# CVEs published 2025-07-04

186 CVEs were published on July 4, 2025: 18 critical, 75 high. Days are UTC.

- [CVE-2025-48952](https://cve.now/CVE-2025-48952.md): NetAlertX has Password Bypass Vulnerability due to Loose Comparison in PHP (CVSS 9.4, jokob-sk NetAlertX)
- [CVE-2025-53366](https://cve.now/CVE-2025-53366.md): MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service (CVSS 8.7, modelcontextprotocol python-sdk · mcp)
- [CVE-2025-53365](https://cve.now/CVE-2025-53365.md): MCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of Service (CVSS 8.7, modelcontextprotocol python-sdk · mcp)
- [CVE-2025-7070](https://cve.now/CVE-2025-7070.md): IROAD Dashcam Q9 MFA Pairing Request allocation of resources (CVSS 5.3, IROAD Dashcam Q9)
- [CVE-2025-7069](https://cve.now/CVE-2025-7069.md): HDF5 H5FSsection.c H5FS\_\_sect\_link\_size heap-based overflow (CVSS 4.8, HDF5)
- [CVE-2025-7068](https://cve.now/CVE-2025-7068.md): HDF5 H5FL.c H5FL\_\_malloc memory leak (CVSS 4.8, HDF5)
- [CVE-2025-7067](https://cve.now/CVE-2025-7067.md): HDF5 H5FScache.c H5FS\_\_sinfo\_serialize\_node\_cb heap-based overflow (CVSS 4.8, HDF5)
- [CVE-2025-53485](https://cve.now/CVE-2025-53485.md): SecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changes (CVSS 7.5, Wikimedia Foundation Mediawiki - SecurePoll extension)
- [CVE-2025-53484](https://cve.now/CVE-2025-53484.md): SecurePoll: Multiple locations vulnerable to Cross-Site Scripting (XSS) via unescaped input (CVSS 9.8, Wikimedia Foundation Mediawiki - SecurePoll extension)
- [CVE-2025-53483](https://cve.now/CVE-2025-53483.md): SecurePoll: Multiple admin actions vulnerable to Cross-Site Request Forgery (CVSS 8.8, Wikimedia Foundation Mediawiki - SecurePoll extension)
- [CVE-2025-53482](https://cve.now/CVE-2025-53482.md): IPInfo: Message key XSS through several IPInfo messages in infobox and popup (CVSS 6.1, Wikimedia Foundation Mediawiki - IPInfo Extension)
- [CVE-2025-53481](https://cve.now/CVE-2025-53481.md): Denial of service vector on ipinfo/v0/norevision (CVSS 7.5, Wikimedia Foundation Mediawiki - IPInfo Extension)
- [CVE-2025-38234](https://cve.now/CVE-2025-38234.md): sched/rt: Fix race in push\_rt\_task (CVSS 7.8, Linux)
- [CVE-2025-38233](https://cve.now/CVE-2025-38233.md): powerpc64/ftrace: fix clobbered r15 during livepatching (CVSS 7.8, Linux)
- [CVE-2025-38232](https://cve.now/CVE-2025-38232.md): NFSD: fix race between nfsd registration and exports\_proc (CVSS 7.8, Linux)
- [CVE-2025-38231](https://cve.now/CVE-2025-38231.md): nfsd: Initialize ssc before laundromat\_work to prevent NULL dereference (no CVSS, Linux)
- [CVE-2025-38230](https://cve.now/CVE-2025-38230.md): jfs: validate AG parameters in dbMount() to prevent crashes (CVSS 7.8, Linux)
- [CVE-2025-38229](https://cve.now/CVE-2025-38229.md): media: cxusb: no longer judge rbuf when the write fails (no CVSS, Linux)
- [CVE-2025-38228](https://cve.now/CVE-2025-38228.md): media: imagination: fix a potential memory leak in e5010\_probe() (no CVSS, Linux)
- [CVE-2025-38227](https://cve.now/CVE-2025-38227.md): media: vidtv: Terminating the subsequent process of initialization failure (CVSS 7.8, Linux)
- [CVE-2025-38226](https://cve.now/CVE-2025-38226.md): media: vivid: Change the siize of the composing (CVSS 7.8, Linux)
- [CVE-2025-38225](https://cve.now/CVE-2025-38225.md): media: imx-jpeg: Cleanup after an allocation error (no CVSS, Linux)
- [CVE-2025-38224](https://cve.now/CVE-2025-38224.md): can: kvaser\_pciefd: refine error prone echo\_skb\_max handling logic (CVSS 7.8, Linux)
- [CVE-2025-38223](https://cve.now/CVE-2025-38223.md): ceph: avoid kernel BUG for encrypted inode with unaligned file size (no CVSS, Linux)
- [CVE-2025-38222](https://cve.now/CVE-2025-38222.md): ext4: inline: fix len overflow in ext4\_prepare\_inline\_data (no CVSS, Linux)
- [CVE-2025-38221](https://cve.now/CVE-2025-38221.md): ext4: fix out of bounds punch offset (no CVSS, Linux)
- [CVE-2025-38220](https://cve.now/CVE-2025-38220.md): ext4: only dirty folios when data journaling regular files (no CVSS, Linux)
- [CVE-2025-38219](https://cve.now/CVE-2025-38219.md): f2fs: prevent kernel warning due to negative i\_nlink from corrupted image (no CVSS, Linux)
- [CVE-2025-38218](https://cve.now/CVE-2025-38218.md): f2fs: fix to do sanity check on sit\_bitmap\_size (CVSS 7.8, Linux)
- [CVE-2025-38217](https://cve.now/CVE-2025-38217.md): hwmon: (ftsteutates) Fix TOCTOU race in fts\_read() (no CVSS, Linux)
- [CVE-2025-38216](https://cve.now/CVE-2025-38216.md): iommu/vt-d: Restore context entry setup order for aliased devices (CVSS 8.8, Linux)
- [CVE-2025-38215](https://cve.now/CVE-2025-38215.md): fbdev: Fix do\_register\_framebuffer to prevent null-ptr-deref in fb\_videomode\_to\_var (no CVSS, Linux)
- [CVE-2025-38214](https://cve.now/CVE-2025-38214.md): fbdev: Fix fb\_set\_var to prevent null-ptr-deref in fb\_videomode\_to\_var (no CVSS, Linux)
- [CVE-2025-38212](https://cve.now/CVE-2025-38212.md): ipc: fix to protect IPCS lookups using RCU (CVSS 7.8, Linux)
- [CVE-2025-38211](https://cve.now/CVE-2025-38211.md): RDMA/iwcm: Fix use-after-free of work objects after cm\_id destruction (CVSS 9.8, Linux)
- [CVE-2025-38210](https://cve.now/CVE-2025-38210.md): configfs-tsm-report: Fix NULL dereference of tsm\_ops (no CVSS, Linux)
- [CVE-2025-38209](https://cve.now/CVE-2025-38209.md): nvme-tcp: remove tag set when second admin queue config fails (CVSS 9.8, Linux)
- [CVE-2025-38208](https://cve.now/CVE-2025-38208.md): smb: client: add NULL check in automount\_fullpath (no CVSS, Linux)
- [CVE-2025-38207](https://cve.now/CVE-2025-38207.md): mm: fix uprobe pte be overwritten when expanding vma (no CVSS, Linux)
- [CVE-2025-38206](https://cve.now/CVE-2025-38206.md): exfat: fix double free in delayed\_free (CVSS 7.8, Linux)
- [CVE-2025-38205](https://cve.now/CVE-2025-38205.md): drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (no CVSS, Linux)
- [CVE-2025-38204](https://cve.now/CVE-2025-38204.md): jfs: fix array-index-out-of-bounds read in add\_missing\_indices (CVSS 7.8, Linux)
- [CVE-2025-38203](https://cve.now/CVE-2025-38203.md): jfs: Fix null-ptr-deref in jfs\_ioc\_trim (no CVSS, Linux)
- [CVE-2025-38202](https://cve.now/CVE-2025-38202.md): bpf: Check rcu\_read\_lock\_trace\_held() in bpf\_map\_lookup\_percpu\_elem() (no CVSS, Linux)
- [CVE-2025-38201](https://cve.now/CVE-2025-38201.md): netfilter: nft\_set\_pipapo: clamp maximum map bucket size to INT\_MAX (no CVSS, Linux)
- [CVE-2025-38200](https://cve.now/CVE-2025-38200.md): i40e: fix MMIO write access to an invalid page in i40e\_clear\_hw (no CVSS, Linux)
- [CVE-2025-38199](https://cve.now/CVE-2025-38199.md): wifi: ath12k: Fix memory leak due to multiple rx\_stats allocation (no CVSS, Linux)
- [CVE-2025-38198](https://cve.now/CVE-2025-38198.md): fbcon: Make sure modelist not set on unregistered console (no CVSS, Linux)
- [CVE-2025-38197](https://cve.now/CVE-2025-38197.md): platform/x86: dell\_rbu: Fix list usage (CVSS 7.3, Linux)
- [CVE-2025-38196](https://cve.now/CVE-2025-38196.md): io\_uring/rsrc: validate buffer count with offset for cloning (no CVSS, Linux)
- [CVE-2025-38195](https://cve.now/CVE-2025-38195.md): LoongArch: Fix panic caused by NULL-PMD in huge\_pte\_offset() (no CVSS, Linux)
- [CVE-2025-38194](https://cve.now/CVE-2025-38194.md): jffs2: check that raw node were preallocated before writing summary (no CVSS, Linux)
- [CVE-2025-38193](https://cve.now/CVE-2025-38193.md): net\_sched: sch\_sfq: reject invalid perturb period (CVSS 7.8, Linux)
- [CVE-2025-38192](https://cve.now/CVE-2025-38192.md): net: clear the dst when changing skb protocol (CVSS 7.8, Linux)
- [CVE-2025-38191](https://cve.now/CVE-2025-38191.md): ksmbd: fix null pointer dereference in destroy\_previous\_session (CVSS 7.5, Linux)
- [CVE-2025-38190](https://cve.now/CVE-2025-38190.md): atm: Revert atm\_account\_tx() if copy\_from\_iter\_full() fails. (no CVSS, Linux)
- [CVE-2025-38189](https://cve.now/CVE-2025-38189.md): drm/v3d: Avoid NULL pointer dereference in \`v3d\_job\_update\_stats()\` (CVSS 7.8, Linux)
- [CVE-2025-38188](https://cve.now/CVE-2025-38188.md): drm/msm/a7xx: Call CP\_RESET\_CONTEXT\_STATE (no CVSS, Linux)
- [CVE-2025-38187](https://cve.now/CVE-2025-38187.md): drm/nouveau: fix a use-after-free in r535\_gsp\_rpc\_push() (CVSS 7.8, Linux)
- [CVE-2025-38186](https://cve.now/CVE-2025-38186.md): bnxt\_en: Fix double invocation of bnxt\_ulp\_stop()/bnxt\_ulp\_start() (no CVSS, Linux)
- [CVE-2025-38185](https://cve.now/CVE-2025-38185.md): atm: atmtcp: Free invalid length skb in atmtcp\_c\_send(). (no CVSS, Linux)
- [CVE-2025-38184](https://cve.now/CVE-2025-38184.md): tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (CVSS 7.8, Linux)
- [CVE-2025-38183](https://cve.now/CVE-2025-38183.md): net: lan743x: fix potential out-of-bounds write in lan743x\_ptp\_io\_event\_clock\_get() (no CVSS, Linux)
- [CVE-2025-38182](https://cve.now/CVE-2025-38182.md): ublk: santizize the arguments from userspace when adding a device (no CVSS, Linux)
- [CVE-2025-38181](https://cve.now/CVE-2025-38181.md): calipso: Fix null-ptr-deref in calipso\_req\_{set,del}attr(). (CVSS 7.5, Linux)
- [CVE-2025-38180](https://cve.now/CVE-2025-38180.md): net: atm: fix /proc/net/atm/lec handling (CVSS 7.8, Linux)
- [CVE-2025-38179](https://cve.now/CVE-2025-38179.md): smb: client: fix max\_sge overflow in smb\_extract\_folioq\_to\_rdma() (CVSS 7.8, Linux)
- [CVE-2025-46733](https://cve.now/CVE-2025-46733.md): REE userspace code can panic TAs, leading to fTPM PCR reset and data disclosure (CVSS 7.9, OP-TEE optee\_os)
- [CVE-2025-38177](https://cve.now/CVE-2025-38177.md): sch\_hfsc: make hfsc\_qlen\_notify() idempotent (CVSS 7.8, Linux)
- [CVE-2025-7061](https://cve.now/CVE-2025-7061.md): Intelbras InControl operador csv injection (CVSS 5.1, Intelbras InControl)
- [CVE-2025-7066](https://cve.now/CVE-2025-7066.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau (CVSS 6.1, Jirafeau project Jirafeau)
- [CVE-2025-6056](https://cve.now/CVE-2025-6056.md): Timing difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2.4 and 8.3.1 allows unauthenticated attacke (CVSS 6.9, Ergon Informatik AG Airlock IAM)
- [CVE-2025-6740](https://cve.now/CVE-2025-6740.md): Contact Form 7 Database Addon \<= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via tmpD Parameter (CVSS 6.1, arshidkv12 Database Addon for Contact Form 7 – CFDB7)
- [CVE-2025-23970](https://cve.now/CVE-2025-23970.md): WordPress Service Finder Booking plugin \<= 6.1 - Privilege Escalation Vulnerability (CVSS 9.8, aonetheme Service Finder Booking)
- [CVE-2025-24771](https://cve.now/CVE-2025-24771.md): WordPress Content Manager Light plugin \<= 3.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, OTWthemes Content Manager Light)
- [CVE-2025-24780](https://cve.now/CVE-2025-24780.md): WordPress Printcart Web to Print Product Designer for WooCommerce plugin \<= 2.4.0 - SQL Injection Vulnerability (CVSS 8.5, Printcart Web to Print Product Designer for WooCommerce)
- [CVE-2025-28968](https://cve.now/CVE-2025-28968.md): WordPress WP Wall plugin \<= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Vladimir Prelovac WP Wall)
- [CVE-2025-28976](https://cve.now/CVE-2025-28976.md): WordPress Email Address Security by WebEmailProtector plugin \<= 3.3.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, dsrodzin Email Address Security by WebEmailProtector)
- [CVE-2025-28978](https://cve.now/CVE-2025-28978.md): WordPress SB Breadcrumbs plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Hung Trang Si SB Breadcrumbs)
- [CVE-2025-28980](https://cve.now/CVE-2025-28980.md): WordPress Aviation Weather from NOAA plugin \<= 0.7.2 - Arbitrary File Deletion Vulnerability (CVSS 7.7, machouinard Aviation Weather from NOAA)
- [CVE-2025-28983](https://cve.now/CVE-2025-28983.md): WordPress Click & Pledge Connect plugin \<= 25.04010101-WP6.8 - Privilege Escalation via SQL Injection vulnerability (CVSS 9.8, ClickandPledge Click & Pledge Connect)
- [CVE-2025-30933](https://cve.now/CVE-2025-30933.md): WordPress LogisticsHub theme \<= 1.1.6 - Arbitrary File Upload Vulnerability (CVSS 10.0, LiquidThemes LogisticsHub)
- [CVE-2025-31037](https://cve.now/CVE-2025-31037.md): WordPress Homey theme \<= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, favethemes Homey)
- [CVE-2025-32297](https://cve.now/CVE-2025-32297.md): WordPress Simple Link Directory Pro plugin \< 14.8.1 - SQL Injection Vulnerability (CVSS 8.5, quantumcloud Simple Link Directory)
- [CVE-2025-32311](https://cve.now/CVE-2025-32311.md): WordPress Pressroom theme \<= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, QuanticaLabs Pressroom)
- [CVE-2025-39487](https://cve.now/CVE-2025-39487.md): WordPress Rankie plugin \<= 1.8.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ValvePress Rankie)
- [CVE-2025-47479](https://cve.now/CVE-2025-47479.md): WordPress WP Compress plugin \<= 6.30.30 - Broken Authentication Vulnerability (CVSS 5.3, AresIT WP Compress)
- [CVE-2025-47565](https://cve.now/CVE-2025-47565.md): WordPress EventON plugin \<= 4.9.9 - Broken Access Control vulnerability (CVSS 6.3, ashanjay EventON)
- [CVE-2025-47627](https://cve.now/CVE-2025-47627.md): WordPress PrivateContent - Mail Actions plugin \<= 2.3.2 - Local File Inclusion vulnerability (CVSS 7.5, LCweb PrivateContent - Mail Actions)
- [CVE-2025-47634](https://cve.now/CVE-2025-47634.md): WordPress WC Pickup Store plugin \<= 1.8.9 - Settings Change Vulnerability (CVSS 6.5, Keylor Mendoza WC Pickup Store)
- [CVE-2025-48231](https://cve.now/CVE-2025-48231.md): WordPress Booking Calendar Contact Form plugin \<= 1.2.58 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, codepeople Booking Calendar Contact Form)
- [CVE-2025-49245](https://cve.now/CVE-2025-49245.md): WordPress Testimonials Showcase plugin \<= 1.9.16 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, cmoreira Testimonials Showcase)
- [CVE-2025-49247](https://cve.now/CVE-2025-49247.md): WordPress Team Showcase plugin \< 25.05.13 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, cmoreira Team Showcase)
- [CVE-2025-49274](https://cve.now/CVE-2025-49274.md): WordPress Neom Blog theme \<= 0.0.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, awordpresslife Neom Blog)
- [CVE-2025-49302](https://cve.now/CVE-2025-49302.md): WordPress Easy Stripe plugin \<= 1.1 - Remote Code Execution (RCE) Vulnerability (CVSS 10.0, Scott Paterson Easy Stripe)
- [CVE-2025-49303](https://cve.now/CVE-2025-49303.md): WordPress Frontend Admin by DynamiApps plugin \<= 3.28.7 - Arbitrary File Download Vulnerability (CVSS 6.8, Shabti Kaplan Frontend Admin by DynamiApps)
- [CVE-2025-49866](https://cve.now/CVE-2025-49866.md): WordPress Beautiful Cookie Consent Banner plugin \<= 4.6.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Nikel Beautiful Cookie Consent Banner)
- [CVE-2025-49867](https://cve.now/CVE-2025-49867.md): WordPress RealHomes theme \<= 4.4.0 - Privilege Escalation vulnerability (CVSS 9.8, InspiryThemes RealHomes)
- [CVE-2025-49870](https://cve.now/CVE-2025-49870.md): WordPress Paid Member Subscriptions plugin \<= 2.15.1 - SQL Injection Vulnerability (CVSS 7.5, Cozmoslabs Paid Member Subscriptions)
- [CVE-2025-50032](https://cve.now/CVE-2025-50032.md): WordPress Paytiko for WooCommerce plugin \<= 1.3.21 - Broken Access Control vulnerability (CVSS 6.5, Paytiko - Payment Orchestration Platform Paytiko for WooCom…)
- [CVE-2025-50039](https://cve.now/CVE-2025-50039.md): WordPress VG WORT METIS plugin \<= 2.0.1 - Broken Access Control Vulnerability (CVSS 6.5, vgwort VG WORT METIS)
- [CVE-2025-52718](https://cve.now/CVE-2025-52718.md): WordPress Alone theme \<= 7.8.2 - Arbitrary Code Execution Vulnerability (CVSS 7.2, Beplusthemes Alone)
- [CVE-2025-52776](https://cve.now/CVE-2025-52776.md): WordPress Video List Manager plugin \<= 1.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, thanhtungtnt Video List Manager)
- [CVE-2025-52796](https://cve.now/CVE-2025-52796.md): WordPress WP-Recall \<= 16.26.14 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, tggfref WP-Recall)
- [CVE-2025-52798](https://cve.now/CVE-2025-52798.md): WordPress JobSearch plugin \< 3.0.6 - Reflected Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, eyecix JobSearch)
- [CVE-2025-52805](https://cve.now/CVE-2025-52805.md): WordPress Leyka plugin \<= 3.32.1 - Local File Inclusion vulnerability (CVSS 7.5, VaultDweller Leyka)
- [CVE-2025-52807](https://cve.now/CVE-2025-52807.md): WordPress Kossy - Minimalist eCommerce WordPress Theme \<= 1.45 - Local File Inclusion Vulnerability (CVSS 8.1, ApusWP Kossy - Minimalist eCommerce WordPress Theme)
- [CVE-2025-52813](https://cve.now/CVE-2025-52813.md): WordPress MobiLoud \<= 4.6.5 - Broken Access Control Vulnerability (CVSS 8.1, pietro MobiLoud)
- [CVE-2025-52828](https://cve.now/CVE-2025-52828.md): WordPress Red Art theme \<= 3.8 - PHP Object Injection Vulnerability (CVSS 8.8, designthemes Red Art)
- [CVE-2025-52830](https://cve.now/CVE-2025-52830.md): WordPress bSecure – Your Universal Checkout plugin \<= 1.7.9 - SQL Injection Vulnerability (CVSS 9.3, bSecure – Your Universal Checkout)
- [CVE-2025-52831](https://cve.now/CVE-2025-52831.md): WordPress Video List Manager plugin \<= 1.7 - SQL Injection Vulnerability (CVSS 9.3, thanhtungtnt Video List Manager)
- [CVE-2025-52832](https://cve.now/CVE-2025-52832.md): WordPress NGG Smart Image Search plugin \<= 3.4.1 - SQL Injection Vulnerability (CVSS 9.3, wpo-HR NGG Smart Image Search)
- [CVE-2025-52833](https://cve.now/CVE-2025-52833.md): WordPress LMS theme \<= 9.2 - SQL Injection Vulnerability (CVSS 9.3, designthemes LMS)
- [CVE-2025-4414](https://cve.now/CVE-2025-4414.md): WordPress CMSMasters Content Composer plugin \< 2.5.7 - Local File Inclusion vulnerability (CVSS 8.1, CMSMasters Content Composer)
- [CVE-2025-49070](https://cve.now/CVE-2025-49070.md): WordPress Elessi \< 6.4.1 - Local File Inclusion Vulnerability (CVSS 7.5, NasaTheme Elessi)
- [CVE-2025-49414](https://cve.now/CVE-2025-49414.md): WordPress FW Gallery plugin \<= 8.0.0 - Arbitrary File Upload Vulnerability (CVSS 10.0, Fastw3b FW Gallery)
- [CVE-2025-49417](https://cve.now/CVE-2025-49417.md): WordPress WooCommerce Product Multi-Action plugin \<= 1.3 - Deserialization of untrusted data Vulnerability (CVSS 9.8, BestWpDeveloper WooCommerce Product Multi-Action)
- [CVE-2025-49418](https://cve.now/CVE-2025-49418.md): WordPress Allmart plugin \<= 1.0.0 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 7.2, TeconceTheme Allmart)
- [CVE-2025-49431](https://cve.now/CVE-2025-49431.md): WordPress MF Plus WPML plugin \<= 1.1 - Settings Change Vulnerability (CVSS 6.5, Gnuget MF Plus WPML)
- [CVE-2025-7060](https://cve.now/CVE-2025-7060.md): Monitorr Installer mkdbajax.php input validation (CVSS 2.1, Monitorr)
- [CVE-2025-38176](https://cve.now/CVE-2025-38176.md): binder: fix use-after-free in binderfs\_evict\_inode() (CVSS 7.8, Linux)
- [CVE-2025-38175](https://cve.now/CVE-2025-38175.md): binder: fix yet another UAF in binder\_devices (CVSS 7.8, Linux)
- [CVE-2025-38174](https://cve.now/CVE-2025-38174.md): thunderbolt: Do not double dequeue a configuration request (CVSS 8.8, Linux)
- [CVE-2025-5920](https://cve.now/CVE-2025-5920.md): Sharable Password Protected Posts \< 1.1.1 - Unauthenticated Password Protect Post Access (CVSS 7.5, Sharable Password Protected Posts)
- [CVE-2025-30983](https://cve.now/CVE-2025-30983.md): WordPress Card flip image slideshow plugin \<= 1.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, gopiplus Card flip image slideshow)
- [CVE-2025-30979](https://cve.now/CVE-2025-30979.md): WordPress Pixelating image slideshow gallery plugin \<= 8.0 - SQL Injection Vulnerability (CVSS 8.5, gopiplus Pixelating image slideshow gallery)
- [CVE-2025-30969](https://cve.now/CVE-2025-30969.md): WordPress iFrame Images Gallery plugin \<= 9.0 - SQL Injection Vulnerability (CVSS 8.5, gopiplus iFrame Images Gallery)
- [CVE-2025-30947](https://cve.now/CVE-2025-30947.md): WordPress Cool fade popup plugin \<= 10.1 - SQL Injection Vulnerability (CVSS 8.5, gopiplus Cool fade popup)
- [CVE-2025-30943](https://cve.now/CVE-2025-30943.md): WordPress Posts Slider Shortcode plugin \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Aakif Kadiwala Posts Slider Shortcode)
- [CVE-2025-30929](https://cve.now/CVE-2025-30929.md): WordPress fluXtore plugin \<= 1.6.0 - Broken Access Control vulnerability (CVSS 5.3, amazewp fluXtore)
- [CVE-2025-29012](https://cve.now/CVE-2025-29012.md): WordPress CF7 7 Mailchimp Add-on plugin \< 2.4 - Broken Access Control Vulnerability (CVSS 5.3, kamleshyadav CF7 7 Mailchimp Add-on)
- [CVE-2025-29007](https://cve.now/CVE-2025-29007.md): WordPress LMSACE Connect plugin \<= 3.4 - Broken Access Control Vulnerability (CVSS 4.3, LMSACE Connect)
- [CVE-2025-29001](https://cve.now/CVE-2025-29001.md): WordPress WooCommerce Shop Page Builder plugin \<= 2.27.7 - Broken Access Control Vulnerability (CVSS 4.3, ZoomIt WooCommerce Shop Page Builder)
- [CVE-2025-28971](https://cve.now/CVE-2025-28971.md): WordPress Easy Elements Hider plugin \<= 2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, CWD Web Designer Easy Elements Hider)
- [CVE-2025-28969](https://cve.now/CVE-2025-28969.md): WordPress Gallery Widget plugin \<= 1.2.1 - SQL Injection Vulnerability (CVSS 8.5, cybio Gallery Widget)
- [CVE-2025-28967](https://cve.now/CVE-2025-28967.md): WordPress Contact Us page - Contact people LITE plugin \<= 3.7.4 - SQL Injection Vulnerability (CVSS 8.5, Steve Truman Contact Us page - Contact people LITE)
- [CVE-2025-28963](https://cve.now/CVE-2025-28963.md): WordPress URL Shortener plugin \<= 3.0.7 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 5.4, Md Yeasin Ul Haider URL Shortener)
- [CVE-2025-28957](https://cve.now/CVE-2025-28957.md): WordPress OwnerRez API plugin \<= 1.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, OwnerRez API)
- [CVE-2025-28951](https://cve.now/CVE-2025-28951.md): WordPress Bulk Featured Image plugin \<= 1.2.4 - Arbitrary File Upload vulnerability (CVSS 9.1, CreedAlly Bulk Featured Image)
- [CVE-2025-27358](https://cve.now/CVE-2025-27358.md): WordPress Frontend File Manager plugin \<= 23.6 - Content Injection vulnerability (CVSS 4.6, N-Media Frontend File Manager)
- [CVE-2025-27326](https://cve.now/CVE-2025-27326.md): WordPress Video Gallery Block plugin \<= 1.1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, bPlugins Video Gallery Block)
- [CVE-2025-26591](https://cve.now/CVE-2025-26591.md): WordPress WP fancybox plugin \<= 1.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Noor Alam WP fancybox)
- [CVE-2025-24764](https://cve.now/CVE-2025-24764.md): WordPress (Simply) Guest Author Name plugin \<= 4.36 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, A. Jones (Simply) Guest Author Name)
- [CVE-2025-24757](https://cve.now/CVE-2025-24757.md): WordPress uDesign theme \<= 4.11.2 - Broken Access Control vulnerability (CVSS 5.3, AndonDesign uDesign)
- [CVE-2025-24748](https://cve.now/CVE-2025-24748.md): WordPress Avada theme \<= 7.11.10 - Broken Access Control vulnerability (CVSS 5.3, ThemeFusion Avada)
- [CVE-2025-24735](https://cve.now/CVE-2025-24735.md): WordPress Chatra Live Chat + ChatBot + Cart Saver plugin \<= 1.0.11 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.7, Chatra Live Chat + ChatBot + Cart Saver)
- [CVE-2025-23972](https://cve.now/CVE-2025-23972.md): WordPress Contact Form 7 reCAPTCHA plugin \<= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Brian S. Reed Contact Form 7 reCAPTCHA)
- [CVE-2025-53569](https://cve.now/CVE-2025-53569.md): WordPress Trust Payments Gateway for WooCommerce (JavaScript Library) plugin \<= 1.3.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Trust Payments Gateway for WooCommerce)
- [CVE-2025-53568](https://cve.now/CVE-2025-53568.md): WordPress Radio Station plugin \<= 2.5.12 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Tony Zeoli Radio Station)
- [CVE-2025-53566](https://cve.now/CVE-2025-53566.md): WordPress WP Visitor Statistics (Real Time Traffic) plugin \<= 7.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, osama.esh WP Visitor Statistics)
- [CVE-2024-9453](https://cve.now/CVE-2024-9453.md): Jenkins-image: sensitive data disclosure when using openshift jenkins image (CVSS 6.5, Jenkins openshift-sync-plugin · Red Hat OpenShift Developer…)
- [CVE-2025-5351](https://cve.now/CVE-2025-5351.md): Libssh: double free vulnerability in libssh key export functions (CVSS 6.5, libssh · Red Hat Enterprise Linux +1)
- [CVE-2025-32918](https://cve.now/CVE-2025-32918.md): Livestatus injection in autocomplete endpoint (CVSS 5.3, Checkmk)
- [CVE-2025-6673](https://cve.now/CVE-2025-6673.md): Easy restaurant menu manager \<= 2.0.1 - Authenticated (Contributot+) Stored Cross-Site Scripting via \`nsc\_eprm\_menu\_link\` Shortcode (CVSS 6.4, nikelschubert Easy restaurant menu manager)
- [CVE-2024-11937](https://cve.now/CVE-2024-11937.md): Premium Addons for Elementor \<= 4.10.69 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2025-53600](https://cve.now/CVE-2025-53600.md): Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment. (CVSS 7.5, NAVER Whale browser)
- [CVE-2025-53599](https://cve.now/CVE-2025-53599.md): Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme. (CVSS 9.8, NAVER Whale browser)
- [CVE-2025-5372](https://cve.now/CVE-2025-5372.md): Libssh: incorrect return code handling in ssh\_kdf() in libssh (CVSS 5.0, libssh · Red Hat Enterprise Linux +1)
- [CVE-2025-6944](https://cve.now/CVE-2025-6944.md): Uncode Core \<= 2.9.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes (CVSS 6.4, undsgn Uncode Core)
- [CVE-2025-5567](https://cve.now/CVE-2025-5567.md): Shortcodes Ultimate \<= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute (CVSS 6.4, gn\_themes WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2025-7053](https://cve.now/CVE-2025-7053.md): Cockpit save cross site scripting (CVSS 5.1, Cockpit · cockpit-hq/cockpit)
- [CVE-2025-6039](https://cve.now/CVE-2025-6039.md): ProcessingJS for WordPress \<= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, cageehv ProcessingJS for WordPress)
- [CVE-2025-6782](https://cve.now/CVE-2025-6782.md): GoZen Forms \<= 1.1.5 - Unauthenticated SQL Injection via dirGZActiveForm() (CVSS 7.5, optinlyhq GoZen Forms)
- [CVE-2025-5924](https://cve.now/CVE-2025-5924.md): WP Firebase Push Notification \<= 1.2.0 - Cross-Site Request Forgery to Broadcast Notification (CVSS 4.3, skywaveinfo WP Firebase Push Notification)
- [CVE-2025-6783](https://cve.now/CVE-2025-6783.md): GoZen Forms \<= 1.1.5 - Unauthenticated SQL Injection via emdedSc() (CVSS 7.5, optinlyhq GoZen Forms)
- [CVE-2025-6787](https://cve.now/CVE-2025-6787.md): Smart Docs \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ibachal Smart Docs)
- [CVE-2025-6814](https://cve.now/CVE-2025-6814.md): Booking X 1.0 - 1.1.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via export\_now() Function (CVSS 7.5, dunskii Booking X – Appointment and Reservation Availabilit…)
- [CVE-2025-5953](https://cve.now/CVE-2025-5953.md): WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation via wp\_ajax\_hrm\_insert\_employee AJAX Action (CVSS 8.8, asaquzzaman WP Human Resource Management)
- [CVE-2025-6586](https://cve.now/CVE-2025-6586.md): Download Plugin \<= 2.2.8 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2, metagauss Download Plugin)
- [CVE-2025-6729](https://cve.now/CVE-2025-6729.md): PayMaster for WooCommerce \<= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgery (CVSS 6.4, qazomardok PayMaster for WooCommerce)
- [CVE-2025-5956](https://cve.now/CVE-2025-5956.md): WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Arbitrary User Deletion via ajax\_delete\_employee Function (CVSS 6.5, asaquzzaman WP Human Resource Management)
- [CVE-2025-6238](https://cve.now/CVE-2025-6238.md): AI Engine 2.8.4 - Insecure OAuth Implementation (CVSS 8.0, tigroumeow AI Engine)
- [CVE-2025-6041](https://cve.now/CVE-2025-6041.md): yContributors \<= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, yonisink yContributors)
- [CVE-2025-6739](https://cve.now/CVE-2025-6739.md): WPQuiz \<= 0.4.2 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, bauc WPQuiz)
- [CVE-2025-7046](https://cve.now/CVE-2025-7046.md): Portfolio for Elementor & Image Gallery | PowerFolio \<= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS (CVSS 6.4, dotrex PowerFolio – Portfolio & Image Gallery for Elementor)
- [CVE-2025-5933](https://cve.now/CVE-2025-5933.md): RD Contacto \<= 1.4 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, richarddev7 RD Contacto)
- [CVE-2025-6786](https://cve.now/CVE-2025-6786.md): DocCheck Login \<= 1.1.5 - Unauthorized Post Access (CVSS 5.3, antwerpes DocCheck Login)
- [CVE-2025-26850](https://cve.now/CVE-2025-26850.md): The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation (CVSS 9.3, Quest KACE Systems Management Appliance)
- [CVE-2025-43711](https://cve.now/CVE-2025-43711.md): Tunnelblick 3.5beta06 before 7.0, when incompletely uninstalled, allows attackers to execute arbitrary code as root (upon the next boot) by (CVSS 8.1, Tunnelblick Project Tunnelblick)
- [CVE-2025-48172](https://cve.now/CVE-2025-48172.md): CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm\_lib.c \_chm\_decompress\_block integer overflow. (CVSS 5.6, CHMLib)
- [CVE-2025-49600](https://cve.now/CVE-2025-49600.md): In MbedTLS 3.3.0 before 3.6.4, mbedtls\_lms\_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, (CVSS 4.9, mbedtls)
- [CVE-2025-49601](https://cve.now/CVE-2025-49601.md): In MbedTLS 3.3.0 before 3.6.4, mbedtls\_lms\_import\_public\_key does not check that the input buffer is at least 4 bytes before reading a 32-bi (CVSS 4.8, mbedtls)
- [CVE-2025-49809](https://cve.now/CVE-2025-49809.md): mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR\_PACKET environment variable. (CVSS 7.8, mtr)
- [CVE-2025-52496](https://cve.now/CVE-2025-52496.md): Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. (CVSS 7.8, mbedtls)
- [CVE-2025-52497](https://cve.now/CVE-2025-52497.md): Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls\_pem\_read\_buffer and two mbedtls\_pk\_parse functions, (CVSS 4.8, mbedtls)
- [CVE-2025-53602](https://cve.now/CVE-2025-53602.md): Zipkin through 3.5.1 has a /heapdump endpoint (associated with the use of Spring Boot Actuator), a similar issue to CVE-2025-48927. (CVSS 5.3, Open Zipkin Zipkin · io.zipkin:zipkin-server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.