CVEs published June 14, 2025
21 CVEs were published on June 14, 2025: 1 critical, 4 high.
- Published
- 21
- Critical
- 1
- High
- 4
- Medium
- 16
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- aspengrovestudios AI Image Lab – Free AI Image Generator
- 1
- bhittani kk Youtube Video
- 1
- bogdanding Zen Sticky Social
- 1
- BZOTheme Zagg - Electronics & Accessories WooCommerce WordP…
- 1
- Click to Chat – HoliThemes
- 1
- croixhaug Appointment Booking Calendar — Simply Schedule Ap…
- 1
- DIOT SCADA with MQTT
- 1
- djerba WP URL Shortener
- 1
- dmitry78 XiSearch bar
- 1
- IBM Backup Recovery and Media Services for i
- 1
Critical 1
High 4
- CVE-2025-4200Zagg - Electronics & Accessories WooCommerce WordPress Theme <= 1.4.1 - Unauthenticated Local File InclusionBZOTheme Zagg - Electronics & Accessories WooCommerce WordP…
- CVE-2025-5487AutomatorWP <= 5.2.5 - Authenticated (Administrator+) SQL Injection via field_conditionsrubengc AutomatorWP – Automator plugin for no-code automati…
- CVE-2025-3234File Manager Pro – Filester <= 1.8.8 - Authenticated (Administrator+) Arbitrary File Uploadninjateam File Manager Pro – Filester
- CVE-2025-33108IBM Backup Recovery and Media Services for i code executionIBM Backup Recovery and Media Services for i
Medium, low and unrated 16
- CVE-2025-5238YITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameteryithemes YITH WooCommerce Wishlist
- CVE-2025-4667Simply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodescroixhaug Appointment Booking Calendar — Simply Schedule Ap…
- CVE-2025-5337Slider, Gallery, and Carousel by MetaSlider <= 3.98.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via aria-label ParameterSlider, Gallery, and Carousel by MetaSlider – Image Slider,…
- CVE-2025-6063XiSearch bar <= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scriptingdmitry78 XiSearch bar
- CVE-2025-6061kk Youtube Video <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingbhittani kk Youtube Video
- CVE-2025-5336Click to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number ParameterClick to Chat – HoliThemes
- CVE-2025-6062Yougler Blogger Profile Page <= v1.01 - Cross-Site Request Forgery to Settings Updatenetlatch Yougler Blogger Profile Page
- CVE-2025-6070Restrict File Access <= 1.1.2 - Authenticated (Subscriber+) Arbitrary File Readjosxha Restrict File Access
- CVE-2025-4592AI Image Lab – Free AI Image Generator <= 1.0.6 - Cross-Site Request Forgery to API Key Updateaspengrovestudios AI Image Lab – Free AI Image Generator
- CVE-2025-5589StreamWeasels Kick Integration <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via status-classic-offline-text ParameterStreamWeasels Kick Integration
- CVE-2025-6055Zen Sticky Social <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scriptingbogdanding Zen Sticky Social
- CVE-2025-4187UserPro - Community and User Profile WordPress Plugin <= 5.1.10 - Unauthenticated Arbitrary File ReadUserPro - Community and User Profile WordPress Plugin
- CVE-2025-6040Easy Flashcards <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scriptingsagesony Easy Flashcards
- CVE-2025-4216DIOT SCADA with MQTT <= 1.0.5.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingDIOT SCADA with MQTT
- CVE-2025-6064WP URL Shortener <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scriptingdjerba WP URL Shortener
- CVE-2025-6059Seraphinite Accelerator <= 2.27.21 - Cross-Site Request Forgery to Multiple Administrative Actionsseraphinitesoft Seraphinite Accelerator