# CVEs published 2025-10-18

42 CVEs were published on October 18, 2025: 4 critical, 6 high. Days are UTC.

- [CVE-2025-47410](https://cve.now/CVE-2025-47410.md): Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system (CVSS 8.8, Apache Software Foundation Apache Geode · org.apache.geode:…)
- [CVE-2025-11926](https://cve.now/CVE-2025-11926.md): Related Posts Lite \<= 1.12 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, wpdreams Related Posts Lite)
- [CVE-2025-9890](https://cve.now/CVE-2025-9890.md): Theme Editor \<= 3.0 - Cross-Site Request Forgery to Remote Code Execution (CVSS 8.8, mndpsingh287 Theme Editor)
- [CVE-2025-40003](https://cve.now/CVE-2025-40003.md): net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (no CVSS, Linux)
- [CVE-2025-40002](https://cve.now/CVE-2025-40002.md): thunderbolt: Fix use-after-free in tb\_dp\_dprx\_work (no CVSS, Linux)
- [CVE-2025-40001](https://cve.now/CVE-2025-40001.md): scsi: mvsas: Fix use-after-free bugs in mvs\_work\_queue (no CVSS, Linux)
- [CVE-2025-5555](https://cve.now/CVE-2025-5555.md): Nixdorf Wincor PORT IO Driver IOCTL wnport.sys sub\_11100 stack-based overflow (CVSS 8.5, Nixdorf Wincor PORT IO Driver)
- [CVE-2025-10750](https://cve.now/CVE-2025-10750.md): PowerBI Embed Reports \<= 1.2.0 - Unauthenticated Sensitive Information Disclosure (CVSS 5.3, cyberlord92 PowerBI Embed Reports)
- [CVE-2025-11256](https://cve.now/CVE-2025-11256.md): Kognetiks Chatbot \<= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing (CVSS 5.3, Kognetiks Chatbot for WordPress)
- [CVE-2025-11691](https://cve.now/CVE-2025-11691.md): PPOM – Product Addons & Custom Fields for WooCommerce \<= 33.0.15 - Unauthenticated SQL Injection (CVSS 7.5, themeisle PPOM – Product Addons & Custom Fields for WooComm…)
- [CVE-2025-11372](https://cve.now/CVE-2025-11372.md): LearnPress – WordPress LMS Plugin \<= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation (CVSS 6.5, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2025-11391](https://cve.now/CVE-2025-11391.md): PPOM – Product Addons & Custom Fields for WooCommerce \<= 33.0.15 - Unauthenticated Arbitrary File Upload (CVSS 9.8, themeisle PPOM – Product Addons & Custom Fields for WooComm…)
- [CVE-2025-11270](https://cve.now/CVE-2025-11270.md): Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns \<= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2025-11519](https://cve.now/CVE-2025-11519.md): Image optimization service by Optimole \<= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload (CVSS 4.3, Optimole – Optimize Images in Real Time)
- [CVE-2025-11510](https://cve.now/CVE-2025-11510.md): FileBird \<= 6.4.9 - Improper Authorization to Authenticated (Author+) Settings Reset (CVSS 4.3, ninjateam FileBird – WordPress Media Library Folders & File…)
- [CVE-2025-9562](https://cve.now/CVE-2025-9562.md): Redirection for Contact Form 7 \<= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs\_date Shortcode (CVSS 6.4, themeisle Redirection for Contact Form)
- [CVE-2025-11703](https://cve.now/CVE-2025-11703.md): WP Go Maps (formerly WP Google Maps) \<= 9.0.48 - Unauthenticated Cache Poisoning (CVSS 5.3, wpgmaps WP Go Maps)
- [CVE-2025-10006](https://cve.now/CVE-2025-10006.md): WPBakery Page Builder \<= 8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, WPBakery Page Builder)
- [CVE-2025-10187](https://cve.now/CVE-2025-10187.md): GSpeech TTS – WordPress Text To Speech Plugin \<= 3.17.13 - Authenticated (Admin+) SQL injection (CVSS 4.9, creative-solutions-1 GSpeech TTS – WordPress Text To Speech…)
- [CVE-2025-11741](https://cve.now/CVE-2025-11741.md): WPC Smart Quick View for WooCommerce \<= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure (CVSS 5.3, wpclever WPC Smart Quick View for WooCommerce)
- [CVE-2025-11517](https://cve.now/CVE-2025-11517.md): Event Tickets and Registration \<= 5.26.5 - Unauthenticated Ticket Payment Bypass (CVSS 7.5, stellarwp Event Tickets and Registration)
- [CVE-2025-11742](https://cve.now/CVE-2025-11742.md): WPC Smart Wishlist for WooCommerce \<= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information Exposure (CVSS 4.3, wpclever WPC Smart Wishlist for WooCommerce)
- [CVE-2025-11857](https://cve.now/CVE-2025-11857.md): XX2WP Integration Tools \<= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mxp XX2WP Integration Tools)
- [CVE-2025-11738](https://cve.now/CVE-2025-11738.md): Media Library Assistant \<= 3.29 - Unauthenticated Limited File Read (CVSS 5.3, dglingren Media Library Assistant)
- [CVE-2025-11937](https://cve.now/CVE-2025-11937.md): Stored XSS through a system message in SecurePoll (CVSS 6.9, The Wikimedia Foundation Mediawiki - SecurePoll Extension)
- [CVE-2025-62666](https://cve.now/CVE-2025-62666.md): DoS vector through the cirrusbuilddoc query API (CVSS 6.9, The Wikimedia Foundation Mediawiki - CirrusSearch Extension)
- [CVE-2025-62667](https://cve.now/CVE-2025-62667.md): Stored XSS through article extracts in GrowthExperiments (CVSS 6.9, The Wikimedia Foundation Mediawiki - GrowthExperiments Exte…)
- [CVE-2025-62668](https://cve.now/CVE-2025-62668.md): Insufficient permission checks in action=growthsetmentor (CVSS 6.9, The Wikimedia Foundation Mediawiki - GrowthExperiments Exte…)
- [CVE-2025-62669](https://cve.now/CVE-2025-62669.md): UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks (CVSS 6.9, The Wikimedia Foundation Mediawiki - CentralAuth Extension)
- [CVE-2025-62670](https://cve.now/CVE-2025-62670.md): Stored XSS through a system message in FlexDiagrams (CVSS 6.9, The Wikimedia Foundation Mediawiki - FlexDiagrams Extension)
- [CVE-2025-11361](https://cve.now/CVE-2025-11361.md): Essential Blocks \<= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery (CVSS 6.4, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2025-62671](https://cve.now/CVE-2025-62671.md): Stored XSS through wikitext in Cargo (CVSS 6.9, The Wikimedia Foundation Mediawiki - Cargo Extension · medi…)
- [CVE-2025-62662](https://cve.now/CVE-2025-62662.md): Stored XSS through system messages in AdvancedSearch (CVSS 6.9, The Wikimedia Foundation Mediawiki - AdvancedSearch Extensi…)
- [CVE-2025-62663](https://cve.now/CVE-2025-62663.md): Stored XSS through a system message in UploadWizard (CVSS 6.9, The Wikimedia Foundation Mediawiki - UploadWizard Extension)
- [CVE-2025-62664](https://cve.now/CVE-2025-62664.md): Stored XSS through a system message in ImageRating (CVSS 6.9, The Wikimedia Foundation Mediawiki - ImageRating Extension)
- [CVE-2025-62665](https://cve.now/CVE-2025-62665.md): Stored XSS through system messages in Skin:BlueSky (CVSS 6.9, Wikimedia Foundation Mediawiki - Skin:BlueSky)
- [CVE-2017-20208](https://cve.now/CVE-2017-20208.md): RegistrationMagic - Custom Registration Forms \<= 3.7.9.2 - PHP Object Injection (CVSS 9.8, metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2017-20207](https://cve.now/CVE-2017-20207.md): Flickr Gallery \<= 1.5.2 - Unauthenticated PHP Object Injection (CVSS 9.8, Dan Coulter Flickr Gallery)
- [CVE-2020-36854](https://cve.now/CVE-2020-36854.md): Async JavaScript \<= 2.19.07.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, cloughit Async JavaScript)
- [CVE-2017-20206](https://cve.now/CVE-2017-20206.md): Appointments \<= 2.2.1 - Unauthenticated PHP Object Injection (CVSS 9.8, wpmudev Appointments)
- [CVE-2020-36853](https://cve.now/CVE-2020-36853.md): 10WebMapBuilder \<= 1.0.63 - Unauthenticated Stored Cross-Site Scripting via Plugin Settings Change (CVSS 7.2, 10Web Map Builder for Google Maps)
- [CVE-2025-11378](https://cve.now/CVE-2025-11378.md): ShortPixel Image Optimizer \<= 6.3.4 - Authenticated (Contributor+) Settings Import/Export (CVSS 5.4, ShortPixel Image Optimizer – Optimize Images, Convert WebP…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.