CVEs published September 20, 2025
15 CVEs were published on September 20, 2025: 1 critical, 2 high.
- Published
- 15
- Critical
- 1
- High
- 2
- Medium
- 12
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Selleo Mentingo
- 2
- bittokazi Custom Login And Signup Widget
- 1
- BLUEFEET Starch
- 1
- bpedrassani Browser Sniff
- 1
- brainstormforce SureForms – Contact Form, Payment Form & Ot…
- 1
- ClickWhale – Link Manager, Link Shortener and Click Tracker…
- 1
- dartiss Draft List
- 1
- endisha Secure Passkeys
- 1
- michaelbo osTicket WP Bridge
- 1
- psmplugins SupportCandy – Helpdesk & Customer Support Ticke…
- 1
Critical 1
High 2
Medium, low and unrated 12
- CVE-2025-10755Selleo Mentingo Content-Type unrestricted uploadSelleo Mentingo
- CVE-2025-10741Selleo Mentingo Profile Picture unrestricted uploadSelleo Mentingo
- CVE-2025-9887Custom Login And Signup Widget <= 1.0 - Cross-Site Request Forgerybittokazi Custom Login And Signup Widget
- CVE-2025-9883Browser Sniff <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scriptingbpedrassani Browser Sniff
- CVE-2025-9882osTicket WP Bridge <= 1.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scriptingmichaelbo osTicket WP Bridge
- CVE-2025-10658SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeoverpsmplugins SupportCandy – Helpdesk & Customer Support Ticke…
- CVE-2025-9949Internal Links Manager <= 3.0.1 - Cross-Site Request Forgerywebraketen Internal Links Manager
- CVE-2025-10002ClickWhale <= 2.5.0 - Authenticated (Admin+) SQL injectionClickWhale – Link Manager, Link Shortener and Click Tracker…
- CVE-2025-10305Secure Passkeys <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletionendisha Secure Passkeys
- CVE-2025-10489SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creationbrainstormforce SureForms – Contact Form, Payment Form & Ot…
- CVE-2025-10181Draft List <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingdartiss Draft List
- CVE-2025-10652Robcore Netatmo <= 1.7 - Authenticated (Contributor+) SQL Injection via robcore-netatmo Shortcoderobcore89 Robcore Netatmo