# CVEs published 2025-08-28

192 CVEs were published on August 28, 2025: 16 critical, 66 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-9596](https://cve.now/CVE-2025-9596.md): itsourcecode Sports Management System login.php sql injection (CVSS 6.9, itsourcecode Sports Management System)
- [CVE-2025-9595](https://cve.now/CVE-2025-9595.md): code-projects Student Information Management System login.php cross site scripting (CVSS 5.3, code-projects Student Information Management System)
- [CVE-2025-48979](https://cve.now/CVE-2025-48979.md): An Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privileges and local access. (CVSS 3.4, Ubiquiti UISP Application)
- [CVE-2025-9594](https://cve.now/CVE-2025-9594.md): itsourcecode Apartment Management System complain\_info.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2025-9593](https://cve.now/CVE-2025-9593.md): itsourcecode Apartment Management System unit\_status\_info.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2025-58062](https://cve.now/CVE-2025-58062.md): LSTM-Kirigaya's openmcp-client Vulnerable to RCE in MCP Authorization Flow (CVSS 7.3, LSTM-Kirigaya openmcp-client)
- [CVE-2025-58061](https://cve.now/CVE-2025-58061.md): OpenEBS Local PV RawFile persistent volume data is world readable (CVSS 5.5, openebs rawfile-localpv)
- [CVE-2025-9592](https://cve.now/CVE-2025-9592.md): itsourcecode Apartment Management System bill\_info.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2025-9591](https://cve.now/CVE-2025-9591.md): ZrLog Theme Configuration Form config cross site scripting (CVSS 4.8, ZrLog)
- [CVE-2025-58058](https://cve.now/CVE-2025-58058.md): github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives (CVSS 5.3, ulikunitz xz · github.com/ulikunitz/xz)
- [CVE-2025-9590](https://cve.now/CVE-2025-9590.md): Weaver E-Mobile Mobile Management Platform cross site scripting (CVSS 5.1, Weaver E-Mobile Mobile Management Platform)
- [CVE-2025-9589](https://cve.now/CVE-2025-9589.md): Cudy WR1200EA shadow default password (CVSS 2.0, Cudy WR1200EA)
- [CVE-2025-9586](https://cve.now/CVE-2025-9586.md): Comfast CF-N1 webmgnt wireless\_device\_dissoc command injection (CVSS 5.3, Comfast CF-N1)
- [CVE-2025-9585](https://cve.now/CVE-2025-9585.md): Comfast CF-N1 webmgnt wifilith\_delete\_pic\_file command injection (CVSS 5.3, Comfast CF-N1)
- [CVE-2025-9584](https://cve.now/CVE-2025-9584.md): Comfast CF-N1 webmgnt update\_interface\_png command injection (CVSS 5.3, Comfast CF-N1)
- [CVE-2025-9583](https://cve.now/CVE-2025-9583.md): Comfast CF-N1 webmgnt ping\_config command injection (CVSS 5.3, Comfast CF-N1)
- [CVE-2025-6203](https://cve.now/CVE-2025-6203.md): Vault unauthenticated denial of service through complex json payload (CVSS 7.5, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2025-9582](https://cve.now/CVE-2025-9582.md): Comfast CF-N1 webmgnt ntp\_timezone command injection (CVSS 5.3, Comfast CF-N1)
- [CVE-2025-9581](https://cve.now/CVE-2025-9581.md): Comfast CF-N1 webmgnt multi\_pppoe command injection (CVSS 5.3, Comfast CF-N1)
- [CVE-2025-9580](https://cve.now/CVE-2025-9580.md): LB-LINK BL-X26 HTTP set\_blacklist os command injection (CVSS 5.3, LB-LINK BL-X26)
- [CVE-2025-9579](https://cve.now/CVE-2025-9579.md): LB-LINK BL-X26 HTTP set\_hidessid\_cfg os command injection (CVSS 5.3, LB-LINK BL-X26)
- [CVE-2025-9577](https://cve.now/CVE-2025-9577.md): TOTOLINK X2000R Administrative shadow.sample default credentials (CVSS 2.0, TOTOLINK X2000R)
- [CVE-2025-31971](https://cve.now/CVE-2025-31971.md): AIML Solutions for HCL SX is susceptible to a URL validation vulnerability (CVSS 5.1, HCL Software AIML Solutions for SX)
- [CVE-2025-9576](https://cve.now/CVE-2025-9576.md): seeedstudio ReSpeaker Administrative shadow default credentials (CVSS 2.0, seeedstudio ReSpeaker)
- [CVE-2025-9575](https://cve.now/CVE-2025-9575.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 upload.cgi cgiMain os command injection (CVSS 5.3, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9195](https://cve.now/CVE-2025-9195.md): Improper input validation in firmware of some Solidigm DC Products may allow an attacker with local access to cause a Denial of Service (CVSS 4.4, Solidigm D7-PS1010/D7-PS1030)
- [CVE-2025-58059](https://cve.now/CVE-2025-58059.md): Valtimo scripting engine can be used to gain access to sensitive data or resources (CVSS 9.1, valtimo-platform valtimo-backend-libraries · com.ritense.va…)
- [CVE-2025-58049](https://cve.now/CVE-2025-58049.md): XWiki PDF export jobs store sensitive cookies unencrypted in job statuses (CVSS 5.8, xwiki-platform · org.xwiki.platform:xwiki-platform-export-p…)
- [CVE-2025-58048](https://cve.now/CVE-2025-58048.md): Paymenter Vulnerable to Remote Code Execution via Public File Uploads (CVSS 10.0, Paymenter · paymenter/paymenter)
- [CVE-2025-58047](https://cve.now/CVE-2025-58047.md): Volto affected by possible DoS by invoking specific URL by anonymous user (CVSS 7.5, plone volto · @plone/volto)
- [CVE-2025-31979](https://cve.now/CVE-2025-31979.md): A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix Service Management (SM) (CVSS 5.4, HCL Software BigFix Service Management)
- [CVE-2025-31977](https://cve.now/CVE-2025-31977.md): A cryptographic weakness has been identified in the HCL BigFix Service Management (SM) (CVSS 5.3, HCL Software BigFix Service Management)
- [CVE-2025-31972](https://cve.now/CVE-2025-31972.md): HCL BigFix Service Management (SM) is affected by a Sensitive Information Exposure vulnerability (CVSS 6.5, HCL Software BigFix Service Management)
- [CVE-2025-58335](https://cve.now/CVE-2025-58335.md): In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.28 (CVSS 5.5, JetBrains Junie)
- [CVE-2025-58334](https://cve.now/CVE-2025-58334.md): In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for t (CVSS 8.1, JetBrains IDE Services)
- [CVE-2025-57819](https://cve.now/CVE-2025-57819.md): FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE (CVSS 10.0, KEV, FreePBX endpoint)
- [CVE-2025-57759](https://cve.now/CVE-2025-57759.md): Contao has improper privilege management for page and article fields (CVSS 4.3, contao · contao/core-bundle +1)
- [CVE-2025-57758](https://cve.now/CVE-2025-57758.md): Contao has improper access control in the back end voters (CVSS 4.3, contao · contao/core-bundle +1)
- [CVE-2025-57757](https://cve.now/CVE-2025-57757.md): Contao discloses information in the news module (CVSS 5.3, contao · contao/core-bundle +1)
- [CVE-2025-57756](https://cve.now/CVE-2025-57756.md): Contao discloses sensitive information in the front end search index (CVSS 5.3, contao · contao/core-bundle +1)
- [CVE-2025-25010](https://cve.now/CVE-2025-25010.md): Kibana privilege escalation via reporting\_user role (CVSS 6.5, Elastic Kibana)
- [CVE-2024-13986](https://cve.now/CVE-2024-13986.md): Nagios XI \< 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE (CVSS 8.7, Nagios XI)
- [CVE-2025-57767](https://cve.now/CVE-2025-57767.md): Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request (CVSS 7.5, asterisk)
- [CVE-2025-54995](https://cve.now/CVE-2025-54995.md): Asterisk remotely exploitable leak of RTP UDP ports and internal resources (CVSS 6.5, asterisk)
- [CVE-2024-48908](https://cve.now/CVE-2024-48908.md): lychee-action vulnerable to arbitrary code injection in composite action (CVSS 6.9, lycheeverse lychee-action)
- [CVE-2025-8067](https://cve.now/CVE-2025-8067.md): Udisks: out-of-bounds read in udisks daemon (CVSS 8.5, storaged-project udisks · Red Hat Enterprise Linux)
- [CVE-2024-49790](https://cve.now/CVE-2024-49790.md): IBM Watson Studio on Cloud Pak for Data cross-site scripting (CVSS 5.4, IBM Watson Studio on Cloud Pak for Data)
- [CVE-2025-9578](https://cve.now/CVE-2025-9578.md): Local privilege escalation due to insecure folder permissions. (CVSS 7.8, Acronis Cyber Protect Cloud Agent)
- [CVE-2025-58127](https://cve.now/CVE-2025-58127.md): Lack of TLS validation in plugin Dell Powerscale on Checkmk Exchange (CVSS 6.9, Dell Powerscale)
- [CVE-2025-58126](https://cve.now/CVE-2025-58126.md): Lack of TLS validation in plugin VMware vSAN on Checkmk Exchange (CVSS 6.9, VMware vSAN)
- [CVE-2025-58125](https://cve.now/CVE-2025-58125.md): Lack of TLS validation in plugin Freebox v6 agent on Checkmk Exchange (CVSS 6.9, Freebox v6 agent)
- [CVE-2025-58124](https://cve.now/CVE-2025-58124.md): Lack of TLS validation in plugin check-mk-api on Checkmk Exchange (CVSS 6.9, check-mk-api)
- [CVE-2025-58123](https://cve.now/CVE-2025-58123.md): Lack of TLS validation in plugin BGP Monitoring on Checkmk Exchange (CVSS 6.9, BGP Monitoring)
- [CVE-2025-54742](https://cve.now/CVE-2025-54742.md): WordPress WpEvently Plugin \<= 4.4.8 - PHP Object Injection Vulnerability (CVSS 8.8, magepeopleteam WpEvently)
- [CVE-2025-54738](https://cve.now/CVE-2025-54738.md): WordPress Jobmonster Theme \<= 4.7.9 - Broken Authentication Vulnerability (CVSS 9.8, NooTheme Jobmonster)
- [CVE-2025-54734](https://cve.now/CVE-2025-54734.md): WordPress B Slider Plugin \<= 1.1.30 - Broken Access Control Vulnerability (CVSS 5.8, bPlugins B Slider)
- [CVE-2025-54733](https://cve.now/CVE-2025-54733.md): WordPress All Bootstrap Blocks Plugin \<= 1.3.28 - Broken Access Control Vulnerability (CVSS 6.5, all\_bootstrap\_blocks All Bootstrap Blocks)
- [CVE-2025-54731](https://cve.now/CVE-2025-54731.md): WordPress YouTube Showcase Plugin \<= 3.5.1 - PHP Object Injection Vulnerability (CVSS 8.1, emarket-design YouTube Showcase)
- [CVE-2025-54725](https://cve.now/CVE-2025-54725.md): WordPress Golo Theme \<= 1.7.0 - Broken Authentication Vulnerability (CVSS 9.8, uxper Golo)
- [CVE-2025-54724](https://cve.now/CVE-2025-54724.md): WordPress Golo Theme \<= 1.7.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, uxper Golo)
- [CVE-2025-54720](https://cve.now/CVE-2025-54720.md): WordPress Nest Addons Plugin \<= 1.6.3 - SQL Injection Vulnerability (CVSS 9.3, SteelThemes Nest Addons)
- [CVE-2025-54716](https://cve.now/CVE-2025-54716.md): WordPress Ireca Theme \<= 1.8.5 - Local File Inclusion Vulnerability (CVSS 8.1, ovatheme Ireca)
- [CVE-2025-54714](https://cve.now/CVE-2025-54714.md): WordPress Zephyr Project Manager Plugin \<= 3.3.201 - Broken Access Control Vulnerability (CVSS 7.1, Dylan James Zephyr Project Manager)
- [CVE-2025-54710](https://cve.now/CVE-2025-54710.md): WordPress Tiktok Feed Plugin \<= 1.0.21 - Broken Access Control Vulnerability (CVSS 7.1, bPlugins Tiktok Feed)
- [CVE-2025-54029](https://cve.now/CVE-2025-54029.md): WordPress WooCommerce csv import export Plugin \<= 2.0.6 - Arbitrary File Deletion Vulnerability (CVSS 7.7, extendons WooCommerce csv import export)
- [CVE-2025-53588](https://cve.now/CVE-2025-53588.md): WordPress UPC/EAN/GTIN Code Generator Plugin \<= 2.0.2 - Arbitrary File Deletion Vulnerability (CVSS 7.7, Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generat…)
- [CVE-2025-53584](https://cve.now/CVE-2025-53584.md): WordPress WP Ticket Customer Service Software & Support Ticket System Plugin \<= 6.0.2 - PHP Object Injection Vulnerability (CVSS 8.1, emarket-design WP Ticket Customer Service Software & Suppor…)
- [CVE-2025-53583](https://cve.now/CVE-2025-53583.md): WordPress Employee Spotlight Plugin \<= 5.1.1 - PHP Object Injection Vulnerability (CVSS 8.1, emarket-design Employee Spotlight)
- [CVE-2025-53579](https://cve.now/CVE-2025-53579.md): WordPress Captcha.eu Plugin \< 1.0.61 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Captcha.eu)
- [CVE-2025-53578](https://cve.now/CVE-2025-53578.md): WordPress Kipso Theme \<= 1.3.4 - Local File Inclusion Vulnerability (CVSS 8.1, gavias Kipso)
- [CVE-2025-53576](https://cve.now/CVE-2025-53576.md): WordPress Ovatheme Events Plugin \<= 1.2.8 - Local File Inclusion Vulnerability (CVSS 8.1, Ovatheme Events)
- [CVE-2025-53572](https://cve.now/CVE-2025-53572.md): WordPress WP Easy Contact Plugin \<= 4.0.1 - PHP Object Injection Vulnerability (CVSS 8.1, emarket-design WP Easy Contact)
- [CVE-2025-53337](https://cve.now/CVE-2025-53337.md): WordPress LifePress plugin \<= 2.1.3 - Broken Access Control vulnerability (CVSS 5.4, Ashan Perera LifePress)
- [CVE-2025-53334](https://cve.now/CVE-2025-53334.md): WordPress Jannah Theme \< 7.5.1 - Local File Inclusion Vulnerability (CVSS 8.1, TieLabs Jannah)
- [CVE-2025-53328](https://cve.now/CVE-2025-53328.md): WordPress Poll, Survey & Quiz Maker Plugin by Opinion Stage Plugin \<= 19.11.0 - Local File Inclusion Vulnerability (CVSS 7.5, Poll, Survey & Quiz Maker Plugin by Opinion Stage)
- [CVE-2025-53326](https://cve.now/CVE-2025-53326.md): WordPress Gutenify Plugin \<= 1.5.4 - Local File Inclusion Vulnerability (CVSS 7.5, CodeYatri Gutenify)
- [CVE-2025-53289](https://cve.now/CVE-2025-53289.md): WordPress Theme Blvd Widget Areas Plugin \<= 1.3.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Jason Theme Blvd Widget Areas)
- [CVE-2025-53250](https://cve.now/CVE-2025-53250.md): WordPress Chartbeat Plugin \<= 2.0.7 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 6.4, Chartbeat)
- [CVE-2025-53248](https://cve.now/CVE-2025-53248.md): WordPress Magazine Theme \<= 1.2.2 - Local File Inclusion Vulnerability (CVSS 8.1, unfoldwp Magazine)
- [CVE-2025-53247](https://cve.now/CVE-2025-53247.md): WordPress BlogMarks Theme \<= 1.0.8 - Local File Inclusion Vulnerability (CVSS 8.1, wpinterface BlogMarks)
- [CVE-2025-53244](https://cve.now/CVE-2025-53244.md): WordPress Magazine Elite Theme \<= 1.2.4 - Local File Inclusion Vulnerability (CVSS 8.1, unfoldwp Magazine Elite)
- [CVE-2025-53243](https://cve.now/CVE-2025-53243.md): WordPress Employee Directory – Staff Listing & Team Directory plugin for WordPress plugin \<= 4.5.5 - PHP Object Injection vulnerability (CVSS 8.1, emarket-design Employee Directory – Staff Listing & Team Di…)
- [CVE-2025-53230](https://cve.now/CVE-2025-53230.md): WordPress Page Manager for Elementor Plugin \<= 2.0.5 - Broken Access Control Vulnerability (CVSS 7.6, honzat Page Manager for Elementor)
- [CVE-2025-53227](https://cve.now/CVE-2025-53227.md): WordPress Magazine Saga Theme \<= 1.2.7 - Local File Inclusion Vulnerability (CVSS 8.1, unfoldwp Magazine Saga)
- [CVE-2025-53225](https://cve.now/CVE-2025-53225.md): WordPress e-Boekhouden.nl Plugin \<= 1.9.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, eboekhouden e-Boekhouden.nl)
- [CVE-2025-53224](https://cve.now/CVE-2025-53224.md): WordPress NextGEN Gallery Search Plugin \<= 2.12 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Koen Schuit NextGEN Gallery Search)
- [CVE-2025-53223](https://cve.now/CVE-2025-53223.md): WordPress Theme Switcher Reloaded Plugin \<= 1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, undoIT Theme Switcher Reloaded)
- [CVE-2025-53220](https://cve.now/CVE-2025-53220.md): WordPress XmasB Quotes Plugin \<= 1.6.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, XmasB Quotes)
- [CVE-2025-53216](https://cve.now/CVE-2025-53216.md): WordPress Glamer Theme \<= 1.0.2 - Local File Inclusion Vulnerability (CVSS 8.1, themeuniver Glamer)
- [CVE-2025-53215](https://cve.now/CVE-2025-53215.md): WordPress Yahoo! WebPlayer Plugin \<= 2.0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, 8bitkid Yahoo! WebPlayer)
- [CVE-2025-52761](https://cve.now/CVE-2025-52761.md): WordPress WP Funnel Manager Plugin \<= 1.4.0 - PHP Object Injection Vulnerability (CVSS 9.8, manfcarlo WP Funnel Manager)
- [CVE-2025-49407](https://cve.now/CVE-2025-49407.md): WordPress Houzez Theme \<= 4.1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 8.8, favethemes Houzez)
- [CVE-2025-49405](https://cve.now/CVE-2025-49405.md): WordPress Houzez Theme \< 4.1.4 - Local File Inclusion Vulnerability (CVSS 4.3, Favethemes Houzez)
- [CVE-2025-49404](https://cve.now/CVE-2025-49404.md): WordPress Listeo-Core Plugin \< 2.0.7 - SQL Injection Vulnerability (CVSS 8.5, purethemes Listeo Core)
- [CVE-2025-49402](https://cve.now/CVE-2025-49402.md): WordPress Exertio Framework Plugin \<= 1.3.3 - SQL Injection Vulnerability (CVSS 8.5, scriptsbundle Exertio Framework)
- [CVE-2025-49388](https://cve.now/CVE-2025-49388.md): WordPress Miraculous Core Plugin Plugin \<= 2.0.7 - Privilege Escalation Vulnerability (CVSS 9.8, kamleshyadav Miraculous Core Plugin)
- [CVE-2025-49387](https://cve.now/CVE-2025-49387.md): WordPress Drag and Drop File Upload for Elementor Forms Plugin \<= 1.5.3 - Arbitrary File Upload Vulnerability (CVSS 10.0, add-ons.org Drag and Drop File Upload for Elementor Forms)
- [CVE-2025-49383](https://cve.now/CVE-2025-49383.md): WordPress Neresa Theme \<= 1.3 - Local File Inclusion Vulnerability (CVSS 8.1, CocoBasic Neresa)
- [CVE-2025-48365](https://cve.now/CVE-2025-48365.md): WordPress Custom Comment plugin \<= 2.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, imaprogrammer Custom Comment)
- [CVE-2025-48364](https://cve.now/CVE-2025-48364.md): WordPress rajce plugin \<= 0.4.2 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, vEnCa-X rajce)
- [CVE-2025-48363](https://cve.now/CVE-2025-48363.md): WordPress Popup for CF7 with Sweet Alert plugin \<= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Metin Saraç Popup for CF7 with Sweet Alert)
- [CVE-2025-48362](https://cve.now/CVE-2025-48362.md): WordPress Hesabfa Accounting plugin \<= 2.2.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Saeed Sattar Beglou Hesabfa Accounting)
- [CVE-2025-48361](https://cve.now/CVE-2025-48361.md): WordPress Hesabfa Accounting plugin \<= 2.2.5 - Sensitive Data Exposure via Log File vulnerability (CVSS 5.3, Saeed Sattar Beglou Hesabfa Accounting)
- [CVE-2025-48360](https://cve.now/CVE-2025-48360.md): WordPress Varnish/Nginx Proxy Caching plugin \<= 1.8.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Razvan Stanga Varnish/Nginx Proxy Caching)
- [CVE-2025-48359](https://cve.now/CVE-2025-48359.md): WordPress ATT YouTube Widget plugin \<= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, thaihavnn07 ATT YouTube Widget)
- [CVE-2025-48358](https://cve.now/CVE-2025-48358.md): WordPress Risk Free Cash On Delivery (COD) – WooCommerce plugin \<= 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, everythingwp Risk Free Cash On Delivery (COD) – WooCommerce)
- [CVE-2025-48357](https://cve.now/CVE-2025-48357.md): WordPress Century ToolKit plugin \<= 1.2.1 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Activation vulnerability (CVSS 5.4, Theme Century Century ToolKit)
- [CVE-2025-48356](https://cve.now/CVE-2025-48356.md): WordPress Kanpress plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Isra Kanpress)
- [CVE-2025-48354](https://cve.now/CVE-2025-48354.md): WordPress Better Post & Filter Widgets for Elementor plugin \<= 1.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Smart Widgets Better Post & Filter Widgets for Elementor)
- [CVE-2025-48353](https://cve.now/CVE-2025-48353.md): WordPress Clickbank WordPress Plugin (Niche Storefront) plugin \<= 1.3.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, dactum Clickbank WordPress Plugin)
- [CVE-2025-48352](https://cve.now/CVE-2025-48352.md): WordPress Yandex Site search pinger plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, sitesearch-yandex Yandex Site search pinger)
- [CVE-2025-48351](https://cve.now/CVE-2025-48351.md): WordPress Kento Splash Screen plugin \<= 1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, PluginsPoint Kento Splash Screen)
- [CVE-2025-48350](https://cve.now/CVE-2025-48350.md): WordPress AutoWP plugin \<= 2.2.7 - Broken Access Control vulnerability (CVSS 4.3, Basar Ventures AutoWP)
- [CVE-2025-48349](https://cve.now/CVE-2025-48349.md): WordPress Video Gallery – Vimeo and YouTube Gallery plugin \<= 1.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, origincode Video Gallery – Vimeo and YouTube Gallery)
- [CVE-2025-48348](https://cve.now/CVE-2025-48348.md): WordPress Site Offline plugin \<= 1.5.7 - Broken Access Control vulnerability (CVSS 4.3, chandrashekharsahu Site Offline)
- [CVE-2025-48347](https://cve.now/CVE-2025-48347.md): WordPress bxSlider integration for WordPress plugin \<= 1.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Vincent Mimoun-Prat bxSlider integration for WordPress)
- [CVE-2025-48343](https://cve.now/CVE-2025-48343.md): WordPress WPMU Ldap Authentication plugin \<= 5.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, Aaron Axelsen WPMU Ldap Authentication)
- [CVE-2025-48327](https://cve.now/CVE-2025-48327.md): WordPress WP Mailgun SMTP plugin \<= 1.0.7 - Broken Access Control vulnerability (CVSS 5.3, inkthemes WP Mailgun SMTP)
- [CVE-2025-48325](https://cve.now/CVE-2025-48325.md): WordPress WP Admin Theme plugin \<= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, shmish111 WP Admin Theme)
- [CVE-2025-48324](https://cve.now/CVE-2025-48324.md): WordPress tli.tl auto Twitter poster plugin \<= 3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, khashabawy tli.tl auto Twitter poster)
- [CVE-2025-48323](https://cve.now/CVE-2025-48323.md): WordPress Advance Food Menu plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Md Abunaser Khan Advance Food Menu)
- [CVE-2025-48322](https://cve.now/CVE-2025-48322.md): WordPress Statify Widget plugin \<= 1.4.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Finn Dohrn Statify Widget)
- [CVE-2025-48321](https://cve.now/CVE-2025-48321.md): WordPress Ultimate twitter profile widget plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, dyiosah Ultimate twitter profile widget)
- [CVE-2025-48320](https://cve.now/CVE-2025-48320.md): WordPress 百度分享按钮 plugin \<= 1.0.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, cuckoohello 百度分享按钮)
- [CVE-2025-48319](https://cve.now/CVE-2025-48319.md): WordPress Mesa Mesa Reservation Widget plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, gslauraspeck Mesa Mesa Reservation Widget)
- [CVE-2025-48318](https://cve.now/CVE-2025-48318.md): WordPress 多说社会化评论框 plugin \<= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, shen2 多说社会化评论框)
- [CVE-2025-48316](https://cve.now/CVE-2025-48316.md): WordPress Responsive Mobile-Friendly Tooltip plugin \<= 1.6.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ItayXD Responsive Mobile-Friendly Tooltip)
- [CVE-2025-48315](https://cve.now/CVE-2025-48315.md): WordPress WordPress HTML plugin \<= 0.51 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, stanton119 WordPress HTML)
- [CVE-2025-48314](https://cve.now/CVE-2025-48314.md): WordPress Add Code To Head plugin \<= 1.17 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, salubrio Add Code To Head)
- [CVE-2025-48313](https://cve.now/CVE-2025-48313.md): WordPress Tripadvisor Shortcode plugin \<= 2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, kevin heath Tripadvisor Shortcode)
- [CVE-2025-48312](https://cve.now/CVE-2025-48312.md): WordPress WPAvatar plugin \<= 1.9.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, 文派翻译（WP Chinese Translation） WPAvatar)
- [CVE-2025-48311](https://cve.now/CVE-2025-48311.md): WordPress Invisible Optin plugin \<= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, OffClicks Invisible Optin)
- [CVE-2025-48310](https://cve.now/CVE-2025-48310.md): WordPress Table Editor plugin \<= 1.6.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wptableeditor Table Editor)
- [CVE-2025-48309](https://cve.now/CVE-2025-48309.md): WordPress BetPress plugin \<= 1.0.1 Lite - CSRF to Stored XSS vulnerability (CVSS 7.1, web-able BetPress)
- [CVE-2025-48308](https://cve.now/CVE-2025-48308.md): WordPress Newsletter subscription optin module plugin \<= 1.2.9 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, nonletter Newsletter subscription optin module)
- [CVE-2025-48307](https://cve.now/CVE-2025-48307.md): WordPress SEO For Images plugin \<= 1.0.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, kasonzhao SEO For Images)
- [CVE-2025-48306](https://cve.now/CVE-2025-48306.md): WordPress Savyour Affiliate Partner plugin \<= 2.1.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, developers savyour Savyour Affiliate Partner)
- [CVE-2025-48305](https://cve.now/CVE-2025-48305.md): WordPress Goal Tracker for Patreon plugin \<= 0.4.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, vikingjs Goal Tracker for Patreon)
- [CVE-2025-48304](https://cve.now/CVE-2025-48304.md): WordPress Google XML News Sitemap plugin plugin \<= 0.02 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, Gary Illyes Google XML News Sitemap plugin)
- [CVE-2025-48110](https://cve.now/CVE-2025-48110.md): WordPress Link View plugin \<= 0.8.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, mibuthu Link View)
- [CVE-2025-48109](https://cve.now/CVE-2025-48109.md): WordPress XM-Backup plugin \<= 0.9.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Xavier Media XM-Backup)
- [CVE-2025-48100](https://cve.now/CVE-2025-48100.md): WordPress bidorbuy Store Integrator plugin \<= 2.12.0 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, extremeidea bidorbuy Store Integrator)
- [CVE-2025-39496](https://cve.now/CVE-2025-39496.md): WordPress WooBeWoo Product Filter Pro plugin \< 2.9.6 - SQL Injection vulnerability (CVSS 9.3, WBW WooBeWoo Product Filter Pro)
- [CVE-2025-9376](https://cve.now/CVE-2025-9376.md): Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection \<= 11.58 - Insufficient Authorization to Unauthenticated Blocklist Bypass (CVSS 6.5, sminozzi Block Bad Bots and Stop Bad Bots Crawlers and Spid…)
- [CVE-2025-55175](https://cve.now/CVE-2025-55175.md): Reflected XSS in QuickCMS (CVSS 5.1, OpenSolution QuickCMS)
- [CVE-2025-54544](https://cve.now/CVE-2025-54544.md): Stored XSS in QuickCMS (CVSS 5.3, OpenSolution QuickCMS)
- [CVE-2025-54543](https://cve.now/CVE-2025-54543.md): Stored XSS in QuickCMS (CVSS 5.3, OpenSolution QuickCMS)
- [CVE-2025-54542](https://cve.now/CVE-2025-54542.md): Sending Password in GET Request (CVSS 6.9, OpenSolution QuickCMS)
- [CVE-2025-54541](https://cve.now/CVE-2025-54541.md): Cross-Site Request Forgery in QuickCMS (CVSS 6.9, OpenSolution QuickCMS)
- [CVE-2025-54540](https://cve.now/CVE-2025-54540.md): Reflected XSS in QuickCMS (CVSS 5.1, OpenSolution QuickCMS)
- [CVE-2025-48963](https://cve.now/CVE-2025-48963.md): Local privilege escalation due to improper soft link handling. (CVSS 7.3, Acronis Cyber Protect Cloud Agent)
- [CVE-2024-58240](https://cve.now/CVE-2024-58240.md): tls: separate no-async decryption request handling from async (CVSS 9.8, Linux)
- [CVE-2025-58081](https://cve.now/CVE-2025-58081.md): Use of hard-coded password issue/vulnerability in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthen (CVSS 7.5, DOS Co. SS1)
- [CVE-2025-58072](https://cve.now/CVE-2025-58072.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in SS1 Ver.16.0.0.10 and earlier (Media version: (CVSS 7.5, DOS Co. SS1)
- [CVE-2025-54819](https://cve.now/CVE-2025-54819.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in SS1 Ver.16.0.0.10 and earlier (Media version: (CVSS 6.5, DOS Co. SS1)
- [CVE-2025-54762](https://cve.now/CVE-2025-54762.md): SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and exe (CVSS 9.8, DOS Co. SS1)
- [CVE-2025-53970](https://cve.now/CVE-2025-53970.md): SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and exe (CVSS 9.8, DOS Co. SS1)
- [CVE-2025-53396](https://cve.now/CVE-2025-53396.md): Incorrect permission assignment for critical resource issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier), whi (CVSS 7.0, DOS Co. SS1)
- [CVE-2025-52460](https://cve.now/CVE-2025-52460.md): Files or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). (CVSS 5.3, DOS Co. SS1)
- [CVE-2025-46409](https://cve.now/CVE-2025-46409.md): Inadequate encryption strength issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). (CVSS 7.5, DOS Co. SS1)
- [CVE-2025-58322](https://cve.now/CVE-2025-58322.md): NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\\SYSTEM by invoking arbitrar (CVSS 7.8, NAVER MYBOX Explorer)
- [CVE-2025-6255](https://cve.now/CVE-2025-6255.md): Dynamic AJAX Product Filters for WooCommerce \<= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter (CVSS 6.4, plugincy Dynamic AJAX Product Filters for WooCommerce)
- [CVE-2025-8073](https://cve.now/CVE-2025-8073.md): Dynamic AJAX Product Filters for WooCommerce \<= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter (CVSS 6.4, plugincy Dynamic AJAX Product Filters for WooCommerce)
- [CVE-2025-7956](https://cve.now/CVE-2025-7956.md): Ajax Search Lite \<= 4.13.1 - Missing Authorization to Unauthenticated Basic Information Exposure via ASL\_Query in AJAX Search Handler (CVSS 5.3, wpdreams Ajax Search Lite – Live Search & Filter)
- [CVE-2024-13807](https://cve.now/CVE-2024-13807.md): Xagio SEO \<= 7.1.0.5 - Unauthenticated Sensitive Information Exposure via Unprotected Back-Up Files (CVSS 7.5, Xagio SEO – AI Powered SEO)
- [CVE-2025-7955](https://cve.now/CVE-2025-7955.md): RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral\_admin\_login\_2fa\_verify Function (CVSS 9.8, pbmacintyre RingCentral Communications Plugin – FREE)
- [CVE-2025-8977](https://cve.now/CVE-2025-8977.md): Simple Download Monitor \<= 3.9.33 - Simple Download Monitor \<= 3.9.33 – Authenticated (Contributor+) SQL Injection via order parameter in Log Export functionality (CVSS 6.5, mra13 Simple Download Monitor)
- [CVE-2025-9345](https://cve.now/CVE-2025-9345.md): File Manager, Code Editor, and Backup by Managefy \<= 1.4.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Download (CVSS 4.9, softdiscover File Manager, Code Editor, and Backup by Manag…)
- [CVE-2025-9346](https://cve.now/CVE-2025-9346.md): Booking Calendar \<= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdevelop Booking Calendar)
- [CVE-2024-9648](https://cve.now/CVE-2024-9648.md): WP ULike Pro \<= 1.9.3 - Unauthenticated Limited Arbitrary File Upload (CVSS 6.1, WP ULike Pro)
- [CVE-2025-8603](https://cve.now/CVE-2025-8603.md): Unlimited Elements For Elementor \<= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, unitecms Unlimited Elements For Elementor)
- [CVE-2025-0951](https://cve.now/CVE-2025-0951.md): LiquidThemes Themes \<= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated (CVSS 4.3, LiquidThemes AI Hub - Startup & Technology WordPress The… +1)
- [CVE-2025-36003](https://cve.now/CVE-2025-36003.md): IBM Security Verify Governance Identity Manager information disclosure (CVSS 7.5, IBM Security Verify Governance Identity Manager)
- [CVE-2025-7812](https://cve.now/CVE-2025-7812.md): Video Share VOD – Turnkey Video Site Builder Script \<= 2.7.6 - Cross-Site Request Forgery to Command Injection (CVSS 8.8, videowhisper Video Share VOD – Turnkey Video Site Builder S…)
- [CVE-2025-8897](https://cve.now/CVE-2025-8897.md): Beaver Builder Plugin (Lite Version) \<= 2.9.2.1 - Reflected Cross-Site Scripting (CVSS 6.1, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2025-9344](https://cve.now/CVE-2025-9344.md): UsersWP \<= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, stiofansisland UsersWP – Front-end login form, User Registr…)
- [CVE-2025-9352](https://cve.now/CVE-2025-9352.md): Pronamic Google Maps \<= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, Pronamic Google Maps)
- [CVE-2025-29364](https://cve.now/CVE-2025-29364.md): spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ\_SYSCALL and WRITE\_SYSCALL system calls. (CVSS 6.5)
- [CVE-2025-51643](https://cve.now/CVE-2025-51643.md): Meitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is accessible without authentication or tamper prot (CVSS 2.4)
- [CVE-2025-51967](https://cve.now/CVE-2025-51967.md): A Reflected Cross-site Scripting (XSS) vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0. (CVSS 6.1)
- [CVE-2025-51968](https://cve.now/CVE-2025-51968.md): A SQL Injection vulnerability exists in the action.php file of PuneethReddyHC Online Shopping System Advanced 1.0. (CVSS 6.5)
- [CVE-2025-51969](https://cve.now/CVE-2025-51969.md): A SQL Injection vulnerability exists in the product.php page of PuneethReddyHC Online Shopping System Advanced 1.0. (CVSS 6.5)
- [CVE-2025-51971](https://cve.now/CVE-2025-51971.md): A reflected Cross-Site Scripting (XSS) vulnerability exists in register.php of PuneethReddyHC Online Shopping System Advanced 1.0. (CVSS 5.4)
- [CVE-2025-51972](https://cve.now/CVE-2025-51972.md): A SQL Injection vulnerability exists in the login.php of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of (CVSS 6.5)
- [CVE-2025-52054](https://cve.now/CVE-2025-52054.md): An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. (CVSS 5.3)
- [CVE-2025-55583](https://cve.now/CVE-2025-55583.md): D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi (CVSS 9.8)
- [CVE-2025-56236](https://cve.now/CVE-2025-56236.md): FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. (CVSS 6.1, FormCMS)
- [CVE-2025-57215](https://cve.now/CVE-2025-57215.md): Tenda AC10 v4.0 firmware v16.03.10.20 was discovered to contain a stack overflow via the function get\_parentControl\_list\_Info. (CVSS 7.5)
- [CVE-2025-57217](https://cve.now/CVE-2025-57217.md): Tenda AC10 v4.0 firmware v16.03.10.09\_multi\_TDE01 was discovered to contain a stack overflow via the Password parameter in the function R7We (CVSS 5.3)
- [CVE-2025-57218](https://cve.now/CVE-2025-57218.md): Tenda AC10 v4.0 firmware v16.03.10.09\_multi\_TDE01 was discovered to contain a stack overflow via the security\_5g parameter in the function s (CVSS 5.3)
- [CVE-2025-57219](https://cve.now/CVE-2025-57219.md): Incorrect access control in the endpoint /goform/ate of Tenda AC10 v4.0 firmware v16.03.10.09\_multi\_TDE01 allows attackers to escalate privi (CVSS 5.3)
- [CVE-2025-57220](https://cve.now/CVE-2025-57220.md): An input validation flaw in the 'ate' service of Tenda AC10 v4.0 firmware v16.03.10.09\_multi\_TDE01 to escalate privileges to root via a craf (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.