# CVEs published 2025-06-14

21 CVEs were published on June 14, 2025: 1 critical, 4 high. Days are UTC.

- [CVE-2025-5238](https://cve.now/CVE-2025-5238.md): YITH WooCommerce Wishlist \<= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, yithemes YITH WooCommerce Wishlist)
- [CVE-2025-4667](https://cve.now/CVE-2025-4667.md): Simply Schedule Appointments \<= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes (CVSS 6.4, croixhaug Appointment Booking Calendar — Simply Schedule Ap…)
- [CVE-2025-5337](https://cve.now/CVE-2025-5337.md): Slider, Gallery, and Carousel by MetaSlider \<= 3.98.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via aria-label Parameter (CVSS 6.4, Slider, Gallery, and Carousel by MetaSlider – Image Slider,…)
- [CVE-2025-6063](https://cve.now/CVE-2025-6063.md): XiSearch bar \<= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, dmitry78 XiSearch bar)
- [CVE-2025-6061](https://cve.now/CVE-2025-6061.md): kk Youtube Video \<= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bhittani kk Youtube Video)
- [CVE-2025-5336](https://cve.now/CVE-2025-5336.md): Click to Chat \<= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no\_number Parameter (CVSS 6.4, Click to Chat – HoliThemes)
- [CVE-2025-6062](https://cve.now/CVE-2025-6062.md): Yougler Blogger Profile Page \<= v1.01 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, netlatch Yougler Blogger Profile Page)
- [CVE-2025-6070](https://cve.now/CVE-2025-6070.md): Restrict File Access \<= 1.1.2 - Authenticated (Subscriber+) Arbitrary File Read (CVSS 6.5, josxha Restrict File Access)
- [CVE-2025-4592](https://cve.now/CVE-2025-4592.md): AI Image Lab – Free AI Image Generator \<= 1.0.6 - Cross-Site Request Forgery to API Key Update (CVSS 4.3, aspengrovestudios AI Image Lab – Free AI Image Generator)
- [CVE-2025-5589](https://cve.now/CVE-2025-5589.md): StreamWeasels Kick Integration \<= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via status-classic-offline-text Parameter (CVSS 6.4, StreamWeasels Kick Integration)
- [CVE-2025-6055](https://cve.now/CVE-2025-6055.md): Zen Sticky Social \<= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, bogdanding Zen Sticky Social)
- [CVE-2025-4200](https://cve.now/CVE-2025-4200.md): Zagg - Electronics & Accessories WooCommerce WordPress Theme \<= 1.4.1 - Unauthenticated Local File Inclusion (CVSS 8.1, BZOTheme Zagg - Electronics & Accessories WooCommerce WordP…)
- [CVE-2025-4187](https://cve.now/CVE-2025-4187.md): UserPro - Community and User Profile WordPress Plugin \<= 5.1.10 - Unauthenticated Arbitrary File Read (CVSS 5.9, UserPro - Community and User Profile WordPress Plugin)
- [CVE-2025-6040](https://cve.now/CVE-2025-6040.md): Easy Flashcards \<= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, sagesony Easy Flashcards)
- [CVE-2025-4216](https://cve.now/CVE-2025-4216.md): DIOT SCADA with MQTT \<= 1.0.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, DIOT SCADA with MQTT)
- [CVE-2025-6064](https://cve.now/CVE-2025-6064.md): WP URL Shortener \<= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, djerba WP URL Shortener)
- [CVE-2025-6065](https://cve.now/CVE-2025-6065.md): Image Resizer On The Fly \<= 1.1 - Unauthenticated Arbitrary File Deletion (CVSS 9.1, wework4web Image Resizer On The Fly)
- [CVE-2025-5487](https://cve.now/CVE-2025-5487.md): AutomatorWP \<= 5.2.5 - Authenticated (Administrator+) SQL Injection via field\_conditions (CVSS 7.2, rubengc AutomatorWP – Automator plugin for no-code automati…)
- [CVE-2025-3234](https://cve.now/CVE-2025-3234.md): File Manager Pro – Filester \<= 1.8.8 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2, ninjateam File Manager Pro – Filester)
- [CVE-2025-6059](https://cve.now/CVE-2025-6059.md): Seraphinite Accelerator \<= 2.27.21 - Cross-Site Request Forgery to Multiple Administrative Actions (CVSS 4.3, seraphinitesoft Seraphinite Accelerator)
- [CVE-2025-33108](https://cve.now/CVE-2025-33108.md): IBM Backup Recovery and Media Services for i code execution (CVSS 8.5, IBM Backup Recovery and Media Services for i)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.