cve.now/CVE-2025-47575.md): WordPress School Management plugin \<= 92.0.0 - SQL Injection vulnerability (CVSS 8.5, mojoomla School Management) - [CVE-2025-47599](https://cve.now/CVE-2025-47599.md): WordPress Facturante plugin \<= 1.11 - SQL Injection Vulnerability (CVSS 9.3, Facturante) - [CVE-2025-47603](https://cve.now/CVE-2025-47603.md): WordPress belingoGeo plugin \<= 1.12.0 - Arbitrary File Download Vulnerability (CVSS 7.5, belingoGeo) - [CVE-2025-47611](https://cve.now/CVE-2025-47611.md): WordPress User Meta plugin \<= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Khaled User Meta) - [CVE-2025-47613](https://cve.now/CVE-2025-47613.md): WordPress School Management System for Wordpress plugin \<= 92.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mojoomla School Management) - [CVE-2025-47618](https://cve.now/CVE-2025-47618.md): WordPress BMI Adult & Kid Calculator plugin \<= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mortgage Calculator BMI Adult & Kid Calculator) - [CVE-2025-47619](https://cve.now/CVE-2025-47619.md): WordPress 6Storage Rentals plugin \<= 2.20.2 - Broken Access Control vulnerability (CVSS 6.5, 6Storage Rentals) - [CVE-2025-47631](https://cve.now/CVE-2025-47631.md): WordPress Hospital Management System plugin \<= 47.0(20-11-2023) - Privilege Escalation vulnerability (CVSS 8.8, mojoomla Hospital Management System) - [CVE-2025-47637](https://cve.now/CVE-2025-47637.md): WordPress STAGGS plugin \<= 2.11.0 - Arbitrary File Upload Vulnerability (CVSS 10.0, STAGGS) - [CVE-2025-47640](https://cve.now/CVE-2025-47640.md): WordPress Printcart Web to Print Product Designer for WooCommerce plugin \<= 2.4.0 - SQL Injection Vulnerability (CVSS 9.3, Printcart Web to Print Product Designer for WooCommerce) - [CVE-2025-47641](https://cve.now/CVE-2025-47641.md): WordPress Printcart Web to Print Product Designer for WooCommerce plugin \<= 2.3.9 - Arbitrary File Upload Vulnerability (CVSS 10.0, Printcart Web to Print Product Designer for WooCommerce) - [CVE-2025-47642](https://cve.now/CVE-2025-47642.md): WordPress Ajar in5 Embed plugin \<= 3.1.5 - Arbitrary File Upload Vulnerability (CVSS 10.0, Ajar Productions Ajar in5 Embed) - [CVE-2025-47646](https://cve.now/CVE-2025-47646.md): WordPress PSW Front-end Login & Registration plugin \<= 1.13 - Broken Authentication Vulnerability (CVSS 9.8, Gilblas Ngunte Possi PSW Front-end Login & Registration) - [CVE-2025-47658](https://cve.now/CVE-2025-47658.md): WordPress ELEX HelpDesk & Customer Ticketing System plugin \<= 3.2.9 - Arbitrary File Upload vulnerability (CVSS 9.9, ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing S…) - [CVE-2025-47660](https://cve.now/CVE-2025-47660.md): WordPress WC Affiliate plugin \<= 2.16 - PHP Object Injection vulnerability (CVSS 8.8, Codexpert WC Affiliate) - [CVE-2025-47663](https://cve.now/CVE-2025-47663.md): WordPress Hospital Management System plugin \<= 47.0(20-11-2023) - Arbitrary File Upload vulnerability (CVSS 9.9, mojoomla Hospital Management System) - [CVE-2025-47670](https://cve.now/CVE-2025-47670.md): WordPress Social Login and Register plugin \<= 7.6.10 - Local File Inclusion Vulnerability (CVSS 8.1, miniOrange WordPress Social Login and Register) - [CVE-2025-47671](https://cve.now/CVE-2025-47671.md): WordPress Binary MLM Plan plugin \<= 3.0 - SQL Injection vulnerability (CVSS 7.6, LETSCMS MLM Software Binary MLM Plan) - [CVE-2025-47672](https://cve.now/CVE-2025-47672.md): WordPress miniOrange Discord Integration plugin \<= 2.2.2 - Local File Inclusion Vulnerability (CVSS 8.1, miniOrange Discord Integration) - [CVE-2025-47673](https://cve.now/CVE-2025-47673.md): WordPress Arconix Shortcodes plugin \<= 2.1.16 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tychesoftwares Arconix Shortcodes) - [CVE-2025-47678](https://cve.now/CVE-2025-47678.md): WordPress FunnelCockpit plugin \<= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, FunnelCockpit) - [CVE-2025-47680](https://cve.now/CVE-2025-47680.md): WordPress xili-tidy-tags plugin \<= 1.12.06 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Michel - xiligroup dev xili-tidy-tags) - [CVE-2025-47687](https://cve.now/CVE-2025-47687.md): WordPress StoreKeeper for WooCommerce plugin \<= 14.4.4 - Arbitrary File Upload Vulnerability (CVSS 10.0, StoreKeeper B.V. StoreKeeper for WooCommerce) - [CVE-2025-47690](https://cve.now/CVE-2025-47690.md): WordPress Lead Form Data Collection to CRM plugin \<= 3.1 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 8.8, Smackcoders Inc., Lead Form Data Collection to CRM) - [CVE-2025-48241](https://cve.now/CVE-2025-48241.md): WordPress Verge3D plugin \<= 4.9.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Soft8Soft Verge3D) - [CVE-2025-48245](https://cve.now/CVE-2025-48245.md): WordPress Quick Contact Form plugin \<= 8.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Saad Iqbal Quick Contact Form) - [CVE-2025-48271](https://cve.now/CVE-2025-48271.md): WordPress Leadinfo plugin \<= 1.1 - Settings Change Vulnerability (CVSS 6.5, Leadinfo) - [CVE-2025-48273](https://cve.now/CVE-2025-48273.md): WordPress WP Job Portal plugin \<= 2.3.2 - Arbitrary File Download Vulnerability (CVSS 7.5, wpjobportal WP Job Portal) - [CVE-2025-48275](https://cve.now/CVE-2025-48275.md): WordPress Visual Header plugin \<= 1.3 - Broken Access Control Vulnerability (CVSS 6.5, dastan800 Visual Header) - [CVE-2025-48283](https://cve.now/CVE-2025-48283.md): WordPress Majestic Support plugin \<= 1.1.0 - SQL Injection Vulnerability (CVSS 9.3, Majestic Support) - [CVE-2025-48286](https://cve.now/CVE-2025-48286.md): WordPress ReDi Restaurant Reservation plugin \<= 24.1209 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, catkin ReDi Restaurant Reservation) - [CVE-2025-48287](https://cve.now/CVE-2025-48287.md): WordPress Pix 4x sem juros - Pagaleve plugin \<= 1.6.9 - PHP Object Injection Vulnerability (CVSS 9.8, Pix 4x sem juros - Pagaleve) - [CVE-2025-48289](https://cve.now/CVE-2025-48289.md): WordPress Kids Planet theme \<= 2.2.14 - PHP Object Injection Vulnerability (CVSS 9.8, AncoraThemes Kids Planet) - [CVE-2025-48292](https://cve.now/CVE-2025-48292.md): WordPress Tourmaster plugin \<= 5.3.8 - Local File Inclusion vulnerability (CVSS 8.1, GoodLayers Tourmaster) - [CVE-2025-41380](https://cve.now/CVE-2025-41380.md): Injection vulnerability in Iridium Certus 700 (CVSS 6.1, Intellian Technologies Iridium Certus) - [CVE-2025-41379](https://cve.now/CVE-2025-41379.md): Injection vulnerability in Iridium Certus 700 (CVSS 6.3, Intellian Technologies Iridium Certus) - [CVE-2025-41378](https://cve.now/CVE-2025-41378.md): Injection vulnerability in Iridium Certus 700 (CVSS 6.9, Intellian Technologies Iridium Certus) - [CVE-2025-41377](https://cve.now/CVE-2025-41377.md): SQL injection vulnerability in Gandia Integra Total (CVSS 8.7, TESI Gandia Integra Total) - [CVE-2024-7803](https://cve.now/CVE-2024-7803.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab) - [CVE-2024-9163](https://cve.now/CVE-2024-9163.md): User Interface (UI) Misrepresentation of Critical Information in GitLab (CVSS 3.5, GitLab) - [CVE-2025-5108](https://cve.now/CVE-2025-5108.md): zongzhige ShopXO ZIP File Payment.php Upload unrestricted upload (CVSS 5.3, zongzhige ShopXO) - [CVE-2025-5107](https://cve.now/CVE-2025-5107.md): Fujian Kelixun xml\_cdr\_details.php sql injection (CVSS 5.3, Fujian Kelixun) - [CVE-2025-1123](https://cve.now/CVE-2025-1123.md): Solid Mail – SMTP email and logging made by SolidWP \<= 2.1.5 - Unauthenticated Stored Cross-Site Scripting via Email (CVSS 7.2, Solid Mail – SMTP email and logging made by SolidWP) - [CVE-2025-5106](https://cve.now/CVE-2025-5106.md): Fujian Kelixun Filename fax\_view.php os command injection (CVSS 6.9, Fujian Kelixun) - [CVE-2025-5105](https://cve.now/CVE-2025-5105.md): TOZED ZLT W51 Service Port 7777 heap inspection (CVSS 6.9, TOZED ZLT W51) - [CVE-2025-41407](https://cve.now/CVE-2025-41407.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus) - [CVE-2025-36527](https://cve.now/CVE-2025-36527.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus) - [CVE-2025-3895](https://cve.now/CVE-2025-3895.md): Low token entropy in MegaBIP (CVSS 9.1, Jan Syski MegaBIP) - [CVE-2025-3894](https://cve.now/CVE-2025-3894.md): Stored XSS in MegaBIP (CVSS 4.8, Jan Syski MegaBIP) - [CVE-2025-3893](https://cve.now/CVE-2025-3893.md): SQL Injection in MegaBIP (CVSS 8.6, Jan Syski MegaBIP) - [CVE-2025-4379](https://cve.now/CVE-2025-4379.md): Reflected XSS in DobryCMS (CVSS 5.1, Studio Fabryka DobryCMS) - [CVE-2024-13945](https://cve.now/CVE-2024-13945.md): Stored Absolute Path Traversal (CVSS 8.4, ABB ASPECT-Enterprise · ABB NEXUS Series +1) - [CVE-2025-47149](https://cve.now/CVE-2025-47149.md): The optional feature 'Anti-Virus & Sandbox' of i-FILTER contains an issue with improper pattern file validation. (CVSS 5.3, Digital Arts i-FILTER) - [CVE-2025-5096](https://cve.now/CVE-2025-5096.md): TablePress \<= 3.1.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters (CVSS 6.4, tobiasbg TablePress – Tables in WordPress made easy) - [CVE-2025-4594](https://cve.now/CVE-2025-4594.md): Tournamatch \<= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Tournamatch) - [CVE-2025-5100](https://cve.now/CVE-2025-5100.md): KL-001-2025-005: Mobile Dynamix PrinterShare Mobile Print Double-Free Memory Write (CVSS 8.0, Mobile Dynamix PrinterShare Mobile Print) - [CVE-2025-5098](https://cve.now/CVE-2025-5098.md): KL-001-2025-003: Mobile Dynamix PrinterShare Mobile Print Gmail Oauth Token Disclosure (CVSS 9.1, Mobile Dynamix PrinterShare Mobile Print) - [CVE-2025-5099](https://cve.now/CVE-2025-5099.md): KL-001-2025-004: Mobile Dynamix PrinterShare Mobile Print Out-of-bounds Write (CVSS 9.8, Mobile Dynamix PrinterShare Mobile Print) - [CVE-2025-2394](https://cve.now/CVE-2025-2394.md): Disclosure of Alibaba (OSS) Keys In Ecovacs Home Android and iOS Mobile Applications (CVSS 4.7, Ecovacs Mobile and Android Application) - [CVE-2023-34873](https://cve.now/CVE-2023-34873.md): On MOBOTIX P3 cameras before MX-V4.7.2.18 and Mx6 cameras before MX-V5.2.0.61, the tcpdump feature does not properly validate input, which a (CVSS 8.7, MOBOTIX P3 · MOBOTIX Mx6) - [CVE-2023-53154](https://cve.now/CVE-2023-53154.md): parse\_string in cJSON before 1.7.18 has a heap-based buffer over-read via {"1":1, with no trailing newline if cJSON\_ParseWithLength is calle (CVSS 2.9, cJSON project cJSON) - [CVE-2024-48702](https://cve.now/CVE-2024-48702.md): PHPGurukul Old Age Home Management System v1.0 is vulnerable to HTML Injection via the searchdata parameter. (CVSS 5.4) - [CVE-2024-48704](https://cve.now/CVE-2024-48704.md): Phpgurukul Medical Card Generation System v1.0 is vulnerable to HTML Injection in admin/contactus.php via the parameter pagedes. (CVSS 6.1) - [CVE-2024-51099](https://cve.now/CVE-2024-51099.md): A reflected cross-site scripting (XSS) vulnerability in the component mcgs/download-medical-cards.php of PHPGURUKUL Medical Card Generation (CVSS 6.1) - [CVE-2024-51101](https://cve.now/CVE-2024-51101.md): PHPGURUKUL Restaurant Table Booking System using PHP and MySQL v1.0 was discovered to contain a SQL injection vulnerability via the searchda (CVSS 9.8) - [CVE-2024-51102](https://cve.now/CVE-2024-51102.md): PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentreco (CVSS 4.4) - [CVE-2024-51103](https://cve.now/CVE-2024-51103.md): PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentreco (CVSS 6.5) - [CVE-2024-51107](https://cve.now/CVE-2024-51107.md): Multiple stored cross-site scripting (XSS) vulnerabilities in the component /mcgs/admin/contactus.php of PHPGURUKUL Medical Card Generation (CVSS 4.8) - [CVE-2024-51108](https://cve.now/CVE-2024-51108.md): Multiple stored cross-site scripting (XSS) vulnerabilities in the component /admin/card-bwdates-report.php of PHPGURUKUL Medical Card Genera (CVSS 5.4) - [CVE-2024-51360](https://cve.now/CVE-2024-51360.md): An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php fi (CVSS 9.8) - [CVE-2025-44998](https://cve.now/CVE-2025-44998.md): A stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to execut (CVSS 6.1) - [CVE-2025-46176](https://cve.now/CVE-2025-46176.md): Hardcoded credentials in the Telnet service in D-Link DIR-605L v2.13B01 and DIR-816L v2.06B01 allow attackers to remotely execute arbitrary (CVSS 6.5) - [CVE-2025-48695](https://cve.now/CVE-2025-48695.md): An issue was discovered in CyberDAVA before 1.1.20. (CVSS 6.4, CyberDAVA) - [CVE-2025-48701](https://cve.now/CVE-2025-48701.md): openDCIM through 23.04 allows SQL injection in people\_depts.php because prepared statements are not used. (CVSS 5.4, openDCIM) - [CVE-2025-48708](https://cve.now/CVE-2025-48708.md): gs\_lib\_ctx\_stash\_sanitized\_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. (CVSS 4.0, Artifex Ghostscript) - [CVE-2025-48735](https://cve.now/CVE-2025-48735.md): A SQL Injection issue in the request body processing in BOS IPCs with firmware 21.45.8.2.2\_220219 before 21.45.8.2.3\_230220 allows remote at (CVSS 4.3, BOS IP camera) - [CVE-2025-48738](https://cve.now/CVE-2025-48738.md): An e-mail flooding vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 (CVSS 6.9, StrangeBee TheHive) - [CVE-2025-48739](https://cve.now/CVE-2025-48739.md): A Server-Side Request Forgery (SSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and (CVSS 4.6, StrangeBee TheHive) - [CVE-2025-48740](https://cve.now/CVE-2025-48740.md): A Cross-Site Request Forgery (CSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5 (CVSS 5.9, StrangeBee TheHive) - [CVE-2025-48741](https://cve.now/CVE-2025-48741.md): A Broken Access Control vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, and 5.4.0 before 5.4.10 allows remote, (CVSS 6.8, StrangeBee TheHive) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-05-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.