# CVEs published 2025-09-22

414 CVEs were published on September 22, 2025: 10 critical, 60 high. Days are UTC.

- [CVE-2025-10823](https://cve.now/CVE-2025-10823.md): axboe fio options.c str\_buffer\_pattern\_cb null pointer dereference (CVSS 4.8, axboe fio)
- [CVE-2025-10822](https://cve.now/CVE-2025-10822.md): fuyang\_lipengjun platform queryAll SysSmsLogController improper authorization (CVSS 5.3, fuyang\_lipengjun platform)
- [CVE-2025-10821](https://cve.now/CVE-2025-10821.md): fuyang\_lipengjun platform queryAll TopicCategoryController improper authorization (CVSS 5.3, fuyang\_lipengjun platform)
- [CVE-2025-43814](https://cve.now/CVE-2025-43814.md): In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 20 (CVSS 6.9, Liferay Portal · Liferay DXP +1)
- [CVE-2025-10820](https://cve.now/CVE-2025-10820.md): fuyang\_lipengjun platform queryAll TopicController improper authorization (CVSS 5.3, fuyang\_lipengjun platform)
- [CVE-2025-10819](https://cve.now/CVE-2025-10819.md): fuyang\_lipengjun platform queryAll UserCouponController improper authorization (CVSS 5.3, fuyang\_lipengjun platform)
- [CVE-2025-43810](https://cve.now/CVE-2025-43810.md): Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2 (CVSS 5.3, Liferay Portal · Liferay DXP +1)
- [CVE-2025-10817](https://cve.now/CVE-2025-10817.md): Campcodes Online Learning Management System admin\_user.php sql injection (CVSS 6.9, Campcodes Online Learning Management System)
- [CVE-2025-43806](https://cve.now/CVE-2025-43806.md): Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 G (CVSS 5.3, Liferay Portal · Liferay DXP +2)
- [CVE-2025-10816](https://cve.now/CVE-2025-10816.md): Jinher OA XML text xml external entity reference (CVSS 6.9, Jinher OA)
- [CVE-2025-10815](https://cve.now/CVE-2025-10815.md): Tenda AC20 HTTP POST Request SetPptpServerCfg strcpy buffer overflow (CVSS 8.7, Tenda AC20)
- [CVE-2025-47910](https://cve.now/CVE-2025-47910.md): CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http (CVSS 5.4, Go standard library net/http · stdlib)
- [CVE-2025-59535](https://cve.now/CVE-2025-59535.md): DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters (CVSS 6.5, dnnsoftware Dnn.Platform · DotNetNuke.Core)
- [CVE-2025-10814](https://cve.now/CVE-2025-10814.md): D-Link DIR-823X goahead command injection (CVSS 5.3, D-Link DIR-823X)
- [CVE-2025-59532](https://cve.now/CVE-2025-59532.md): Codex has sandbox bypass due to bug in path configuration logic (CVSS 8.6, openai codex · @openai/codex)
- [CVE-2025-10813](https://cve.now/CVE-2025-10813.md): code-projects Hostel Management System index.php sql injection (CVSS 6.9, code-projects Hostel Management System)
- [CVE-2025-59528](https://cve.now/CVE-2025-59528.md): Flowise has Remote Code Execution vulnerability (CVSS 10.0, FlowiseAI Flowise · flowise)
- [CVE-2025-59527](https://cve.now/CVE-2025-59527.md): FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability (CVSS 7.5, FlowiseAI Flowise · flowise)
- [CVE-2025-59434](https://cve.now/CVE-2025-59434.md): Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function (CVSS 9.6, FlowiseAI Flowise)
- [CVE-2025-10812](https://cve.now/CVE-2025-10812.md): code-projects Hostel Management System index.php sql injection (CVSS 6.9, code-projects Hostel Management System)
- [CVE-2025-59526](https://cve.now/CVE-2025-59526.md): Mailgen: HTML injection vulnerability in plaintext e-mails (CVSS 2.7, eladnava mailgen · mailgen)
- [CVE-2025-59432](https://cve.now/CVE-2025-59432.md): Timing Attack Vulnerability in SCRAM Authentication (CVSS 6.6, ongres scram · com.ongres.scram:scram-common)
- [CVE-2025-59433](https://cve.now/CVE-2025-59433.md): @conventional-changelog/git-client has an Argument Injection vulnerability (CVSS 5.3, conventional-changelog · @conventional-changelog/git-client)
- [CVE-2025-10811](https://cve.now/CVE-2025-10811.md): code-projects Hostel Management System index.php sql injection (CVSS 6.9, code-projects Hostel Management System)
- [CVE-2025-8892](https://cve.now/CVE-2025-8892.md): PRT File Parsing Memory Corruption Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-59430](https://cve.now/CVE-2025-59430.md): Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink (CVSS 8.2, FrontFin mesh-web-sdk · @meshconnect/web-link-sdk)
- [CVE-2025-9960](https://cve.now/CVE-2025-9960.md): is-localhost-ip 2.0.0 - SSRF via Restrictions bypass (CVSS 6.9, is-localhost-ip)
- [CVE-2025-10810](https://cve.now/CVE-2025-10810.md): Campcodes Online Learning Management System edit\_user.php sql injection (CVSS 6.9, Campcodes Online Learning Management System)
- [CVE-2025-58956](https://cve.now/CVE-2025-58956.md): WordPress WP Attractive Donations System Plugin \< 1.29 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, loopus WP Attractive Donations System)
- [CVE-2025-58957](https://cve.now/CVE-2025-58957.md): WordPress VPSUForm Plugin \<= 3.2.20 - Broken Access Control Vulnerability (CVSS 4.3, Vikas Ratudi VPSUForm)
- [CVE-2025-58960](https://cve.now/CVE-2025-58960.md): WordPress IP Based Login Plugin \<= 2.4.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, brijeshk89 IP Based Login)
- [CVE-2025-58962](https://cve.now/CVE-2025-58962.md): WordPress Publitio Plugin \<= 2.2.1 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 6.4, Publitio)
- [CVE-2025-58965](https://cve.now/CVE-2025-58965.md): WordPress Fusion Page Builder : Extension – Gallery Plugin \<= 1.7.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Agency Dominion Fusion Page Builder : Extension – Gallery)
- [CVE-2025-58968](https://cve.now/CVE-2025-58968.md): WordPress MaxiBlocks Plugin \<= 2.1.3 - Broken Access Control Vulnerability (CVSS 5.0, Christiaan Pieterse MaxiBlocks)
- [CVE-2025-58969](https://cve.now/CVE-2025-58969.md): WordPress Custom Login URL Plugin \<= 1.0.2 - Broken Access Control Vulnerability (CVSS 5.3, Greg Winiarski Custom Login URL)
- [CVE-2025-58973](https://cve.now/CVE-2025-58973.md): WordPress Easy Elementor Addons Plugin \<= 2.2.8 - Local File Inclusion Vulnerability (CVSS 7.5, hashthemes Easy Elementor Addons)
- [CVE-2025-58974](https://cve.now/CVE-2025-58974.md): WordPress WPComplete Plugin \<= 2.9.5.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, StellarWP WPComplete)
- [CVE-2025-58992](https://cve.now/CVE-2025-58992.md): WordPress Product Catalog Simple Plugin \<= 1.8.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, impleCode Product Catalog Simple)
- [CVE-2025-59549](https://cve.now/CVE-2025-59549.md): WordPress GetResponse Forms Plugin \<= 2.6.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, fatcatapps GetResponse Forms)
- [CVE-2025-59551](https://cve.now/CVE-2025-59551.md): WordPress Revive.so Plugin \<= 2.0.6 - Broken Access Control Vulnerability (CVSS 4.3, WP Chill Revive.so)
- [CVE-2025-59552](https://cve.now/CVE-2025-59552.md): WordPress Save as PDF Plugin \<= 4.5.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Pdfcrowd Dev Team Save as PDF)
- [CVE-2025-59553](https://cve.now/CVE-2025-59553.md): WordPress Custom iFrame for Elementor Plugin \<= 1.0.13 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Coderz Studio Custom iFrame for Elementor)
- [CVE-2025-59559](https://cve.now/CVE-2025-59559.md): WordPress Payrexx Payment Gateway for WooCommerce Plugin \<= 3.1.5 - Broken Access Control Vulnerability (CVSS 4.3, Payrexx Payment Gateway for WooCommerce)
- [CVE-2025-59561](https://cve.now/CVE-2025-59561.md): WordPress Smart Blocks Plugin \<= 2.4 - Broken Access Control Vulnerability (CVSS 4.3, hashthemes Smart Blocks)
- [CVE-2025-59562](https://cve.now/CVE-2025-59562.md): WordPress Academy LMS Plugin \<= 3.3.4 - Insecure Direct Object References (IDOR) Vulnerability (CVSS 5.5, Kodezen Academy LMS)
- [CVE-2025-59565](https://cve.now/CVE-2025-59565.md): WordPress Upsell Order Bump Offer for WooCommerce Plugin \<= 3.0.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WP Swings Upsell Order Bump Offer for WooCommerce)
- [CVE-2025-59567](https://cve.now/CVE-2025-59567.md): WordPress Coupon Affiliates Plugin \<= 6.8.0 - Broken Access Control Vulnerability (CVSS 4.3, Elliot Sowersby / RelyWP Coupon Affiliates)
- [CVE-2025-59568](https://cve.now/CVE-2025-59568.md): WordPress Zoho Flow Plugin \<= 2.14.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Zoho Flow)
- [CVE-2025-59569](https://cve.now/CVE-2025-59569.md): WordPress CubeWP Plugin \<= 1.1.26 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Imran Tauqeer CubeWP)
- [CVE-2025-59570](https://cve.now/CVE-2025-59570.md): WordPress Mail Mint Plugin \<= 1.18.6 - SQL Injection Vulnerability (CVSS 7.6, WPFunnels Mail Mint)
- [CVE-2025-59572](https://cve.now/CVE-2025-59572.md): WordPress WorkScout-Core Plugin \< 1.7.06 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 8.8, purethemes WorkScout-Core)
- [CVE-2025-59573](https://cve.now/CVE-2025-59573.md): WordPress Cozy Blocks Plugin \<= 2.1.29 - Content Injection Vulnerability (CVSS 5.3, CozyThemes Cozy Blocks)
- [CVE-2025-59574](https://cve.now/CVE-2025-59574.md): WordPress WP Travel Engine Plugin \<= 1.4.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WP Travel Engine)
- [CVE-2025-59576](https://cve.now/CVE-2025-59576.md): WordPress MasterStudy LMS Plugin \<= 3.6.20 - Broken Access Control Vulnerability (CVSS 6.5, Stylemix MasterStudy LMS)
- [CVE-2025-59577](https://cve.now/CVE-2025-59577.md): WordPress MasterStudy LMS Plugin \<= 3.6.20 - Race Condition Vulnerability (CVSS 4.3, Stylemix MasterStudy LMS)
- [CVE-2025-59581](https://cve.now/CVE-2025-59581.md): WordPress Ibtana Plugin \<= 1.2.5.3 - Arbitrary Content Deletion Vulnerability (CVSS 6.5, VW THEMES Ibtana)
- [CVE-2025-59582](https://cve.now/CVE-2025-59582.md): WordPress Ajax Load More Plugin \<= 7.6.0.2 - Sensitive Data Exposure Vulnerability (CVSS 5.3, Darren Cooney Ajax Load More)
- [CVE-2025-59583](https://cve.now/CVE-2025-59583.md): WordPress Penci Filter Everything Plugin \< 1.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, PenciDesign Penci Filter Everything)
- [CVE-2025-59584](https://cve.now/CVE-2025-59584.md): WordPress Penci Podcast Plugin \<= 1.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, PenciDesign Penci Podcast)
- [CVE-2025-59585](https://cve.now/CVE-2025-59585.md): WordPress Penci Recipe Plugin \<= 4.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, PenciDesign Penci Recipe)
- [CVE-2025-59586](https://cve.now/CVE-2025-59586.md): WordPress Penci Portfolio Plugin \<= 3.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, PenciDesign Penci Portfolio)
- [CVE-2025-59587](https://cve.now/CVE-2025-59587.md): WordPress Penci Shortcodes & Performance Plugin \< 6.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, PenciDesign Penci Shortcodes & Performance)
- [CVE-2025-59588](https://cve.now/CVE-2025-59588.md): WordPress Soledad Theme \<= 8.6.8 - Local File Inclusion Vulnerability (CVSS 7.5, PenciDesign Soledad)
- [CVE-2025-59589](https://cve.now/CVE-2025-59589.md): WordPress Soledad Theme \<= 8.6.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, PenciDesign Soledad)
- [CVE-2025-59590](https://cve.now/CVE-2025-59590.md): WordPress Media Library Assistant Plugin \<= 3.28 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, David Lingren Media LIbrary Assistant)
- [CVE-2025-59591](https://cve.now/CVE-2025-59591.md): WordPress wpDiscuz Plugin \<= 7.6.33 - Broken Access Control Vulnerability (CVSS 4.3, AdvancedCoding wpDiscuz)
- [CVE-2025-59592](https://cve.now/CVE-2025-59592.md): WordPress Make Column Clickable Elementor Plugin \<= 1.6.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Fernando Acosta Make Column Clickable Elementor)
- [CVE-2025-53450](https://cve.now/CVE-2025-53450.md): WordPress Easy Pricing Table WP Plugin \<= 1.1.3 - Local File Inclusion Vulnerability (CVSS 7.5, Pluginwale Easy Pricing Table WP)
- [CVE-2025-53452](https://cve.now/CVE-2025-53452.md): WordPress Event Rocket Plugin \<= 3.3 - Broken Access Control Vulnerability (CVSS 4.3, Barry Event Rocket)
- [CVE-2025-53451](https://cve.now/CVE-2025-53451.md): WordPress Mihdan: No External Links Plugin \<= 5.1.6.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, Mihdan: No External Links)
- [CVE-2025-53454](https://cve.now/CVE-2025-53454.md): WordPress Ultimate WP Mail Plugin \<= 1.3.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Rustaurius Ultimate WP Mail)
- [CVE-2025-53455](https://cve.now/CVE-2025-53455.md): WordPress CashBill.pl – Płatności WooCommerce Plugin \<= 3.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, CashBill.pl – Płatności WooCommerce)
- [CVE-2025-53456](https://cve.now/CVE-2025-53456.md): WordPress SEO Backlink Monitor plugin \<= 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, activewebsight SEO Backlink Monitor)
- [CVE-2025-53457](https://cve.now/CVE-2025-53457.md): WordPress SEO Backlink Monitor plugin \<= 1.8.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, activewebsight SEO Backlink Monitor)
- [CVE-2025-53458](https://cve.now/CVE-2025-53458.md): WordPress Goracash Plugin \<= 1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, davaxi Goracash)
- [CVE-2025-36064](https://cve.now/CVE-2025-36064.md): IBM Sterling Connect:Express for Microsoft Windows information disclosure (CVSS 5.9, IBM Sterling Connect:Express for Microsoft Windows)
- [CVE-2025-53460](https://cve.now/CVE-2025-53460.md): WordPress AffiliateWP – External Referral Links Plugin \<= 1.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Syed Balkhi AffiliateWP – External Referral Links)
- [CVE-2025-53461](https://cve.now/CVE-2025-53461.md): WordPress Beaf Plugin \<= 1.6.2 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.4, Binsaifullah Beaf)
- [CVE-2025-53462](https://cve.now/CVE-2025-53462.md): WordPress SAPO Feed plugin \<= 2.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, SAPO Feed)
- [CVE-2025-53463](https://cve.now/CVE-2025-53463.md): WordPress HT Mega – Absolute Addons for WPBakery Page Builder Plugin \<= 1.0.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, HT Plugins HT Mega – Absolute Addons for WPBakery Page Buil…)
- [CVE-2025-53464](https://cve.now/CVE-2025-53464.md): WordPress WP Mailto Links Plugin \<= 3.1.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Online Optimisation WP Mailto Links)
- [CVE-2025-53465](https://cve.now/CVE-2025-53465.md): WordPress GSheets Connector Plugin \<= 1.1.1 - PHP Object Injection Vulnerability (CVSS 7.2, raoinfotech GSheets Connector)
- [CVE-2025-53466](https://cve.now/CVE-2025-53466.md): WordPress Better Find and Replace Plugin \<= 1.7.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, CodeSolz Better Find and Replace)
- [CVE-2025-53467](https://cve.now/CVE-2025-53467.md): WordPress Login-Logout Plugin \<= 3.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, webvitaly Login-Logout)
- [CVE-2025-53468](https://cve.now/CVE-2025-53468.md): WordPress Wp tabber widget Plugin \<= 4.0 - SQL Injection Vulnerability (CVSS 8.5, gopiplus@hotmail.com Wp tabber widget)
- [CVE-2025-53469](https://cve.now/CVE-2025-53469.md): WordPress BMI Adult & Kid Calculator Plugin \<= 1.2.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Mortgage Calculator BMI Adult & Kid Calculator)
- [CVE-2025-53570](https://cve.now/CVE-2025-53570.md): WordPress DELUCKS SEO Plugin \<= 2.7.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, DELUCKS SEO)
- [CVE-2025-57898](https://cve.now/CVE-2025-57898.md): WordPress WP Frontend Admin plugin \<= 1.22.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jose Vega WP Frontend Admin)
- [CVE-2025-57899](https://cve.now/CVE-2025-57899.md): WordPress WP Compress Plugin \<= 6.50.54 - Broken Access Control Vulnerability (CVSS 5.3, AresIT WP Compress)
- [CVE-2025-57900](https://cve.now/CVE-2025-57900.md): WordPress GutenKit Plugin \<= 2.4.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ataur R GutenKit)
- [CVE-2025-57902](https://cve.now/CVE-2025-57902.md): WordPress RIS Version Switcher – Downgrade or Upgrade WP Versions Easily Plugin \<= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 6.5, Md Taufiqur Rahman RIS)
- [CVE-2025-57903](https://cve.now/CVE-2025-57903.md): WordPress WooCommerce Additional Fees On Checkout (Free) plugin \<= 1.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WPSuperiors Developer WooCommerce Additional Fees On Checko…)
- [CVE-2025-57904](https://cve.now/CVE-2025-57904.md): WordPress Sales Count Manager for WooCommerce plugin \<= 2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WP-EXPERTS.IN Sales Count Manager for WooCommerce)
- [CVE-2025-57905](https://cve.now/CVE-2025-57905.md): WordPress AgreeMe Checkboxes For WooCommerce Plugin \<= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Amin Y AgreeMe Checkboxes For WooCommerce)
- [CVE-2025-57906](https://cve.now/CVE-2025-57906.md): WordPress Epeken All Kurir plugin \<= 2.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Epeken All Kurir)
- [CVE-2025-57907](https://cve.now/CVE-2025-57907.md): WordPress Heureka Plugin \<= 1.1.0 - Broken Access Control Vulnerability (CVSS 5.3, Heureka Group Heureka)
- [CVE-2025-57908](https://cve.now/CVE-2025-57908.md): WordPress Product Time Countdown for WooCommerce plugin \<= 1.6.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, ProWCPlugins Product Time Countdown for WooCommerce)
- [CVE-2025-57909](https://cve.now/CVE-2025-57909.md): WordPress Editor Custom Color Palette plugin \<= 3.5.6 - Broken Access Control vulnerability (CVSS 6.5, Rouergue Création Editor Custom Color Palette)
- [CVE-2025-57910](https://cve.now/CVE-2025-57910.md): WordPress AnyClip Luminous Studio Plugin \<= 1.3.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, AnyClip Video Platform AnyClip Luminous Studio)
- [CVE-2025-57911](https://cve.now/CVE-2025-57911.md): WordPress Adverts Plugin \<= 1.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPFactory Adverts)
- [CVE-2025-57912](https://cve.now/CVE-2025-57912.md): WordPress Dialogity Free Live Chat plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Dialogity Free Live Chat)
- [CVE-2025-57913](https://cve.now/CVE-2025-57913.md): WordPress Behance Portfolio Manager plugin \<= 1.7.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, eleopard Behance Portfolio Manager)
- [CVE-2025-57914](https://cve.now/CVE-2025-57914.md): WordPress Deliver via Shipos for WooCommerce plugin \<= 3.0.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Matat Technologies Deliver via Shipos for WooCommerce)
- [CVE-2025-57915](https://cve.now/CVE-2025-57915.md): WordPress TOCHAT.BE Plugin \<= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, César Martín TOCHAT.BE)
- [CVE-2025-57916](https://cve.now/CVE-2025-57916.md): WordPress WP System Information Plugin \<= 1.5 - Sensitive Data Exposure Vulnerability (CVSS 4.3, Nurul Amin WP System Information)
- [CVE-2025-57917](https://cve.now/CVE-2025-57917.md): WordPress Printcart Web to Print Product Designer for WooCommerce plugin \<= 2.4.8 - Broken Access Control vulnerability (CVSS 4.3, Printcart Web to Print Product Designer for WooCommerce)
- [CVE-2025-57918](https://cve.now/CVE-2025-57918.md): WordPress LinkedInclude Plugin \<= 3.0.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, ERA404 LinkedInclude)
- [CVE-2025-57919](https://cve.now/CVE-2025-57919.md): WordPress ConveyThis plugin \<= 269.1 - PHP Object Injection vulnerability (CVSS 7.2, ConveyThis)
- [CVE-2025-57920](https://cve.now/CVE-2025-57920.md): WordPress Category Featured Images Extended Plugin \<= 1.52 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, CK MacLeod Category Featured Images Extended)
- [CVE-2025-57921](https://cve.now/CVE-2025-57921.md): WordPress Frontend File Manager plugin \<= 23.3 - Broken Access Control vulnerability (CVSS 5.3, N-Media Frontend File Manager)
- [CVE-2025-57922](https://cve.now/CVE-2025-57922.md): WordPress Envíos Coordinadora Woocommerce plugin \<= 1.1.32 - Sensitive Data Exposure vulnerability (CVSS 5.3, Coordinadora Mercantil S.A. Envíos Coordinadora Woocommerce)
- [CVE-2025-57923](https://cve.now/CVE-2025-57923.md): WordPress UK Address Postcode Validation plugin \<= 3.9.2 - Sensitive Data Exposure vulnerability (CVSS 5.3, Ideal Postcodes UK Address Postcode Validation)
- [CVE-2025-57924](https://cve.now/CVE-2025-57924.md): WordPress Developer Plugin \<= 1.2.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Automattic Developer)
- [CVE-2025-57925](https://cve.now/CVE-2025-57925.md): WordPress immonex Kickstart Team Plugin \<= 1.6.9 - Local File Inclusion Vulnerability (CVSS 7.5, immonex Kickstart Team)
- [CVE-2025-57926](https://cve.now/CVE-2025-57926.md): WordPress Passster Plugin \<= 4.2.18 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WP Chill Passster)
- [CVE-2025-57927](https://cve.now/CVE-2025-57927.md): WordPress Dashboard Notepad Plugin \<= 1.42 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Stephanie Leary Dashboard Notepad)
- [CVE-2025-57928](https://cve.now/CVE-2025-57928.md): WordPress AWP Classifieds plugin \<= 4.4.3 - Content Injection vulnerability (CVSS 5.3, Strategy11 Team AWP Classifieds)
- [CVE-2025-57929](https://cve.now/CVE-2025-57929.md): WordPress Double the Donation Plugin \<= 2.0.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, kanwei\_doublethedonation Double the Donation)
- [CVE-2025-57930](https://cve.now/CVE-2025-57930.md): WordPress Double the Donation Plugin \<= 2.0.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, kanwei\_doublethedonation Double the Donation)
- [CVE-2025-57932](https://cve.now/CVE-2025-57932.md): WordPress PowerFolio Plugin \<= 3.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Diego Pereira PowerFolio)
- [CVE-2025-57933](https://cve.now/CVE-2025-57933.md): WordPress Piotnet Forms Plugin \<= 1.0.30 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, piotnetdotcom Piotnet Forms)
- [CVE-2025-57934](https://cve.now/CVE-2025-57934.md): WordPress LWS Affiliation Plugin \<= 2.3.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Aurélien LWS LWS Affiliation)
- [CVE-2025-57935](https://cve.now/CVE-2025-57935.md): WordPress Bot Block – Stop Spam Referrals in Google Analytics Plugin \<= 2.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Ricky Dawn Bot Block – Stop Spam Referrals in Google Analyt…)
- [CVE-2025-57936](https://cve.now/CVE-2025-57936.md): WordPress Subresource Integrity (SRI) Manager Plugin \<= 0.4.0 - Broken Access Control Vulnerability (CVSS 4.3, Meitar Subresource Integrity (SRI) Manager)
- [CVE-2025-57937](https://cve.now/CVE-2025-57937.md): WordPress WPeMatico RSS Feed Fetcher Plugin \<= 2.8.10 - Sensitive Data Exposure Vulnerability (CVSS 4.3, etruel WPeMatico RSS Feed Fetcher)
- [CVE-2025-57938](https://cve.now/CVE-2025-57938.md): WordPress Easy Hotel Booking plugin \<= 1.9.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, themewant Easy Hotel Booking)
- [CVE-2025-57939](https://cve.now/CVE-2025-57939.md): WordPress Image Hover Effects – Elementor Addon Plugin \<= 1.4.4 - Broken Access Control Vulnerability (CVSS 5.3, Blocksera Image Hover Effects – Elementor Addon)
- [CVE-2025-57940](https://cve.now/CVE-2025-57940.md): WordPress Append extensions on Pages Plugin \<= 1.1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Suresh Kumar Mukhiya Append extensions on Pages)
- [CVE-2025-57941](https://cve.now/CVE-2025-57941.md): WordPress Append Link on Copy Plugin \<= 0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, JonathanMH Append Link on Copy)
- [CVE-2025-57942](https://cve.now/CVE-2025-57942.md): WordPress Emergency Password Reset plugin \<= 9.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, andy\_moyle Emergency Password Reset)
- [CVE-2025-57943](https://cve.now/CVE-2025-57943.md): WordPress Skimlinks Affiliate Marketing Tool plugin \<= 1.3.1 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, Skimlinks Affiliate Marketing Tool)
- [CVE-2025-57944](https://cve.now/CVE-2025-57944.md): WordPress Skimlinks Affiliate Marketing Tool plugin \<= 1.3 - Broken Access Control vulnerability (CVSS 5.3, Skimlinks Affiliate Marketing Tool)
- [CVE-2025-57945](https://cve.now/CVE-2025-57945.md): WordPress WP Advanced PDF Plugin \<= 1.1.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, cedcommerce WP Advanced PDF)
- [CVE-2025-57946](https://cve.now/CVE-2025-57946.md): WordPress payOS plugin \<= 1.0.73 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Loc Bui payOS)
- [CVE-2025-57947](https://cve.now/CVE-2025-57947.md): WordPress Photo Gallery by Ays Plugin \<= 6.3.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ays Pro Photo Gallery by Ays)
- [CVE-2025-57948](https://cve.now/CVE-2025-57948.md): WordPress Directory Pro Plugin \<= 2.5.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, e-plugins Directory Pro)
- [CVE-2025-57949](https://cve.now/CVE-2025-57949.md): WordPress Ongkoskirim.id Plugin \<= 1.0.6 - Broken Access Control Vulnerability (CVSS 5.4, oggix Ongkoskirim.id)
- [CVE-2025-57950](https://cve.now/CVE-2025-57950.md): WordPress Plugin Security Scanner Plugin \<= 2.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Glen Scott Plugin Security Scanner)
- [CVE-2025-57951](https://cve.now/CVE-2025-57951.md): WordPress SiteNarrator Text-to-Speech Widget Plugin \<= 1.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, ken107 SiteNarrator Text-to-Speech Widget)
- [CVE-2025-57952](https://cve.now/CVE-2025-57952.md): WordPress Maps for WP Plugin \<= 1.2.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, icopydoc Maps for WP)
- [CVE-2025-57953](https://cve.now/CVE-2025-57953.md): WordPress Open User Map Plugin \<= 1.4.14 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, 100plugins Open User Map)
- [CVE-2025-57954](https://cve.now/CVE-2025-57954.md): WordPress Poll Maker Plugin \<= 6.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ays Pro Poll Maker)
- [CVE-2025-57955](https://cve.now/CVE-2025-57955.md): WordPress Post Carousel Slider for Elementor Plugin \<= 1.7.0 - Broken Access Control Vulnerability (CVSS 6.5, Plugin Devs Post Carousel Slider for Elementor)
- [CVE-2025-57956](https://cve.now/CVE-2025-57956.md): WordPress WooMS Plugin \<= 9.12 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, wpcraft WooMS)
- [CVE-2025-57957](https://cve.now/CVE-2025-57957.md): WordPress WooMS Plugin \<= 9.12 - Broken Access Control Vulnerability (CVSS 5.3, wpcraft WooMS)
- [CVE-2025-57959](https://cve.now/CVE-2025-57959.md): WordPress Slightly troublesome permalink Plugin \<= 1.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, tmatsuur Slightly troublesome permalink)
- [CVE-2025-57960](https://cve.now/CVE-2025-57960.md): WordPress Travel Map Plugin \<= 1.0.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, TravelMap Travel Map)
- [CVE-2025-57961](https://cve.now/CVE-2025-57961.md): WordPress CoDesigner plugin \<= 4.29 - Broken Access Control vulnerability (CVSS 4.3, Codexpert CoDesigner)
- [CVE-2025-57962](https://cve.now/CVE-2025-57962.md): WordPress VikRestaurants Table Reservations and Take-Away plugin \<= 1.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, e4jvikwp VikRestaurants)
- [CVE-2025-57963](https://cve.now/CVE-2025-57963.md): WordPress Zoho Billing Plugin \<= 4.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Zoho Subscriptions Zoho Billing)
- [CVE-2025-57964](https://cve.now/CVE-2025-57964.md): WordPress Library Bookshelves Plugin \<= 5.11 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, photonicgnostic Library Bookshelves)
- [CVE-2025-57965](https://cve.now/CVE-2025-57965.md): WordPress WP Proposals Plugin \<= 2.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WP CodeUs WP Proposals)
- [CVE-2025-57966](https://cve.now/CVE-2025-57966.md): WordPress Gallery Lightbox plugin \<= 1.0.0.41 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GhozyLab Gallery Lightbox)
- [CVE-2025-57967](https://cve.now/CVE-2025-57967.md): WordPress WPB Quick View for WooCommerce plugin \<= 2.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPBean WPB Quick View for WooCommerce)
- [CVE-2025-57968](https://cve.now/CVE-2025-57968.md): WordPress VikRestaurants Table Reservations and Take-Away plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, e4jvikwp VikRestaurants)
- [CVE-2025-57969](https://cve.now/CVE-2025-57969.md): WordPress Hide WP Toolbar Plugin \<= 2.7 - Broken Access Control Vulnerability (CVSS 4.3, Jeremy Saxey Hide WP Toolbar)
- [CVE-2025-57970](https://cve.now/CVE-2025-57970.md): WordPress SALESmanago Plugin \<= 3.8.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, SALESmanago & Leadoo)
- [CVE-2025-57971](https://cve.now/CVE-2025-57971.md): WordPress SALESmanago Plugin \<= 3.8.1 - Broken Access Control Vulnerability (CVSS 5.3, SALESmanago & Leadoo)
- [CVE-2025-57972](https://cve.now/CVE-2025-57972.md): WordPress Helpdesk Support Ticket System for WooCommerce plugin \<= 2.1.1 - Broken Access Control vulnerability (CVSS 4.3, WPFactory Helpdesk Support Ticket System for WooCommerce)
- [CVE-2025-57973](https://cve.now/CVE-2025-57973.md): WordPress WP-Members Plugin \<= 3.5.4.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.5, Chad Butler WP-Members)
- [CVE-2025-57974](https://cve.now/CVE-2025-57974.md): WordPress TZ PlusGallery Plugin \<= 1.5.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, tuyennv TZ PlusGallery)
- [CVE-2025-57975](https://cve.now/CVE-2025-57975.md): WordPress Team Plugin \<= 5.0.6 - Broken Access Control Vulnerability (CVSS 4.3, RadiusTheme Team)
- [CVE-2025-57976](https://cve.now/CVE-2025-57976.md): WordPress CardCom Payment Gateway plugin \<= 3.5.0.7 - Broken Access Control vulnerability (CVSS 5.3, CardCom Payment Gateway)
- [CVE-2025-57977](https://cve.now/CVE-2025-57977.md): WordPress Flexible PDF Invoices for WooCommerce & WordPress Plugin \<= 6.0.13 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, wpdesk Flexible PDF Invoices for WooCommerce & WordPress)
- [CVE-2025-57978](https://cve.now/CVE-2025-57978.md): WordPress Advanced Appointment Booking & Scheduling plugin \<= 2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, themespride Advanced Appointment Booking & Scheduling)
- [CVE-2025-57979](https://cve.now/CVE-2025-57979.md): WordPress AuthorSure Plugin \<= 2.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Russell Jamieson AuthorSure)
- [CVE-2025-57980](https://cve.now/CVE-2025-57980.md): WordPress Safety Exit Plugin \<= 1.8.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Tomas Cordero Safety Exit)
- [CVE-2025-57981](https://cve.now/CVE-2025-57981.md): WordPress WP Social Widget Plugin \<= 2.3.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, catchsquare WP Social Widget)
- [CVE-2025-57982](https://cve.now/CVE-2025-57982.md): WordPress Advance Portfolio Grid plugin \<= 1.07.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WPBean Advance Portfolio Grid)
- [CVE-2025-57983](https://cve.now/CVE-2025-57983.md): WordPress BP Disable Activation Reloaded Plugin \<= 1.2.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 6.5, Damian BP Disable Activation Reloaded)
- [CVE-2025-57984](https://cve.now/CVE-2025-57984.md): WordPress MakeStories (for Google Web Stories) Plugin \<= 3.0.4 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.4, Pratik Ghela MakeStories)
- [CVE-2025-57985](https://cve.now/CVE-2025-57985.md): WordPress Ultimate Watermark Plugin \<= 1.1 - Broken Access Control Vulnerability (CVSS 4.3, MantraBrain Ultimate Watermark)
- [CVE-2025-57986](https://cve.now/CVE-2025-57986.md): WordPress WP Subtitle plugin \<= 3.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, husani WP Subtitle)
- [CVE-2025-57987](https://cve.now/CVE-2025-57987.md): WordPress WP Events Manager Plugin \<= 2.2.1 - Broken Access Control Vulnerability (CVSS 5.3, ThimPress WP Events Manager)
- [CVE-2025-57988](https://cve.now/CVE-2025-57988.md): WordPress Uncanny Toolkit for LearnDash Plugin \<= 3.7.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Uncanny Owl Uncanny Toolkit for LearnDash)
- [CVE-2025-57989](https://cve.now/CVE-2025-57989.md): WordPress WordPress Widgets Shortcode Plugin \<= 1.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Brajesh Singh WordPress Widgets Shortcode)
- [CVE-2025-57990](https://cve.now/CVE-2025-57990.md): WordPress Blog Designer Plugin \<= 3.1.8 - Broken Access Control Vulnerability (CVSS 5.4, solwininfotech Blog Designer)
- [CVE-2025-57991](https://cve.now/CVE-2025-57991.md): WordPress Clariti Plugin \<= 1.2.1 - Broken Access Control Vulnerability (CVSS 5.4, Clariti)
- [CVE-2025-57992](https://cve.now/CVE-2025-57992.md): WordPress Mail Baby SMTP plugin \<= 2.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, InterServer Mail Baby SMTP)
- [CVE-2025-57993](https://cve.now/CVE-2025-57993.md): WordPress Geolocation IP Detection plugin \<= 5.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Benjamin Pick Geolocation IP Detection)
- [CVE-2025-57994](https://cve.now/CVE-2025-57994.md): WordPress Upcoming Events Lists Plugin \<= 1.4.0 - Insecure Direct Object References (IDOR) Vulnerability (CVSS 5.4, Sayful Islam Upcoming Events Lists)
- [CVE-2025-57995](https://cve.now/CVE-2025-57995.md): WordPress DethemeKit For Elementor Plugin \<= 2.1.10 - Broken Access Control Vulnerability (CVSS 4.3, DethemeKit For Elementor)
- [CVE-2025-57996](https://cve.now/CVE-2025-57996.md): WordPress Buckets Plugin \<= 0.3.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, matthewordie Buckets)
- [CVE-2025-57997](https://cve.now/CVE-2025-57997.md): WordPress Trustpilot Reviews Plugin \<= 2.5.925 - Broken Access Control Vulnerability (CVSS 4.3, Trustpilot Reviews)
- [CVE-2025-57998](https://cve.now/CVE-2025-57998.md): WordPress E-namad & Shamed Logo Manager Plugin \<= 2.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Hamid Reza Yazdani E-namad & Shamed Logo Manager)
- [CVE-2025-57999](https://cve.now/CVE-2025-57999.md): WordPress WPKoi Templates for Elementor Plugin \<= 3.4.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, wpkoithemes WPKoi Templates for Elementor)
- [CVE-2025-58000](https://cve.now/CVE-2025-58000.md): WordPress Memberful plugin \<= 1.75.0 - Broken Access Control vulnerability (CVSS 5.3, Memberful - Membership Plugin)
- [CVE-2025-58001](https://cve.now/CVE-2025-58001.md): WordPress Compact Archives plugin \<= 4.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Syed Balkhi Compact Archives)
- [CVE-2025-58002](https://cve.now/CVE-2025-58002.md): WordPress GD bbPress Tools Plugin \<= 3.5.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Milan Petrovic GD bbPress Tools)
- [CVE-2025-58003](https://cve.now/CVE-2025-58003.md): WordPress Javo Core Plugin \<= 3.0.0.266 - Broken Access Control Vulnerability (CVSS 5.3, javothemes Javo Core)
- [CVE-2025-58004](https://cve.now/CVE-2025-58004.md): WordPress DriCub Theme \<= 2.9 - Broken Access Control Vulnerability (CVSS 5.3, SmartDataSoft DriCub)
- [CVE-2025-58005](https://cve.now/CVE-2025-58005.md): WordPress DriCub Theme \<= 2.9 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 5.4, SmartDataSoft DriCub)
- [CVE-2025-58006](https://cve.now/CVE-2025-58006.md): WordPress WP Gravity Forms Keap/Infusionsoft plugin \<= 1.2.6 - Open Redirection vulnerability (CVSS 4.7, CRM Perks WP Gravity Forms Keap/Infusionsoft)
- [CVE-2025-58007](https://cve.now/CVE-2025-58007.md): WordPress Social Pug Plugin \<= 1.35.2 - Sensitive Data Exposure Vulnerability (CVSS 4.3, NerdPress Hubbub Lite)
- [CVE-2025-58008](https://cve.now/CVE-2025-58008.md): WordPress Participants Database Plugin \<= 2.7.6.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, xnau webdesign Participants Database)
- [CVE-2025-58009](https://cve.now/CVE-2025-58009.md): WordPress CP Multi View Event Calendar plugin \<= 1.4.35 - Broken Access Control vulnerability (CVSS 3.8, codepeople CP Multi View Event Calendar)
- [CVE-2025-58010](https://cve.now/CVE-2025-58010.md): WordPress SV Proven Expert Plugin \<= 2.0.06 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, straightvisions SV Proven Expert)
- [CVE-2025-58011](https://cve.now/CVE-2025-58011.md): WordPress Content Mask plugin \<= 1.8.5.2 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4, Alex Content Mask)
- [CVE-2025-58012](https://cve.now/CVE-2025-58012.md): WordPress Content Mask plugin \<= 1.8.5.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 3.8, Alex Content Mask)
- [CVE-2025-58013](https://cve.now/CVE-2025-58013.md): WordPress CouponXxL Theme \<= 4.5.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 8.8, pebas CouponXxL)
- [CVE-2025-58014](https://cve.now/CVE-2025-58014.md): WordPress Quiz Maker Plugin \<= 6.7.0.64 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Ays Pro Quiz Maker)
- [CVE-2025-58015](https://cve.now/CVE-2025-58015.md): WordPress Quiz Maker Plugin \<= 6.7.0.65 - Sensitive Data Exposure Vulnerability (CVSS 5.3, Ays Pro Quiz Maker)
- [CVE-2025-58016](https://cve.now/CVE-2025-58016.md): WordPress CF7 Submissions Plugin \<= 0.26 - Broken Access Control Vulnerability (CVSS 4.3, Codexpert CF7 Submissions)
- [CVE-2025-58017](https://cve.now/CVE-2025-58017.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 2.8.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bdthemes Ultimate Store Kit Elementor Addons)
- [CVE-2025-58018](https://cve.now/CVE-2025-58018.md): WordPress Mail Subscribe List Plugin \<= 2.1.10 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Richard Leishman Mail Subscribe List)
- [CVE-2025-58019](https://cve.now/CVE-2025-58019.md): WordPress Search Atlas SEO Plugin \<= 2.5.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Search Atlas Group Search Atlas SEO)
- [CVE-2025-58020](https://cve.now/CVE-2025-58020.md): WordPress Theater for WordPress plugin \<= 0.18.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jeroen Schmit Theater for WordPress)
- [CVE-2025-58021](https://cve.now/CVE-2025-58021.md): WordPress List Child Pages Shortcode Plugin \<= 1.3.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, douglaskarr List Child Pages Shortcode)
- [CVE-2025-58022](https://cve.now/CVE-2025-58022.md): WordPress ShortCode Plugin \<= 0.8.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, maxpagels ShortCode)
- [CVE-2025-58023](https://cve.now/CVE-2025-58023.md): WordPress Genealogical Tree plugin \<= 2.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, akdevs Genealogical Tree)
- [CVE-2025-58025](https://cve.now/CVE-2025-58025.md): WordPress Master Slider Plugin \<= 3.11.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, averta Master Slider)
- [CVE-2025-58026](https://cve.now/CVE-2025-58026.md): WordPress Termageddon: Cookie Consent & Privacy Compliance Plugin \<= 1.8.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Termageddon: Cookie Consent & Privacy Compliance)
- [CVE-2025-58027](https://cve.now/CVE-2025-58027.md): WordPress NGG Smart Image Search Plugin \<= 3.4.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, wpo-HR NGG Smart Image Search)
- [CVE-2025-58028](https://cve.now/CVE-2025-58028.md): WordPress Designil PDPA Thailand plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Aum Watcharapon Designil PDPA Thailand)
- [CVE-2025-58029](https://cve.now/CVE-2025-58029.md): WordPress Classic Widgets with Block-based Widgets Plugin \<= 1.0.1 - Broken Access Control Vulnerability (CVSS 5.3, Sumit Singh Classic Widgets with Block-based Widgets)
- [CVE-2025-58030](https://cve.now/CVE-2025-58030.md): WordPress Page-list Plugin \<= 5.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, webvitaly Page-list)
- [CVE-2025-58031](https://cve.now/CVE-2025-58031.md): WordPress Nextend Facebook Connect Plugin \<= 3.1.19 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Nextendweb Nextend Facebook Connect)
- [CVE-2025-58032](https://cve.now/CVE-2025-58032.md): WordPress WP Compiler Plugin \<= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Bytes.co WP Compiler)
- [CVE-2025-58033](https://cve.now/CVE-2025-58033.md): WordPress Draft Plugin \<= 3.0.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, leeshadle Draft)
- [CVE-2025-58199](https://cve.now/CVE-2025-58199.md): WordPress Fastly plugin \<= 1.2.28 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Fastly)
- [CVE-2025-58200](https://cve.now/CVE-2025-58200.md): WordPress Flexible FAQ Plugin \<= 0.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Bage Flexible FAQ)
- [CVE-2025-58219](https://cve.now/CVE-2025-58219.md): WordPress Show Pages List Plugin \<= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, LIJE Show Pages List)
- [CVE-2025-58220](https://cve.now/CVE-2025-58220.md): WordPress Card Elements for WPBakery Plugin \<= 1.0.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Techeshta Card Elements for WPBakery)
- [CVE-2025-58221](https://cve.now/CVE-2025-58221.md): WordPress PilotPress Plugin \<= 2.0.36 - Broken Access Control Vulnerability (CVSS 4.3, ONTRAPORT PilotPress)
- [CVE-2025-58222](https://cve.now/CVE-2025-58222.md): WordPress Team Manager plugin \<= 2.6.8 - Broken Access Control vulnerability (CVSS 5.3, Dynamic Web Lab Team Manager)
- [CVE-2025-58224](https://cve.now/CVE-2025-58224.md): WordPress Printeers Print & Ship Plugin \<= 1.17.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, Printeers Print & Ship)
- [CVE-2025-58223](https://cve.now/CVE-2025-58223.md): WordPress VoucherPress Plugin \<= 1.5.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Chris Taylor VoucherPress)
- [CVE-2025-58226](https://cve.now/CVE-2025-58226.md): WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin \<= 1.16.16 - Sensitive Data Exposure Vulnerability (CVSS 5.3, iberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Ima…)
- [CVE-2025-58227](https://cve.now/CVE-2025-58227.md): WordPress Podlove Subscribe button Plugin \<= 1.3.11 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Alexander Lueken Podlove Subscribe button)
- [CVE-2025-58228](https://cve.now/CVE-2025-58228.md): WordPress Quick View for WooCommerce Plugin \<= 2.2.16 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, ShapedPlugin Quick View for WooCommerce)
- [CVE-2025-58229](https://cve.now/CVE-2025-58229.md): WordPress Sitekit Plugin \<= 2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, webvitaly Sitekit)
- [CVE-2025-58230](https://cve.now/CVE-2025-58230.md): WordPress ZoloBlocks plugin \<= 2.3.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bdthemes ZoloBlocks)
- [CVE-2025-58231](https://cve.now/CVE-2025-58231.md): WordPress Bitly plugin \<= 2.8.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bitlydeveloper Bitly)
- [CVE-2025-58232](https://cve.now/CVE-2025-58232.md): WordPress Image Editor by Pixo Plugin \<= 2.3.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ickata Image Editor by Pixo)
- [CVE-2025-58233](https://cve.now/CVE-2025-58233.md): WordPress SQL Chart Builder Plugin \<= 2.3.7.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Guaven Labs SQL Chart Builder)
- [CVE-2025-58234](https://cve.now/CVE-2025-58234.md): WordPress JS Job Manager Plugin \<= 2.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, JoomSky JS Job Manager)
- [CVE-2025-58235](https://cve.now/CVE-2025-58235.md): WordPress Front End Users plugin \<= 3.2.35 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Rustaurius Front End Users)
- [CVE-2025-58236](https://cve.now/CVE-2025-58236.md): WordPress Force Update Translations plugin \<= 0.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Mayo Moriyama Force Update Translations)
- [CVE-2025-58237](https://cve.now/CVE-2025-58237.md): WordPress LC Wizard plugin \<= 2.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Niaj Morshed LC Wizard)
- [CVE-2025-58238](https://cve.now/CVE-2025-58238.md): WordPress PilotPress Plugin \<= 2.0.36 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, ONTRAPORT PilotPress)
- [CVE-2025-58239](https://cve.now/CVE-2025-58239.md): WordPress WP Category Dropdown Plugin \<= 1.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Chandrika Sista WP Category Dropdown)
- [CVE-2025-58240](https://cve.now/CVE-2025-58240.md): WordPress xili-tidy-tags Plugin \<= 1.12.06 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Michel - xiligroup dev xili-tidy-tags)
- [CVE-2025-58241](https://cve.now/CVE-2025-58241.md): WordPress SnapWidget Social Photo Feed Widget Plugin \<= 1.1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, SnapWidget Social Photo Feed Widget)
- [CVE-2025-58242](https://cve.now/CVE-2025-58242.md): WordPress Bg Church Memos Plugin \<= 1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Vadim Bogaiskov Bg Church Memos)
- [CVE-2025-58244](https://cve.now/CVE-2025-58244.md): WordPress Constructo Theme \<= 4.3.9 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 8.8, Anps Constructo)
- [CVE-2025-58245](https://cve.now/CVE-2025-58245.md): WordPress Portfolio Plugin \<= 2.58 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, bestweblayout Portfolio)
- [CVE-2025-58247](https://cve.now/CVE-2025-58247.md): WordPress TI WooCommerce Wishlist plugin \<= 2.10.0 - Broken Access Control vulnerability (CVSS 5.3, templateinvaders TI WooCommerce Wishlist)
- [CVE-2025-58248](https://cve.now/CVE-2025-58248.md): WordPress Pinterest Pinboard Widget Plugin \<= 1.0.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, codefish Pinterest Pinboard Widget)
- [CVE-2025-58249](https://cve.now/CVE-2025-58249.md): WordPress Qubely Plugin \<= 1.8.14 - Sensitive Data Exposure Vulnerability (CVSS 4.3, Themeum Qubely)
- [CVE-2025-58250](https://cve.now/CVE-2025-58250.md): WordPress Findgo Theme \<= 1.3.55 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 8.8, ApusTheme Findgo)
- [CVE-2025-58251](https://cve.now/CVE-2025-58251.md): WordPress Sticky Header Effects for Elementor Plugin \<= 2.1.2 - Broken Access Control Vulnerability (CVSS 4.3, POSIMYTH Sticky Header Effects for Elementor)
- [CVE-2025-58252](https://cve.now/CVE-2025-58252.md): WordPress Getwid Plugin \<= 2.1.2 - Sensitive Data Exposure Vulnerability (CVSS 4.3, jetmonsters Getwid)
- [CVE-2025-58253](https://cve.now/CVE-2025-58253.md): WordPress Real Estate Manager Plugin \<= 7.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Rameez Iqbal Real Estate Manager)
- [CVE-2025-58254](https://cve.now/CVE-2025-58254.md): WordPress StylePress for Elementor Plugin \<= 1.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, dtbaker StylePress for Elementor)
- [CVE-2025-58255](https://cve.now/CVE-2025-58255.md): WordPress Custom Post Type Images Plugin \<= 0.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 9.6, yonisink Custom Post Type Images)
- [CVE-2025-58256](https://cve.now/CVE-2025-58256.md): WordPress DOAJ Export Plugin \<= 1.0.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Jonathan Brinley DOAJ Export)
- [CVE-2025-58257](https://cve.now/CVE-2025-58257.md): WordPress Verowa Connect plugin \<= 3.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Picture-Planet Verowa Connect)
- [CVE-2025-58258](https://cve.now/CVE-2025-58258.md): WordPress Lazy Blocks Plugin \<= 4.1.0 - Broken Access Control Vulnerability (CVSS 4.3, nK Lazy Blocks)
- [CVE-2025-58259](https://cve.now/CVE-2025-58259.md): WordPress Nokri Theme \<= 1.6.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, scriptsbundle Nokri)
- [CVE-2025-58260](https://cve.now/CVE-2025-58260.md): WordPress Highlight and Share – Social Text and Image Sharing plugin \<= 5.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ronald Huereca Highlight and Share)
- [CVE-2025-58261](https://cve.now/CVE-2025-58261.md): WordPress Mavis HTTPS to HTTP Redirection Plugin \<= 1.4.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, PressPage Entertainment Mavis HTTPS to HTTP Redirection)
- [CVE-2025-58262](https://cve.now/CVE-2025-58262.md): WordPress Sweet Energy Efficiency plugin \<= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, WPDirectoryKit Sweet Energy Efficiency)
- [CVE-2025-58263](https://cve.now/CVE-2025-58263.md): WordPress BuddyPress Notification Widget Plugin \<= 1.3.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, BuddyDev BuddyPress Notification Widget)
- [CVE-2025-58264](https://cve.now/CVE-2025-58264.md): WordPress JupiterX Core Plugin \<= 4.11.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, artbees JupiterX Core)
- [CVE-2025-58265](https://cve.now/CVE-2025-58265.md): WordPress Events Manager – OpenStreetMaps Plugin \<= 4.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Stonehenge Creations Events Manager – OpenStreetMaps)
- [CVE-2025-58266](https://cve.now/CVE-2025-58266.md): WordPress Gianism plugin \<= 6.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Fumiki Takahashi Gianism)
- [CVE-2025-58267](https://cve.now/CVE-2025-58267.md): WordPress Stock Message Plugin \<= 1.1.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Aftabul Islam Stock Message)
- [CVE-2025-58268](https://cve.now/CVE-2025-58268.md): WordPress WPMK PDF Generator Plugin \<= 1.0.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, WPMK PDF Generator)
- [CVE-2025-58269](https://cve.now/CVE-2025-58269.md): WordPress WP Project Manager Plugin \<= 2.6.25 - Sensitive Data Exposure Vulnerability (CVSS 5.3, weDevs WP Project Manager)
- [CVE-2025-58270](https://cve.now/CVE-2025-58270.md): WordPress NIX Anti-Spam Light Plugin \<= 0.0.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, NIX Solutions NIX Anti-Spam Light)
- [CVE-2025-58271](https://cve.now/CVE-2025-58271.md): WordPress AnyClip Luminous Studio Plugin \<= 1.3.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, AnyClip Video Platform AnyClip Luminous Studio)
- [CVE-2025-58645](https://cve.now/CVE-2025-58645.md): WordPress Gravitate Automated Tester Plugin \<= 1.4.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Gravitate Automated Tester)
- [CVE-2025-58646](https://cve.now/CVE-2025-58646.md): WordPress Mobi2Go Plugin \<= 1.0.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, chtombleson Mobi2Go)
- [CVE-2025-58647](https://cve.now/CVE-2025-58647.md): WordPress Simple Restaurant Menu Plugin \<= 1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Will.I.am Simple Restaurant Menu)
- [CVE-2025-58648](https://cve.now/CVE-2025-58648.md): WordPress Simple JWT Login plugin \<= 3.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Nicu Micle Simple JWT Login)
- [CVE-2025-58649](https://cve.now/CVE-2025-58649.md): WordPress All In One SEO Pack Plugin \<= 4.8.7.1 - Sensitive Data Exposure Vulnerability (CVSS 4.3, Syed Balkhi All In One SEO Pack)
- [CVE-2025-58650](https://cve.now/CVE-2025-58650.md): WordPress All In One SEO Pack Plugin \<= 4.8.7.1 - Broken Access Control Vulnerability (CVSS 5.4, Syed Balkhi All In One SEO Pack)
- [CVE-2025-58651](https://cve.now/CVE-2025-58651.md): WordPress PlayerJS Plugin \<= 2.24 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, PlayerJS)
- [CVE-2025-58652](https://cve.now/CVE-2025-58652.md): WordPress Carousel Ultimate Plugin \<= 1.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Themepoints Carousel Ultimate)
- [CVE-2025-58653](https://cve.now/CVE-2025-58653.md): WordPress JSM file\_get\_contents() Shortcode Plugin \<= 2.7.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, JS Morisset JSM file\_get\_contents() Shortcode)
- [CVE-2025-58654](https://cve.now/CVE-2025-58654.md): WordPress xili-language Plugin \<= 2.21.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Michel - xiligroup dev xili-language)
- [CVE-2025-58655](https://cve.now/CVE-2025-58655.md): WordPress Category Featured Images Plugin \<= 1.1.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Mat Category Featured Images)
- [CVE-2025-58656](https://cve.now/CVE-2025-58656.md): WordPress Estonian Shipping Methods for WooCommerce Plugin \<= 1.7.2 - Sensitive Data Exposure Vulnerability (CVSS 5.3, Risto Niinemets Estonian Shipping Methods for WooCommerce)
- [CVE-2025-58657](https://cve.now/CVE-2025-58657.md): WordPress Grid plugin \<= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, EdwardBock Grid)
- [CVE-2025-58658](https://cve.now/CVE-2025-58658.md): WordPress Proof Factor – Social Proof Notifications Plugin \<= 1.0.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Proof Factor – Social Proof Notifications)
- [CVE-2025-58659](https://cve.now/CVE-2025-58659.md): WordPress Helpie FAQ plugin \<= 1.45 - Sensitive Data Exposure vulnerability (CVSS 5.3, Essekia Helpie FAQ)
- [CVE-2025-58660](https://cve.now/CVE-2025-58660.md): WordPress Oshine Core Plugin \<= 1.5.5 - Broken Access Control Vulnerability (CVSS 5.4, brandexponents Oshine Core)
- [CVE-2025-58661](https://cve.now/CVE-2025-58661.md): WordPress eZee Online Hotel Booking Engine Plugin \<= 1.0.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, eZee Technosys eZee Online Hotel Booking Engine)
- [CVE-2025-58662](https://cve.now/CVE-2025-58662.md): WordPress Awesome Support plugin \<= 6.3.5 - Deserialization of untrusted data vulnerability (CVSS 7.2, awesomesupport Awesome Support)
- [CVE-2025-58663](https://cve.now/CVE-2025-58663.md): WordPress Qubely Plugin \<= 1.8.14 - Broken Access Control Vulnerability (CVSS 4.3, Themeum Qubely)
- [CVE-2025-58664](https://cve.now/CVE-2025-58664.md): WordPress Text To Speech TTS Accessibility plugin \<= 1.9.30 - Broken Access Control vulnerability (CVSS 4.3, Azizul Hasan Text To Speech TTS Accessibility)
- [CVE-2025-58665](https://cve.now/CVE-2025-58665.md): WordPress Form Generator for WordPress Plugin \<= 1.52 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, tmontg1 Form Generator for WordPress)
- [CVE-2025-58666](https://cve.now/CVE-2025-58666.md): WordPress Website Chat Button: Kommo integration Plugin \<= 1.3.1 - Broken Access Control Vulnerability (CVSS 4.3, Website Chat Button: Kommo integration)
- [CVE-2025-58667](https://cve.now/CVE-2025-58667.md): WordPress ListingPro Reviews plugin \< 2.9.11 - Broken Access Control vulnerability (CVSS 5.4, CridioStudio ListingPro Reviews)
- [CVE-2025-58668](https://cve.now/CVE-2025-58668.md): WordPress WPLMS theme \<= 4.970 - Broken Access Control vulnerability (CVSS 4.3, VibeThemes WPLMS)
- [CVE-2025-58669](https://cve.now/CVE-2025-58669.md): WordPress Magento 2 WordPress Integration plugin \<= 1.4.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Modern Minds Magento 2 WordPress Integration)
- [CVE-2025-58670](https://cve.now/CVE-2025-58670.md): WordPress WP Content Protection Plugin \<= 1.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Shankaranand Maurya WP Content Protection)
- [CVE-2025-58671](https://cve.now/CVE-2025-58671.md): WordPress Auction Feed plugin \<= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, morganrichards Auction Feed)
- [CVE-2025-58672](https://cve.now/CVE-2025-58672.md): WordPress WP User Frontend Plugin \<= 4.1.12 - Broken Access Control Vulnerability (CVSS 5.4, weDevs WP User Frontend)
- [CVE-2025-58673](https://cve.now/CVE-2025-58673.md): WordPress WP User Frontend Plugin \<= 4.1.12 - Content Injection Vulnerability (CVSS 5.4, weDevs WP User Frontend)
- [CVE-2025-58675](https://cve.now/CVE-2025-58675.md): WordPress Interact: Embed A Quiz On Your Site Plugin \<= 3.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, tryinteract Interact: Embed A Quiz On Your Site)
- [CVE-2025-58676](https://cve.now/CVE-2025-58676.md): WordPress HORIZONTAL SLIDER Plugin \<= 2.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, extendyourweb HORIZONTAL SLIDER)
- [CVE-2025-58677](https://cve.now/CVE-2025-58677.md): WordPress ShrinkTheWeb (STW) Website Previews Plugin \<= 2.8.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, puravida1976 ShrinkTheWeb (STW) Website Previews)
- [CVE-2025-58678](https://cve.now/CVE-2025-58678.md): WordPress Accordion Plugin \<= 2.3.15 - Broken Access Control Vulnerability (CVSS 6.5, PickPlugins Accordion)
- [CVE-2025-58679](https://cve.now/CVE-2025-58679.md): WordPress AppMySite plugin \<= 3.15.0 - Broken Access Control vulnerability (CVSS 5.3, AppMySite)
- [CVE-2025-58680](https://cve.now/CVE-2025-58680.md): WordPress Gutentor plugin \<= 3.5.2 - Broken Access Control vulnerability (CVSS 6.5, Gutentor)
- [CVE-2025-58681](https://cve.now/CVE-2025-58681.md): WordPress Easy Quotes Plugin \<= 1.2.4 - Broken Access Control Vulnerability (CVSS 5.3, Jürgen Müller Easy Quotes)
- [CVE-2025-58682](https://cve.now/CVE-2025-58682.md): WordPress Kama Click Counter plugin \<= 4.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Timur Kamaev Kama Click Counter)
- [CVE-2025-58683](https://cve.now/CVE-2025-58683.md): WordPress Last Updated Shortcode Plugin \<= 1.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Luke Mlsna Last Updated Shortcode)
- [CVE-2025-58684](https://cve.now/CVE-2025-58684.md): WordPress Logo Showcase plugin \<= 4.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themepoints Logo Showcase)
- [CVE-2025-58685](https://cve.now/CVE-2025-58685.md): WordPress Cecabank WooCommerce plugin plugin \<= 0.3.4 - Broken Access Control vulnerability (CVSS 5.3, Cecabank WooCommerce Plugin)
- [CVE-2025-58686](https://cve.now/CVE-2025-58686.md): WordPress Perfect Brands for WooCommerce plugin \<= 3.6.2 - SQL Injection vulnerability (CVSS 8.5, quadlayers Perfect Brands for WooCommerce)
- [CVE-2025-58687](https://cve.now/CVE-2025-58687.md): WordPress Current Age Plugin Plugin \<= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, WP CMS Ninja Current Age Plugin)
- [CVE-2025-58688](https://cve.now/CVE-2025-58688.md): WordPress Casengo Live Chat Support Plugin \<= 2.1.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Casengo Live Chat Support)
- [CVE-2025-58689](https://cve.now/CVE-2025-58689.md): WordPress Tapfiliate Plugin \<= 3.2.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Tapfiliate)
- [CVE-2025-58691](https://cve.now/CVE-2025-58691.md): WordPress Genesis Club Lite Plugin \<= 1.17 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Russell Jamieson Genesis Club Lite)
- [CVE-2025-58690](https://cve.now/CVE-2025-58690.md): WordPress Doliconnect Plugin \<= 9.5.7 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, ptibogxiv Doliconnect)
- [CVE-2025-58702](https://cve.now/CVE-2025-58702.md): WordPress MarketKing Plugin \<= 2.0.92 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WebWizards MarketKing)
- [CVE-2025-58703](https://cve.now/CVE-2025-58703.md): WordPress Skyword API Plugin Plugin \<= 2.5.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Skyword API Plugin)
- [CVE-2025-58704](https://cve.now/CVE-2025-58704.md): WordPress WP Delete User Accounts Plugin \<= 1.2.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ren Ventura WP Delete User Accounts)
- [CVE-2025-59418](https://cve.now/CVE-2025-59418.md): BunnyPad Vulnerable to Buffer Overflow When Opening Files of Size 20MB or Greater (CVSS 5.5, GSYT-Productions BunnyPad-SRC)
- [CVE-2025-10809](https://cve.now/CVE-2025-10809.md): Campcodes Online Learning Management System department.php sql injection (CVSS 6.9, Campcodes Online Learning Management System)
- [CVE-2025-10808](https://cve.now/CVE-2025-10808.md): Campcodes Farm Management System uploadProduct.php sql injection (CVSS 6.9, Campcodes Farm Management System)
- [CVE-2025-59420](https://cve.now/CVE-2025-59420.md): Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass) (CVSS 7.5, authlib)
- [CVE-2025-10807](https://cve.now/CVE-2025-10807.md): Campcodes Online Beauty Parlor Management System edit-customer-detailed.php sql injection (CVSS 5.3, Campcodes Online Beauty Parlor Management System)
- [CVE-2025-10806](https://cve.now/CVE-2025-10806.md): Campcodes Online Beauty Parlor Management System bwdates-reports-details.php sql injection (CVSS 5.3, Campcodes Online Beauty Parlor Management System)
- [CVE-2025-43807](https://cve.now/CVE-2025-43807.md): Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023. (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-59413](https://cve.now/CVE-2025-59413.md): CubeCart Unauthorized Newsletter Unsubscription via force\_unsubscribe Parameter (CVSS 6.5, cubecart)
- [CVE-2025-59412](https://cve.now/CVE-2025-59412.md): CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement (CVSS 5.4, cubecart)
- [CVE-2025-59411](https://cve.now/CVE-2025-59411.md): CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry (CVSS 5.4, cubecart)
- [CVE-2025-59335](https://cve.now/CVE-2025-59335.md): CubeCart Session Not Invalidated After Password Change (CVSS 7.1, cubecart)
- [CVE-2025-10805](https://cve.now/CVE-2025-10805.md): Campcodes Online Beauty Parlor Management System add-services.php sql injection (CVSS 5.3, Campcodes Online Beauty Parlor Management System)
- [CVE-2025-35042](https://cve.now/CVE-2025-35042.md): Airship AI Acropolis default credentials (CVSS 9.3, Airship AI Acropolis)
- [CVE-2025-35041](https://cve.now/CVE-2025-35041.md): Airship AI Acropolis MFA insufficient rate limiting (CVSS 7.5, Airship AI Acropolis)
- [CVE-2025-10804](https://cve.now/CVE-2025-10804.md): Campcodes Online Beauty Parlor Management System add-customer.php sql injection (CVSS 5.3, Campcodes Online Beauty Parlor Management System)
- [CVE-2025-36037](https://cve.now/CVE-2025-36037.md): IBM webMethods Integration server-side request forgery (CVSS 5.4, IBM webMethods Integration)
- [CVE-2025-36202](https://cve.now/CVE-2025-36202.md): IBM webMethods Integration code execution (CVSS 7.5, IBM webMethods Integration)
- [CVE-2025-10803](https://cve.now/CVE-2025-10803.md): Tenda AC23 HTTP POST Request SetPptpServerCfg sscanf buffer overflow (CVSS 8.7, Tenda AC23)
- [CVE-2025-9038](https://cve.now/CVE-2025-9038.md): S1 Agile Privilege Escalation (CVSS 7.5, GE Vernova S1 Agile Configuration Software)
- [CVE-2025-10802](https://cve.now/CVE-2025-10802.md): code-projects Online Bidding System remove.php sql injection (CVSS 6.9, code-projects Online Bidding System)
- [CVE-2025-10801](https://cve.now/CVE-2025-10801.md): SourceCodester Pet Grooming Management Software edit\_tax.php sql injection (CVSS 6.9, SourceCodester Pet Grooming Management Software)
- [CVE-2025-10800](https://cve.now/CVE-2025-10800.md): itsourcecode Online Discussion Forum index.php sql injection (CVSS 6.9, itsourcecode Online Discussion Forum)
- [CVE-2025-10799](https://cve.now/CVE-2025-10799.md): code-projects Hostel Management System index.php sql injection (CVSS 6.9, code-projects Hostel Management System)
- [CVE-2025-10798](https://cve.now/CVE-2025-10798.md): code-projects Hostel Management System index.php sql injection (CVSS 6.9, code-projects Hostel Management System)
- [CVE-2025-10854](https://cve.now/CVE-2025-10854.md): Symlink Following in txtai leads to arbitrary file write when loading untrusted embedding indices (CVSS 8.1, txtai)
- [CVE-2025-10797](https://cve.now/CVE-2025-10797.md): code-projects Hostel Management System index.php sql injection (CVSS 6.9, code-projects Hostel Management System)
- [CVE-2025-10796](https://cve.now/CVE-2025-10796.md): code-projects Hostel Management System login.php sql injection (CVSS 6.9, code-projects Hostel Management System)
- [CVE-2025-9983](https://cve.now/CVE-2025-9983.md): Lack of Authentication for RTSP stream (CVSS 7.1, GALAYOU G2)
- [CVE-2025-10795](https://cve.now/CVE-2025-10795.md): code-projects Online Bidding System bidupdate.php sql injection (CVSS 6.9, code-projects Online Bidding System)
- [CVE-2025-10794](https://cve.now/CVE-2025-10794.md): PHPGurukul Car Rental Project search.php cross site scripting (CVSS 5.3, PHPGurukul Car Rental Project)
- [CVE-2025-46711](https://cve.now/CVE-2025-46711.md): GPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misused (CVSS 5.5, Imagination Technologies Graphics DDK)
- [CVE-2025-25177](https://cve.now/CVE-2025-25177.md): GPU DDK - Roll-back of pvr\_exp\_fence not in finalised state can cause UAF (CVSS 5.1, Imagination Technologies Graphics DDK)
- [CVE-2025-10793](https://cve.now/CVE-2025-10793.md): code-projects E-Commerce Website admin\_account\_delete.php sql injection (CVSS 6.9, code-projects E-Commerce Website)
- [CVE-2025-10792](https://cve.now/CVE-2025-10792.md): D-Link DIR-513 formWPS buffer overflow (CVSS 8.7, D-Link DIR-513)
- [CVE-2025-10009](https://cve.now/CVE-2025-10009.md): Authenticated admin RCE in Invoice Ninja (CVSS 8.6, Invoice Ninja)
- [CVE-2025-9035](https://cve.now/CVE-2025-9035.md): Reflected XSS in Horato Internet Technologies' Virtual Library Platform (CVSS 5.4, Horato Internet Technologies Ind. and Trade Virtual Library…)
- [CVE-2025-10791](https://cve.now/CVE-2025-10791.md): code-projects Online Bidding System index.php sql injection (CVSS 6.9, code-projects Online Bidding System)
- [CVE-2025-8079](https://cve.now/CVE-2025-8079.md): Reflected XSS in Akıllı Ticaret Software Technologies' Smart Trade E-Commerce (CVSS 4.6, Akıllı Ticaret Software Technologies Ltd. Smart Trade E-Com…)
- [CVE-2025-10790](https://cve.now/CVE-2025-10790.md): SourceCodester Simple Forum Discussion System ajax.php sql injection (CVSS 5.3, SourceCodester Simple Forum Discussion System)
- [CVE-2025-5962](https://cve.now/CVE-2025-5962.md): Rhel-lightspeed: improper access control in lightspeed history management allows local privilege manipulation (CVSS 7.7, Red Hat Enterprise Linux)
- [CVE-2025-0875](https://cve.now/CVE-2025-0875.md): IDOR in Proliz Software's OBS (CVSS 6.5, PROLIZ Computer Software Hardware Service Trade Ltd. OBS)
- [CVE-2025-10789](https://cve.now/CVE-2025-10789.md): SourceCodester Online Hotel Reservation System deleteslide.php sql injection (CVSS 6.9, SourceCodester Online Hotel Reservation System)
- [CVE-2025-10788](https://cve.now/CVE-2025-10788.md): SourceCodester Online Hotel Reservation System deleteroominventory.php sql injection (CVSS 6.9, SourceCodester Online Hotel Reservation System)
- [CVE-2025-10787](https://cve.now/CVE-2025-10787.md): MuYuCMS Add Fiend Link index.html server-side request forgery (CVSS 5.3, MuYuCMS)
- [CVE-2025-10786](https://cve.now/CVE-2025-10786.md): Campcodes Grocery Sales and Inventory System ajax.php sql injection (CVSS 6.9, Campcodes Grocery Sales and Inventory System)
- [CVE-2025-10785](https://cve.now/CVE-2025-10785.md): Campcodes Grocery Sales and Inventory System manage\_user.php sql injection (CVSS 6.9, Campcodes Grocery Sales and Inventory System)
- [CVE-2025-9541](https://cve.now/CVE-2025-9541.md): Markup Markdown \< 3.20.10 - Contributor+ Stored XSS (CVSS 4.7, Markup Markdown)
- [CVE-2025-9540](https://cve.now/CVE-2025-9540.md): Markup Markdown \< 3.20.10 - Contributor+ Stored XSS (CVSS 4.7, Markup Markdown)
- [CVE-2025-9487](https://cve.now/CVE-2025-9487.md): Admin and Site Enhancements \< 7.9.8 - Authenticated Stored XSS via SVG (CVSS 4.7, Admin and Site Enhancements)
- [CVE-2025-9115](https://cve.now/CVE-2025-9115.md): Etsy Shop \< 3.0.7 - Reflected XSS via $\_SERVER\['REQUEST\_URI'\] (CVSS 5.6, Etsy Shop)
- [CVE-2025-10784](https://cve.now/CVE-2025-10784.md): Campcodes Online Learning Management System edit\_subject.php sql injection (CVSS 6.9, Campcodes Online Learning Management System)
- [CVE-2025-10783](https://cve.now/CVE-2025-10783.md): Campcodes Online Learning Management System add\_subject.php sql injection (CVSS 6.9, Campcodes Online Learning Management System)
- [CVE-2025-10782](https://cve.now/CVE-2025-10782.md): Campcodes Online Learning Management System class.php sql injection (CVSS 6.9, Campcodes Online Learning Management System)
- [CVE-2025-10781](https://cve.now/CVE-2025-10781.md): Campcodes Online Learning Management System edit\_class.php sql injection (CVSS 6.9, Campcodes Online Learning Management System)
- [CVE-2025-10780](https://cve.now/CVE-2025-10780.md): CodeAstro Simple Pharmacy Management view.php sql injection (CVSS 5.3, CodeAstro Simple Pharmacy Management)
- [CVE-2025-10779](https://cve.now/CVE-2025-10779.md): D-Link DCS-935L HNAP1 sub\_402280 stack-based overflow (CVSS 8.7, D-Link DCS-935L)
- [CVE-2025-10778](https://cve.now/CVE-2025-10778.md): Smartstore Gift Voucher confirm race condition (CVSS 2.3, Smartstore)
- [CVE-2025-10777](https://cve.now/CVE-2025-10777.md): JSC R7 R7-Office Document Server downloadas path traversal (CVSS 5.3, JSC R7 R7-Office Document Server)
- [CVE-2025-10776](https://cve.now/CVE-2025-10776.md): LionCoders SalePro POS Login cleartext transmission (CVSS 6.3, LionCoders SalePro POS)
- [CVE-2025-10775](https://cve.now/CVE-2025-10775.md): Wavlink WL-NU516U1 login.cgi sub\_4012A0 os command injection (CVSS 5.1, Wavlink WL-NU516U1)
- [CVE-2025-10774](https://cve.now/CVE-2025-10774.md): Ruijie 6000-E10 sub\_commit.php os command injection (CVSS 5.1, Ruijie 6000-E10)
- [CVE-2025-10773](https://cve.now/CVE-2025-10773.md): B-Link BL-AC2100 Web Management set\_delshrpath\_cfg delshrpath stack-based overflow (CVSS 8.7, B-Link BL-AC2100)
- [CVE-2025-43953](https://cve.now/CVE-2025-43953.md): In 2wcom IP-4c 2.16, the web interface allows admin and manager users to execute arbitrary code as root via a ping or traceroute field on th (CVSS 8.8)
- [CVE-2025-51006](https://cve.now/CVE-2025-51006.md): Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the dlt\_linuxsll2\_cleanup() function in plugins/dlt\_linuxs (CVSS 7.8)
- [CVE-2025-52367](https://cve.now/CVE-2025-52367.md): Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field. (CVSS 5.4)
- [CVE-2025-55885](https://cve.now/CVE-2025-55885.md): SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Lign before v.2025-04-23 allows a remote attacker to escalate pri (CVSS 6.3)
- [CVE-2025-55886](https://cve.now/CVE-2025-55886.md): An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ARD. (CVSS 6.5)
- [CVE-2025-55887](https://cve.now/CVE-2025-55887.md): Cross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD. (CVSS 6.1)
- [CVE-2025-55888](https://cve.now/CVE-2025-55888.md): Cross-Site Scripting (XSS) vulnerability was discovered in the Ajax transaction manager endpoint of ARD. (CVSS 7.3)
- [CVE-2025-56074](https://cve.now/CVE-2025-56074.md): A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management Syste (CVSS 9.8)
- [CVE-2025-56075](https://cve.now/CVE-2025-56075.md): A SQL Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v (CVSS 5.4)
- [CVE-2025-57203](https://cve.now/CVE-2025-57203.md): MagicProject AI version 9.1 is affected by a Cross-Site Scripting (XSS) vulnerability within the chatbot generation feature available to aut (CVSS 4.8)
- [CVE-2025-57204](https://cve.now/CVE-2025-57204.md): Stocky POS with Inventory Management & HRM (ui-lib) version 5.0 is affected by a Stored Cross-Site Scripting (XSS) vulnerability within the (CVSS 5.4)
- [CVE-2025-57205](https://cve.now/CVE-2025-57205.md): iNiLabs School Express (SMS Express) 6.2 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the content-management features (CVSS 5.4)
- [CVE-2025-57430](https://cve.now/CVE-2025-57430.md): Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get. (CVSS 7.5)
- [CVE-2025-57431](https://cve.now/CVE-2025-57431.md): The Sound4 PULSE-ECO AES67 1.22 web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update (CVSS 8.8)
- [CVE-2025-57432](https://cve.now/CVE-2025-57432.md): Blackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts unauthenticated commands. (CVSS 9.8)
- [CVE-2025-57433](https://cve.now/CVE-2025-57433.md): The 2wcom IP-4c 2.15.5 device's web interface includes an information disclosure vulnerability. (CVSS 6.5)
- [CVE-2025-57434](https://cve.now/CVE-2025-57434.md): Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. (CVSS 8.8)
- [CVE-2025-57437](https://cve.now/CVE-2025-57437.md): The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service on port 9977. (CVSS 9.8)
- [CVE-2025-57438](https://cve.now/CVE-2025-57438.md): The 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability. (CVSS 6.8)
- [CVE-2025-57439](https://cve.now/CVE-2025-57439.md): Creacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible via the edit.php endpoint. (CVSS 8.8)
- [CVE-2025-57440](https://cve.now/CVE-2025-57440.md): The Blackmagic ATEM Mini Pro 2.7 exposes an undocumented Telnet service on TCP port 9993, which accepts unauthenticated plaintext commands f (CVSS 7.5)
- [CVE-2025-57441](https://cve.now/CVE-2025-57441.md): The Blackmagic ATEM Mini Pro 2.7 exposes sensitive device and stream configuration information via an unauthenticated Telnet service on port (CVSS 9.8)
- [CVE-2025-57601](https://cve.now/CVE-2025-57601.md): AiKaan Cloud Controller uses a single hardcoded SSH private key and the username \`proxyuser\` for remote terminal access to all managed IoT/e (CVSS 9.8)
- [CVE-2025-57602](https://cve.now/CVE-2025-57602.md): Insufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined with the use of a shared, hardcoded SSH priv (CVSS 9.8)
- [CVE-2025-57605](https://cve.now/CVE-2025-57605.md): Lack of server-side authorisation on department admin assignment APIs in AiKaan IoT Platform allows authenticated users to elevate their pri (CVSS 8.8)
- [CVE-2025-57682](https://cve.now/CVE-2025-57682.md): Directory Traversal vulnerability in Papermark 0.20.0 and prior allows authenticated attackers to retrieve arbitrary files from an S3 bucket (CVSS 6.5)
- [CVE-2025-57685](https://cve.now/CVE-2025-57685.md): The LB-Link routers, including the BL-AC2100\_AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000\_AE4 v2.4.9, BL-AC1900\_AZ2 v1.0.2, BL-X26\_AC8 v1.2.8, an (CVSS 8.8)
- [CVE-2025-59797](https://cve.now/CVE-2025-59797.md): Profession Fit 5.0.99 Build 44910 allows authorization bypass via a direct request for /api/challenges/{id} and also URLs for eversports, th (CVSS 5.8, Profession Fit)
- [CVE-2025-59798](https://cve.now/CVE-2025-59798.md): Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf\_write\_cmap in devices/vector/gdevpdtw.c. (CVSS 4.3, Artifex Ghostscript)
- [CVE-2025-59799](https://cve.now/CVE-2025-59799.md): Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark\_coerce\_dest in devices/vector/gdevpdfm.c via a large size v (CVSS 4.3, Artifex Ghostscript)
- [CVE-2025-59800](https://cve.now/CVE-2025-59800.md): In Artifex Ghostscript through 10.05.1, ocr\_begin\_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer ove (CVSS 4.3, Artifex Ghostscript)
- [CVE-2025-59801](https://cve.now/CVE-2025-59801.md): In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps\_unpredict\_tiff in xpstiff.c because the samplesperpixel va (CVSS 4.3, Artifex GhostXPS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-09-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.