# CVEs published 2025-10-22

389 CVEs were published on October 22, 2025: 32 critical, 161 high. Days are UTC.

- [CVE-2025-62710](https://cve.now/CVE-2025-62710.md): Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl (CVSS 5.9, sakaiproject sakai · org.sakaiproject.kernel:sakai-kernel-i…)
- [CVE-2025-62708](https://cve.now/CVE-2025-62708.md): pypdf manipulated LZWDecode streams can exhaust RAM (CVSS 6.6, py-pdf pypdf · pypdf)
- [CVE-2025-62707](https://cve.now/CVE-2025-62707.md): pypdf affected by possible infinite loop when reading DCT inline images without EOF marker (CVSS 6.6, py-pdf pypdf · pypdf)
- [CVE-2025-62706](https://cve.now/CVE-2025-62706.md): Authlib : JWE zip=DEF decompression bomb enables DoS (CVSS 6.5, authlib)
- [CVE-2025-62705](https://cve.now/CVE-2025-62705.md): OpenBao and Vault Leak \[\]byte Fields in Audit Logs (CVSS 5.7, openbao · github.com/openbao/openbao)
- [CVE-2025-62617](https://cve.now/CVE-2025-62617.md): Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality (CVSS 7.2, admidio · admidio/admidio)
- [CVE-2025-62614](https://cve.now/CVE-2025-62614.md): BookLore Media API Authentication Bypass (CVSS 8.7, booklore-app booklore)
- [CVE-2025-62613](https://cve.now/CVE-2025-62613.md): VDO.Ninja Reflected XSS Vulnerability in control.html (CVSS 6.9, steveseguin vdo.ninja)
- [CVE-2025-62612](https://cve.now/CVE-2025-62612.md): FastGPT File Reading Node SSRF Vulnerability (CVSS 6.9, labring FastGPT)
- [CVE-2025-62611](https://cve.now/CVE-2025-62611.md): aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server (CVSS 8.2, aio-libs aiomysql · aiomysql)
- [CVE-2025-62247](https://cve.now/CVE-2025-62247.md): Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025 (CVSS 2.0, Liferay Portal · Liferay DXP +1)
- [CVE-2025-62610](https://cve.now/CVE-2025-62610.md): Hono Improperly Authorizes JWT Audience Validation (CVSS 8.1, honojs hono · hono)
- [CVE-2025-62513](https://cve.now/CVE-2025-62513.md): OpenBao leaks HTTPRawBody in Audit Logs (CVSS 5.7, openbao · github.com/openbao/openbao)
- [CVE-2025-62248](https://cve.now/CVE-2025-62248.md): A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4. (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-58712](https://cve.now/CVE-2025-58712.md): Amq: privilege escalation via excessive /etc/passwd permissions (CVSS 6.4, apache activemq-artemis · Red Hat RHEL-9 based Middlewar… +1)
- [CVE-2025-24934](https://cve.now/CVE-2025-24934.md): SO\_REUSEPORT\_LB breaks connect(2) for UDP sockets (CVSS 5.4, FreeBSD)
- [CVE-2025-11957](https://cve.now/CVE-2025-11957.md): Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to (CVSS 9.0, Devolutions Server)
- [CVE-2025-11958](https://cve.now/CVE-2025-11958.md): An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticat (CVSS 5.1, Devolutions Server)
- [CVE-2025-22178](https://cve.now/CVE-2025-22178.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3, Atlassian Jira Align)
- [CVE-2025-22169](https://cve.now/CVE-2025-22169.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3, Atlassian Jira Align)
- [CVE-2025-22173](https://cve.now/CVE-2025-22173.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3, Atlassian Jira Align)
- [CVE-2025-22170](https://cve.now/CVE-2025-22170.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3, Atlassian Jira Align)
- [CVE-2025-22174](https://cve.now/CVE-2025-22174.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3, Atlassian Jira Align)
- [CVE-2025-22172](https://cve.now/CVE-2025-22172.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3, Atlassian Jira Align)
- [CVE-2025-22176](https://cve.now/CVE-2025-22176.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3, Atlassian Jira Align)
- [CVE-2025-22171](https://cve.now/CVE-2025-22171.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3, Atlassian Jira Align)
- [CVE-2025-22168](https://cve.now/CVE-2025-22168.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3, Atlassian Jira Align)
- [CVE-2025-22177](https://cve.now/CVE-2025-22177.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3, Atlassian Jira Align)
- [CVE-2025-22175](https://cve.now/CVE-2025-22175.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3, Atlassian Jira Align)
- [CVE-2025-40780](https://cve.now/CVE-2025-40780.md): Cache poisoning due to weak PRNG (CVSS 8.6, ISC BIND)
- [CVE-2025-40778](https://cve.now/CVE-2025-40778.md): Cache poisoning attacks with unsolicited RRs (CVSS 8.6, ISC BIND)
- [CVE-2025-8677](https://cve.now/CVE-2025-8677.md): Resource exhaustion via malformed DNSKEY handling (CVSS 7.5, ISC BIND)
- [CVE-2025-62607](https://cve.now/CVE-2025-62607.md): Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL (CVSS 5.3, nautobot-app-ssot · nautobot-ssot)
- [CVE-2025-62659](https://cve.now/CVE-2025-62659.md): The CookieConsent extension does not properly use reserved data attributes, thus introducing potential XSS vectors (CVSS 2.1, The Wikimedia Foundation MediaWiki CookieConsent extension)
- [CVE-2025-23299](https://cve.now/CVE-2025-23299.md): NVIDIA Bluefield and ConnectX contain a vulnerability in the management interface that could allow a malicious actor with high privilege acc (CVSS 6.7, NVIDIA BlueField GA · NVIDIA BlueField LTS22 +7)
- [CVE-2025-62606](https://cve.now/CVE-2025-62606.md): my little forum vulnerable to SQL Injection in Bookmark Reordering via bookmarks parameter (CVSS 8.8, My-Little-Forum mylittleforum)
- [CVE-2025-62604](https://cve.now/CVE-2025-62604.md): MeterSphere logic flaw allows retrieval of arbitrary user information (CVSS 5.3, metersphere)
- [CVE-2025-62526](https://cve.now/CVE-2025-62526.md): OpenWrt ubusd vulnerable to heap buffer overflow (CVSS 7.9, openwrt)
- [CVE-2025-62525](https://cve.now/CVE-2025-62525.md): OpenWrt vulnerable to local privilage escalation (CVSS 7.9, openwrt)
- [CVE-2025-11965](https://cve.now/CVE-2025-11965.md): In Eclipse Vert.x versions \[4.0.0, 4.5.21\] and \[5.0.0, 5.0.4\], a StaticHandler configuration for restricting access to hidden files fails to (CVSS 6.3, Eclipse Foundation Vert.x · io.vertx:vertx-web)
- [CVE-2025-11966](https://cve.now/CVE-2025-11966.md): In Eclipse Vert.x versions \[4.0.0, 4.5.21\] and \[5.0.0, 5.0.4\], when "directory listing" is enabled, file and directory names are inserted in (CVSS 2.3, Eclipse Foundation Vert.x · io.vertx:vertx-web)
- [CVE-2025-62073](https://cve.now/CVE-2025-62073.md): WordPress MeetingHub plugin \<= 1.23.9 - Broken Access Control vulnerability (CVSS 4.3, Sovlix MeetingHub)
- [CVE-2025-62072](https://cve.now/CVE-2025-62072.md): WordPress Front End Users plugin \<= 3.2.33 - Broken Access Control vulnerability (CVSS 4.3, Rustaurius Front End Users)
- [CVE-2025-62071](https://cve.now/CVE-2025-62071.md): WordPress Social proof testimonials and reviews by Repuso plugin \<= 5.29 - Broken Access Control vulnerability (CVSS 4.3, Social proof testimonials and reviews by Repuso)
- [CVE-2025-62070](https://cve.now/CVE-2025-62070.md): WordPress WowRevenue plugin \<= 1.2.13 - Broken Access Control vulnerability (CVSS 4.3, WPXPO WowRevenue)
- [CVE-2025-62069](https://cve.now/CVE-2025-62069.md): WordPress MDTF plugin \<= 1.3.3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RealMag777 MDTF)
- [CVE-2025-62068](https://cve.now/CVE-2025-62068.md): WordPress e2pdf plugin \<= 1.28.09 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, e2pdf)
- [CVE-2025-62063](https://cve.now/CVE-2025-62063.md): WordPress WP Travel Gutenberg Blocks plugin \<= 3.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Travel Gutenberg Blocks)
- [CVE-2025-62062](https://cve.now/CVE-2025-62062.md): WordPress Easy Post Submission plugin \<= 1.7.0 - Sensitive Data Exposure vulnerability (CVSS 5.3, ThemeRuby Easy Post Submission)
- [CVE-2025-62061](https://cve.now/CVE-2025-62061.md): WordPress Product Catalog Simple plugin \<= 1.8.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, impleCode Product Catalog Simple)
- [CVE-2025-62060](https://cve.now/CVE-2025-62060.md): WordPress Tab Ultimate plugin \<= 1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themepoints Tab Ultimate)
- [CVE-2025-62058](https://cve.now/CVE-2025-62058.md): WordPress Houzez Theme - Functionality plugin \< 4.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, favethemes Houzez Theme - Functionality)
- [CVE-2025-62054](https://cve.now/CVE-2025-62054.md): WordPress Houzez Theme - Functionality plugin \<= 4.1.8 - Local File Inclusion vulnerability (CVSS 7.5, favethemes Houzez Theme - Functionality)
- [CVE-2025-62052](https://cve.now/CVE-2025-62052.md): WordPress One Page Express Companion plugin \<= 1.6.43 - Broken Access Control vulnerability (CVSS 4.3, Horea Radu One Page Express Companion)
- [CVE-2025-62048](https://cve.now/CVE-2025-62048.md): WordPress SmartCrawl plugin \<= 3.14.3 - Broken Access Control vulnerability (CVSS 5.4, WPMU DEV - Your All-in-One WordPress Platform SmartCrawl)
- [CVE-2025-62042](https://cve.now/CVE-2025-62042.md): WordPress Event post plugin \<= 5.10.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Bastien Ho Event post)
- [CVE-2025-62029](https://cve.now/CVE-2025-62029.md): WordPress Grevo theme \<= 2.4 - Local File Inclusion vulnerability (CVSS 8.1, themesion Grevo)
- [CVE-2025-62027](https://cve.now/CVE-2025-62027.md): WordPress Event Tickets plugin \<= 5.26.3 - Broken Access Control vulnerability (CVSS 5.4, StellarWP Event Tickets)
- [CVE-2025-62026](https://cve.now/CVE-2025-62026.md): WordPress Blockspare plugin \<= 3.2.13.2 - Sensitive Data Exposure vulnerability (CVSS 4.3, Blockspare)
- [CVE-2025-62025](https://cve.now/CVE-2025-62025.md): WordPress JobSearch plugin \< 3.0.8 - PHP Object Injection vulnerability (CVSS 9.8, eyecix JobSearch)
- [CVE-2025-62024](https://cve.now/CVE-2025-62024.md): WordPress Pie Calendar plugin \<= 1.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jonathan Jernigan Pie Calendar)
- [CVE-2025-62023](https://cve.now/CVE-2025-62023.md): WordPress s2Member plugin \<= 250905 - Remote Code Execution (RCE) vulnerability (CVSS 9.0, Cristián Lávaque s2Member)
- [CVE-2025-62022](https://cve.now/CVE-2025-62022.md): WordPress BuddyPress plugin \<= 14.3.4 - Broken Access Control vulnerability (CVSS 7.5, BuddyPress)
- [CVE-2025-62021](https://cve.now/CVE-2025-62021.md): WordPress Acknowledgify plugin \<= 1.1.3 - Broken Access Control vulnerability (CVSS 4.3, Made Neat Acknowledgify)
- [CVE-2025-62020](https://cve.now/CVE-2025-62020.md): WordPress VOD Infomaniak plugin \<= 1.5.11 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Infomaniak Network VOD Infomaniak)
- [CVE-2025-62019](https://cve.now/CVE-2025-62019.md): WordPress Recipe Card Blocks for Gutenberg & Elementor plugin \<= 3.4.8 - Broken Access Control vulnerability (CVSS 6.5, WPZOOM Recipe Card Blocks for Gutenberg & Elementor)
- [CVE-2025-62015](https://cve.now/CVE-2025-62015.md): WordPress Advanced Coupons for WooCommerce Coupons plugin \<= 4.6.8 - SQL Injection vulnerability (CVSS 7.6, Josh Kohlbach Advanced Coupons for WooCommerce Coupons)
- [CVE-2025-62013](https://cve.now/CVE-2025-62013.md): WordPress UiChemy plugin \<= 4.0.0 - Broken Access Control vulnerability (CVSS 4.3, POSIMYTH UiChemy)
- [CVE-2025-62009](https://cve.now/CVE-2025-62009.md): WordPress UPC/EAN/GTIN Code Generator plugin \<= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generat…)
- [CVE-2025-62008](https://cve.now/CVE-2025-62008.md): WordPress Product Table For WooCommerce plugin \<= 1.2.4 - PHP Object Injection vulnerability (CVSS 8.8, acowebs Product Table For WooCommerce)
- [CVE-2025-62007](https://cve.now/CVE-2025-62007.md): WordPress Voice Feedback plugin \<= 1.0.3 - Privilege Escalation vulnerability (CVSS 8.8, bPlugins Voice Feedback)
- [CVE-2025-62006](https://cve.now/CVE-2025-62006.md): WordPress WP SMS plugin \<= 7.0.1 - Broken Access Control vulnerability (CVSS 5.4, VeronaLabs WP SMS)
- [CVE-2025-62005](https://cve.now/CVE-2025-62005.md): WordPress SUMO Memberships for WooCommerce plugin \< 7.8.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, FantasticPlugins SUMO Memberships for WooCommerce)
- [CVE-2025-60246](https://cve.now/CVE-2025-60246.md): WordPress Simple Finance Calculator plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, weissmike Simple Finance Calculator)
- [CVE-2025-60238](https://cve.now/CVE-2025-60238.md): WordPress UNIVERSAM plugin \<= 9.04.02 - PHP Object Injection vulnerability (CVSS 9.8, UNIVERSAM)
- [CVE-2025-60234](https://cve.now/CVE-2025-60234.md): WordPress Single Property theme \<= 2.8 - PHP Object Injection vulnerability (CVSS 8.8, designthemes Single Property)
- [CVE-2025-60232](https://cve.now/CVE-2025-60232.md): WordPress KBx Pro Ultimate plugin \<= 8.0.5 - PHP Object Injection vulnerability (CVSS 9.8, quantumcloud KBx Pro Ultimate)
- [CVE-2025-60228](https://cve.now/CVE-2025-60228.md): WordPress Knowledge Base theme \<= 2.9 - PHP Object Injection vulnerability (CVSS 8.8, designthemes Knowledge Base)
- [CVE-2025-60227](https://cve.now/CVE-2025-60227.md): WordPress WP Pipes plugin \<= 1.4.3 - Arbitrary File Deletion vulnerability (CVSS 8.6, ThimPress WP Pipes)
- [CVE-2025-60226](https://cve.now/CVE-2025-60226.md): WordPress White Rabbit theme \<= 1.5.2 - PHP Object Injection vulnerability (CVSS 9.8, axiomthemes White Rabbit)
- [CVE-2025-60225](https://cve.now/CVE-2025-60225.md): WordPress BugsPatrol theme \<= 1.5.0 - PHP Object Injection vulnerability (CVSS 9.8, AncoraThemes BugsPatrol)
- [CVE-2025-60224](https://cve.now/CVE-2025-60224.md): WordPress Subscribe to Download plugin \<= 2.0.9 - PHP Object Injection vulnerability (CVSS 9.8, wpshuffle Subscribe to Download)
- [CVE-2025-60222](https://cve.now/CVE-2025-60222.md): WordPress SUMO Memberships for WooCommerce plugin \<= 7.8.0 - Privilege Escalation vulnerability (CVSS 8.8, FantasticPlugins SUMO Memberships for WooCommerce)
- [CVE-2025-60221](https://cve.now/CVE-2025-60221.md): WordPress Captivate Sync Plugin \<= 3.0.3 - PHP Object Injection Vulnerability (CVSS 9.8, captivateaudio Captivate Sync)
- [CVE-2025-60220](https://cve.now/CVE-2025-60220.md): WordPress CouponXxL theme \<= 3.0.0 - Privilege Escalation vulnerability (CVSS 9.8, pebas CouponXxL)
- [CVE-2025-60217](https://cve.now/CVE-2025-60217.md): WordPress PT Luxa Addons Plugin \<= 1.2.2 - Arbitrary File Deletion Vulnerability (CVSS 7.7, ypromo PT Luxa Addons)
- [CVE-2025-60216](https://cve.now/CVE-2025-60216.md): WordPress Addison theme \< 1.4.8 - PHP Object Injection vulnerability (CVSS 9.8, BoldThemes Addison)
- [CVE-2025-60215](https://cve.now/CVE-2025-60215.md): WordPress Kriya theme \<= 3.4 - PHP Object Injection Vulnerability (CVSS 8.8, designthemes Kriya)
- [CVE-2025-60214](https://cve.now/CVE-2025-60214.md): WordPress Goldenblatt theme \< 1.3.0 - PHP Object Injection vulnerability (CVSS 9.8, BoldThemes Goldenblatt)
- [CVE-2025-60213](https://cve.now/CVE-2025-60213.md): WordPress Scape theme \<= 1.5.13 - PHP Object Injection vulnerability (CVSS 9.8, Whitebox-Studio Scape)
- [CVE-2025-60212](https://cve.now/CVE-2025-60212.md): WordPress VEDA Theme \<= 4.2 - PHP Object Injection Vulnerability (CVSS 8.8, designthemes VEDA)
- [CVE-2025-60211](https://cve.now/CVE-2025-60211.md): WordPress WooCommerce Registration Fields Plugin - Custom Signup Fields plugin \<= 3.2.3 - Privilege Escalation vulnerability (CVSS 8.8, extendons WooCommerce Registration Fields Plugin - Custom S…)
- [CVE-2025-60210](https://cve.now/CVE-2025-60210.md): WordPress Everest Forms - Frontend Listing plugin \<= 1.0.5 - PHP Object Injection Vulnerability (CVSS 9.8, wpeverest Everest Forms - Frontend Listing)
- [CVE-2025-60209](https://cve.now/CVE-2025-60209.md): WordPress Connector for Gravity Forms and Google Sheets plugin \<= 1.2.6 - PHP Object Injection vulnerability (CVSS 9.8, CRM Perks Connector for Gravity Forms and Google Sheets)
- [CVE-2025-60208](https://cve.now/CVE-2025-60208.md): WordPress Advanced Custom Fields : CPT Options Pages plugin \<= 2.0.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8, Tusko Trush Advanced Custom Fields : CPT Options Pages)
- [CVE-2025-60206](https://cve.now/CVE-2025-60206.md): WordPress Alone theme \<= 7.8.3 - Remote Code Execution (RCE) vulnerability (CVSS 10.0, Beplusthemes Alone)
- [CVE-2025-60176](https://cve.now/CVE-2025-60176.md): WordPress WP Tesseract Plugin \<= 1.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, tattersoftware WP Tesseract)
- [CVE-2025-60168](https://cve.now/CVE-2025-60168.md): WordPress HotelRunner Booking Widget Plugin \<= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, integrationshotelrunner HotelRunner Booking Widget)
- [CVE-2025-60151](https://cve.now/CVE-2025-60151.md): WordPress WP Gravity Forms HubSpot Plugin \<= 1.2.5 - Open Redirection Vulnerability (CVSS 4.7, CRM Perks WP Gravity Forms HubSpot)
- [CVE-2025-60135](https://cve.now/CVE-2025-60135.md): WordPress WeShare Buttons Plugin \<= 13.0.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, NIKITAS GEORGOPOULOS WeShare Buttons)
- [CVE-2025-60134](https://cve.now/CVE-2025-60134.md): WordPress WP Media Categories Plugin \<= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, John James Jacoby WP Media Categories)
- [CVE-2025-60132](https://cve.now/CVE-2025-60132.md): WordPress Video Blogster Lite Plugin \<= 1.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, johnh10 Video Blogster Lite)
- [CVE-2025-60131](https://cve.now/CVE-2025-60131.md): WordPress Werk aan de Muur Plugin \<= 1.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Zoefff Werk aan de Muur)
- [CVE-2025-60041](https://cve.now/CVE-2025-60041.md): WordPress Emails Catch All plugin \<= 3.5.3 - Broken Authentication vulnerability (CVSS 8.8, Iulia Cazan Emails Catch All)
- [CVE-2025-60039](https://cve.now/CVE-2025-60039.md): WordPress Noisa theme \<= 2.6.0 - PHP Object Injection vulnerability (CVSS 9.8, rascals Noisa)
- [CVE-2025-59593](https://cve.now/CVE-2025-59593.md): WordPress Colibri Page Builder Plugin \< 1.0.334 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Extend Themes Colibri Page Builder)
- [CVE-2025-59580](https://cve.now/CVE-2025-59580.md): WordPress Goodlayers Core plugin \< 2.1.7 - Privilege Escalation vulnerability (CVSS 8.8, Goodlayers Core)
- [CVE-2025-59579](https://cve.now/CVE-2025-59579.md): WordPress Simple Job Board plugin \<= 2.13.7 - Sensitive Data Exposure vulnerability (CVSS 7.5, PressTigers Simple Job Board)
- [CVE-2025-59578](https://cve.now/CVE-2025-59578.md): WordPress ShopMagic plugin \<= 4.5.6 - Sensitive Data Exposure vulnerability (CVSS 5.8, wpdesk ShopMagic)
- [CVE-2025-59575](https://cve.now/CVE-2025-59575.md): WordPress MasterStudy LMS plugin \<= 3.6.20 - Sensitive Data Exposure vulnerability (CVSS 4.9, Stylemix MasterStudy LMS)
- [CVE-2025-59571](https://cve.now/CVE-2025-59571.md): WordPress WorkScout-Core plugin \< 1.7.06 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, purethemes WorkScout-Core)
- [CVE-2025-59566](https://cve.now/CVE-2025-59566.md): WordPress Workreap (theme's plugin) plugin \<= 3.3.5 - Arbitrary File Deletion vulnerability (CVSS 7.7, AmentoTech Workreap)
- [CVE-2025-59564](https://cve.now/CVE-2025-59564.md): WordPress EduMall Theme \< 4.4.5 - Local File Inclusion Vulnerability (CVSS 8.1, ThemeMove EduMall)
- [CVE-2025-59558](https://cve.now/CVE-2025-59558.md): WordPress Billey Theme \< 2.1.6 - Local File Inclusion Vulnerability (CVSS 8.1, ThemeMove Billey)
- [CVE-2025-59557](https://cve.now/CVE-2025-59557.md): WordPress Learts Addons Plugin \< 1.7.5 - SQL Injection Vulnerability (CVSS 9.3, ThemeMove Learts Addons)
- [CVE-2025-59555](https://cve.now/CVE-2025-59555.md): WordPress Medizin Theme \< 1.9.7 - Local File Inclusion Vulnerability (CVSS 8.1, ThemeMove Medizin)
- [CVE-2025-59550](https://cve.now/CVE-2025-59550.md): WordPress Xcare theme \< 6.5 - Local File Inclusion vulnerability (CVSS 8.1, designervily Xcare)
- [CVE-2025-59007](https://cve.now/CVE-2025-59007.md): WordPress TF Woo Product Grid Addon For Elementor Plugin \<= 1.0.1 - Deserialization of untrusted data Vulnerability (CVSS 9.8, themesflat TF Woo Product Grid Addon For Elementor)
- [CVE-2025-59006](https://cve.now/CVE-2025-59006.md): WordPress Easy Woocommerce Customizer plugin \<= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, themebon Easy Woocommerce Customizer)
- [CVE-2025-59004](https://cve.now/CVE-2025-59004.md): WordPress WC Return products plugin \<= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, pco\_58 WC Return products)
- [CVE-2025-58971](https://cve.now/CVE-2025-58971.md): WordPress Doctreat theme \<= 1.6.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, AmentoTech Doctreat)
- [CVE-2025-58970](https://cve.now/CVE-2025-58970.md): WordPress Doctreat theme \<= 1.6.7 - Content Injection vulnerability (CVSS 6.3, AmentoTech Doctreat)
- [CVE-2025-58967](https://cve.now/CVE-2025-58967.md): WordPress Businext theme \< 2.4.4 - Local File Inclusion vulnerability (CVSS 8.1, ThemeMove Businext)
- [CVE-2025-58966](https://cve.now/CVE-2025-58966.md): WordPress NEX-Forms LITE plugin \< 8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Basix NEX-Forms LITE)
- [CVE-2025-58963](https://cve.now/CVE-2025-58963.md): WordPress Medcity theme \< 1.1.9 - Arbitrary File Upload vulnerability (CVSS 10.0, 7oroof Medcity)
- [CVE-2025-58961](https://cve.now/CVE-2025-58961.md): WordPress CF7 Auto Responder Addon plugin \<= 2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kamleshyadav CF7 Auto Responder Addon)
- [CVE-2025-58959](https://cve.now/CVE-2025-58959.md): WordPress Taskbot plugin \<= 6.4 - Arbitrary File Deletion vulnerability (CVSS 7.7, AmentoTech Taskbot)
- [CVE-2025-58958](https://cve.now/CVE-2025-58958.md): WordPress SmilePure Theme \< 1.8.5 - Local File Inclusion Vulnerability (CVSS 8.1, ThemeMove SmilePure)
- [CVE-2025-58955](https://cve.now/CVE-2025-58955.md): WordPress Karzo theme \< 2.6 - Local File Inclusion vulnerability (CVSS 8.1, designervily Karzo)
- [CVE-2025-58921](https://cve.now/CVE-2025-58921.md): WordPress WP Tactical Popup plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Arevico WP Tactical Popup)
- [CVE-2025-58916](https://cve.now/CVE-2025-58916.md): WordPress Author: Munzir plugin \<= 0.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Author: Munzir)
- [CVE-2025-53428](https://cve.now/CVE-2025-53428.md): WordPress Simple User Registration plugin \<= 6.8 - Privilege Escalation vulnerability (CVSS 8.8, N-Media Simple User Registration)
- [CVE-2025-53427](https://cve.now/CVE-2025-53427.md): WordPress SEO Pyramid plugin \<= 1.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Chibueze Okechukwu SEO Pyramid)
- [CVE-2025-53426](https://cve.now/CVE-2025-53426.md): WordPress Likert Survey Master plugin \<= 0.8.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bob Likert Survey Master)
- [CVE-2025-53425](https://cve.now/CVE-2025-53425.md): WordPress Dokan plugin \<= 4.1.3 - Privilege Escalation vulnerability (CVSS 7.2, Dokan)
- [CVE-2025-53424](https://cve.now/CVE-2025-53424.md): WordPress WooCommerce Orders & Customers Exporter plugin \<= 5.4 - Broken Access Control vulnerability (CVSS 6.5, vanquish WooCommerce Orders & Customers Exporter)
- [CVE-2025-53423](https://cve.now/CVE-2025-53423.md): WordPress Triss theme \<= 2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, designthemes Triss)
- [CVE-2025-53422](https://cve.now/CVE-2025-53422.md): WordPress WhatsApp Chat for WordPress and WooCommerce plugin \<= 1.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeWarriors WhatsApp Chat for WordPress and WooCommerce)
- [CVE-2025-53421](https://cve.now/CVE-2025-53421.md): WordPress Accordion plugin \<= 2.3.14 - Broken Access Control vulnerability (CVSS 6.5, PickPlugins Accordion)
- [CVE-2025-53420](https://cve.now/CVE-2025-53420.md): WordPress WPLMS plugin \<= 1.9.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, VibeThemes WPLMS)
- [CVE-2025-53352](https://cve.now/CVE-2025-53352.md): WordPress Grid Plus plugin \<= 3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, G5Theme Grid Plus)
- [CVE-2025-53351](https://cve.now/CVE-2025-53351.md): WordPress Fidelo Snippet plugin \<= 1.12 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Fidelo Software Fidelo Snippet)
- [CVE-2025-53350](https://cve.now/CVE-2025-53350.md): WordPress Calendar Plus plugin \<= 1.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, webjunk Calendar Plus)
- [CVE-2025-53297](https://cve.now/CVE-2025-53297.md): WordPress Woocommerce Envato Affiliates plugin \<= 1.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AA-Team Woocommerce Envato Affiliates)
- [CVE-2025-53238](https://cve.now/CVE-2025-53238.md): WordPress Toast Mobile Menu plugin \<= 1.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Toast Plugins Toast Mobile Menu)
- [CVE-2025-53236](https://cve.now/CVE-2025-53236.md): WordPress UDesign Core plugin \<= 4.14.0 - Broken Access Control vulnerability (CVSS 6.3, AndonDesign UDesign Core)
- [CVE-2025-53234](https://cve.now/CVE-2025-53234.md): WordPress UDesign Core plugin \<= 4.14.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AndonDesign UDesign Core)
- [CVE-2025-53232](https://cve.now/CVE-2025-53232.md): WordPress WP Gmail SMTP plugin \<= 1.0.7 - Sensitive Data Exposure vulnerability (CVSS 5.8, inkthemes WP Gmail SMTP)
- [CVE-2025-53229](https://cve.now/CVE-2025-53229.md): WordPress RockON DJ theme \<= 3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kamleshyadav RockON DJ)
- [CVE-2025-53218](https://cve.now/CVE-2025-53218.md): WordPress AppExperts plugin \<= 1.4.5 - Sensitive Data Exposure vulnerability (CVSS 5.8, Saad Iqbal AppExperts)
- [CVE-2025-52770](https://cve.now/CVE-2025-52770.md): WordPress Hello Followers plugin \<= 2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, appscreo Hello Followers)
- [CVE-2025-52763](https://cve.now/CVE-2025-52763.md): WordPress Nifty Backups plugin \<= 1.08 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NickDuncan Nifty Backups)
- [CVE-2025-52760](https://cve.now/CVE-2025-52760.md): WordPress MultiSite Clone Duplicator plugin \<= 1.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Globalis MultiSite Clone Duplicator)
- [CVE-2025-52758](https://cve.now/CVE-2025-52758.md): WordPress Zippy plugin \<= 1.7.0 - Arbitrary File Upload vulnerability (CVSS 9.1, Gesundheit Bewegt Zippy)
- [CVE-2025-52757](https://cve.now/CVE-2025-52757.md): WordPress SUMO Memberships for WooCommerce plugin \< 7.8.0 - Arbitrary Content Deletion vulnerability (CVSS 6.5, FantasticPlugins SUMO Memberships for WooCommerce)
- [CVE-2025-52756](https://cve.now/CVE-2025-52756.md): WordPress WP Last Modified Info plugin \<= 1.9.4 - Remote Code Execution (RCE) vulnerability (CVSS 7.4, Sayan Datta WP Last Modified Info)
- [CVE-2025-52755](https://cve.now/CVE-2025-52755.md): WordPress Child Themes plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Chris Taylor Child Themes)
- [CVE-2025-52754](https://cve.now/CVE-2025-52754.md): WordPress Sello ChannelConnector plugin \<= 1.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, selloio Sello ChannelConnector)
- [CVE-2025-52753](https://cve.now/CVE-2025-52753.md): WordPress Contact Form by Supsystic plugin \<= 1.7.36 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Contact Form by Supsystic)
- [CVE-2025-52752](https://cve.now/CVE-2025-52752.md): WordPress IDonatePro plugin \<= 2.1.9 - Sensitive Data Exposure vulnerability (CVSS 6.5, ThemeAtelier IDonatePro)
- [CVE-2025-52751](https://cve.now/CVE-2025-52751.md): WordPress Slide Puzzle plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, colome Slide Puzzle)
- [CVE-2025-52750](https://cve.now/CVE-2025-52750.md): WordPress Emu2 plugin \<= 0.83b - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Juergen Schulze Emu2)
- [CVE-2025-52749](https://cve.now/CVE-2025-52749.md): WordPress Uji Countdown plugin \<= 2.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Activity Track Uji Countdown)
- [CVE-2025-52748](https://cve.now/CVE-2025-52748.md): WordPress Directory Pro plugin \<= 2.5.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, e-plugins Directory Pro)
- [CVE-2025-52743](https://cve.now/CVE-2025-52743.md): WordPress oik-privacy-policy plugin \<= 1.4.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, bobbingwide oik-privacy-policy)
- [CVE-2025-52742](https://cve.now/CVE-2025-52742.md): WordPress Pets Plugin \<= 1.4.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Igor Benic Pets)
- [CVE-2025-52741](https://cve.now/CVE-2025-52741.md): WordPress Post Connector Plugin \<= 1.0.11 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Barry Kooij Post Connector)
- [CVE-2025-52740](https://cve.now/CVE-2025-52740.md): WordPress Boldermail Plugin \<= 2.4.0 - PHP Object Injection Vulnerability (CVSS 8.8, Hernan Villanueva Boldermail)
- [CVE-2025-52738](https://cve.now/CVE-2025-52738.md): WordPress Wikipedia Preview plugin \<= 1.15.0 - Broken Access Control vulnerability (CVSS 6.5, Wikimedia Foundation Wikipedia Preview)
- [CVE-2025-52737](https://cve.now/CVE-2025-52737.md): WordPress WP Store Locator plugin \<= 2.2.260 - PHP Object Injection vulnerability (CVSS 8.8, Tijmen Smit WP Store Locator)
- [CVE-2025-52736](https://cve.now/CVE-2025-52736.md): WordPress Finale Lite Plugin \<= 2.20.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Daman Jeet Finale Lite)
- [CVE-2025-52735](https://cve.now/CVE-2025-52735.md): WordPress NextMove Lite plugin \<= 2.24.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, XLPlugins NextMove Lite)
- [CVE-2025-52734](https://cve.now/CVE-2025-52734.md): WordPress CropRefine Plugin \<= 1.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, ERA404 CropRefine)
- [CVE-2025-49992](https://cve.now/CVE-2025-49992.md): WordPress LearnPress Export Import plugin \<= 4.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThimPress LearnPress Export Import)
- [CVE-2025-49963](https://cve.now/CVE-2025-49963.md): WordPress Simple Stripe Checkout plugin \<= 1.1.28 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, growniche Simple Stripe Checkout)
- [CVE-2025-49962](https://cve.now/CVE-2025-49962.md): WordPress bbPress Notify plugin \<= 2.19.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, useStrict bbPress Notify)
- [CVE-2025-49961](https://cve.now/CVE-2025-49961.md): WordPress Breeze Checkout plugin \<= 1.4.0 - Broken Access Control vulnerability (CVSS 6.5, Breeze Team Breeze Checkout)
- [CVE-2025-49960](https://cve.now/CVE-2025-49960.md): WordPress LeadBI Plugin for WordPress plugin \<= 1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, LeadBI Plugin for WordPress)
- [CVE-2025-49959](https://cve.now/CVE-2025-49959.md): WordPress bbPress Move Topics plugin \<= 1.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pascal Casier bbPress Move Topics)
- [CVE-2025-49958](https://cve.now/CVE-2025-49958.md): WordPress Robokassa payment gateway for Woocommerce plugin \<= 1.8.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Robokassa payment gateway for Woocommerce)
- [CVE-2025-49957](https://cve.now/CVE-2025-49957.md): WordPress Email Attachment by Order Status & Products Plugin \<= 1.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Weboccult Technologies Pvt Email Attachment by Order Status…)
- [CVE-2025-49956](https://cve.now/CVE-2025-49956.md): WordPress Fade Slider plugin \<= 2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Anandaraj Balu Fade Slider)
- [CVE-2025-49955](https://cve.now/CVE-2025-49955.md): WordPress WP Smart Flexslider Plugin \<= 2.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Rajan Vijayan WP Smart Flexslider)
- [CVE-2025-49954](https://cve.now/CVE-2025-49954.md): WordPress WP-Click-Tracker Plugin \<= 0.7.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, mithra62 WP-Click-Tracker)
- [CVE-2025-49953](https://cve.now/CVE-2025-49953.md): WordPress ShareBang, Ultimate Social Share Buttons for WordPress Plugin \<= 1.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, themeinity ShareBang, Ultimate Social Share Buttons for Wor…)
- [CVE-2025-49952](https://cve.now/CVE-2025-49952.md): WordPress Houzez theme \<= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, favethemes Houzez)
- [CVE-2025-49951](https://cve.now/CVE-2025-49951.md): WordPress gAppointments Plugin \<= 1.14.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, wpcrunch gAppointments)
- [CVE-2025-49950](https://cve.now/CVE-2025-49950.md): WordPress Official Integration for Billingo plugin \<= 4.3.0 - Privilege Escalation vulnerability (CVSS 7.2, Official Integration for Billingo)
- [CVE-2025-49949](https://cve.now/CVE-2025-49949.md): WordPress Templazee plugin \<= 1.0.2 - Broken Access Control Vulnerability (CVSS 5.4, Templazee)
- [CVE-2025-49948](https://cve.now/CVE-2025-49948.md): WordPress WP Super Edit plugin \<= 2.5.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Ahmad Awais WP Super Edit)
- [CVE-2025-49947](https://cve.now/CVE-2025-49947.md): WordPress WooCommerce Registration Fields Plugin - Custom Signup Fields plugin \<= 3.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, extendons WooCommerce Registration Fields Plugin - Custom S…)
- [CVE-2025-49946](https://cve.now/CVE-2025-49946.md): WordPress Auto Login After Registration plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Cynob IT Consultancy Auto Login After Registration)
- [CVE-2025-49945](https://cve.now/CVE-2025-49945.md): WordPress Shortcode Generator plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kylegetson Shortcode Generator)
- [CVE-2025-49944](https://cve.now/CVE-2025-49944.md): WordPress WPCode Content Ratio plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jonatan Jumbert WPCode Content Ratio)
- [CVE-2025-49940](https://cve.now/CVE-2025-49940.md): WordPress Fusion Builder plugin \<= 3.13.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThemeFusion Fusion Builder)
- [CVE-2025-49939](https://cve.now/CVE-2025-49939.md): WordPress JetElements For Elementor plugin \<= 2.7.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetElements For Elementor)
- [CVE-2025-49938](https://cve.now/CVE-2025-49938.md): WordPress JetEngine plugin \<= 3.7.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetEngine)
- [CVE-2025-49937](https://cve.now/CVE-2025-49937.md): WordPress Smash Balloon Social Post Feed plugin \<= 4.3.2 - Broken Access Control vulnerability (CVSS 4.3, Syed Balkhi Smash Balloon Social Post Feed)
- [CVE-2025-49936](https://cve.now/CVE-2025-49936.md): WordPress WoodMart theme \< 8.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, xtemos WoodMart)
- [CVE-2025-49935](https://cve.now/CVE-2025-49935.md): WordPress WoodMart theme \< 8.3.2 - Local File Inclusion vulnerability (CVSS 7.5, xtemos WoodMart)
- [CVE-2025-49934](https://cve.now/CVE-2025-49934.md): WordPress JetBlocks For Elementor plugin \<= 1.3.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetBlocks For Elementor)
- [CVE-2025-49933](https://cve.now/CVE-2025-49933.md): WordPress JetBlog plugin \<= 2.4.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetBlog)
- [CVE-2025-49932](https://cve.now/CVE-2025-49932.md): WordPress JetBlog plugin \<= 2.4.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetBlog)
- [CVE-2025-49931](https://cve.now/CVE-2025-49931.md): WordPress JetSearch plugin \<= 3.5.10 - SQL Injection vulnerability (CVSS 9.3, Crocoblock JetSearch)
- [CVE-2025-49930](https://cve.now/CVE-2025-49930.md): WordPress JetSearch plugin \<= 3.5.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Crocoblock JetSearch)
- [CVE-2025-49929](https://cve.now/CVE-2025-49929.md): WordPress Ultimate Blocks plugin \<= 3.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ultimate Blocks)
- [CVE-2025-49928](https://cve.now/CVE-2025-49928.md): WordPress JetWooBuilder plugin \<= 2.1.20 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetWooBuilder)
- [CVE-2025-49927](https://cve.now/CVE-2025-49927.md): WordPress JetWooBuilder plugin \<= 2.1.20.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetWooBuilder)
- [CVE-2025-49926](https://cve.now/CVE-2025-49926.md): WordPress Kalium theme \<= 3.25 - Arbitrary Code Execution vulnerability (CVSS 7.2, Laborator Kalium)
- [CVE-2025-49925](https://cve.now/CVE-2025-49925.md): WordPress WPLMS plugin \<= 1.9.9.7 - Broken Access Control vulnerability (CVSS 7.5, VibeThemes WPLMS)
- [CVE-2025-49924](https://cve.now/CVE-2025-49924.md): WordPress Wholesale Suite plugin \<= 2.2.4.2 - Privilege Escalation vulnerability (CVSS 7.2, Josh Kohlbach Wholesale Suite)
- [CVE-2025-49923](https://cve.now/CVE-2025-49923.md): WordPress Seriously Simple Podcasting plugin \<= 3.11.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Craig Hewitt Seriously Simple Podcasting)
- [CVE-2025-49922](https://cve.now/CVE-2025-49922.md): WordPress WPeMatico RSS Feed Fetcher plugin \<= 2.8.3 - Broken Access Control vulnerability (CVSS 4.3, etruel WPeMatico RSS Feed Fetcher)
- [CVE-2025-49921](https://cve.now/CVE-2025-49921.md): WordPress JetReviews plugin \<= 3.0.0 - Local File Inclusion vulnerability (CVSS 7.5, Crocoblock JetReviews)
- [CVE-2025-49920](https://cve.now/CVE-2025-49920.md): WordPress Web Accessibility By accessiBe plugin \<= 2.10 - Broken Access Control vulnerability (CVSS 5.4, Web Accessibility By accessiBe)
- [CVE-2025-49917](https://cve.now/CVE-2025-49917.md): WordPress Icegram Express Pro plugin \<= 5.9.5 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, Icegram Express Pro)
- [CVE-2025-49916](https://cve.now/CVE-2025-49916.md): WordPress MultiVendorX plugin \<= 4.2.23 - Broken Access Control vulnerability (CVSS 8.6, MultiVendorX)
- [CVE-2025-49915](https://cve.now/CVE-2025-49915.md): WordPress SMS Alert Order Notifications plugin \<= 3.8.5 - SQL Injection vulnerability (CVSS 9.3, Cozy Vision SMS Alert Order Notifications)
- [CVE-2025-49913](https://cve.now/CVE-2025-49913.md): WordPress CoSchedule plugin \<= 3.4.0 - Broken Access Control vulnerability (CVSS 5.3, CoSchedule)
- [CVE-2025-49912](https://cve.now/CVE-2025-49912.md): WordPress Email Subscription Popup plugin \<= 1.2.26 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Nks Email Subscription Popup)
- [CVE-2025-49911](https://cve.now/CVE-2025-49911.md): WordPress WooCommerce Vehicle Parts Finder plugin \<= 3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpinstinct WooCommerce Vehicle Parts Finder)
- [CVE-2025-49910](https://cve.now/CVE-2025-49910.md): WordPress WPGuppy plugin \<= 1.1.4 - Broken Access Control vulnerability (CVSS 8.2, AmentoTech Private Limited WPGuppy)
- [CVE-2025-49908](https://cve.now/CVE-2025-49908.md): WordPress WPC Countdown Timer for WooCommerce plugin \<= 3.1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPClever WPC Countdown Timer for WooCommerce)
- [CVE-2025-49907](https://cve.now/CVE-2025-49907.md): WordPress MDTF plugin \<= 1.3.3.9 - Broken Access Control vulnerability (CVSS 4.3, RealMag777 MDTF)
- [CVE-2025-49906](https://cve.now/CVE-2025-49906.md): WordPress WPComplete plugin \<= 2.9.5.3 - Broken Access Control vulnerability (CVSS 5.3, StellarWP WPComplete)
- [CVE-2025-49903](https://cve.now/CVE-2025-49903.md): WordPress ZoloBlocks plugin \<= 2.3.11 - Broken Access Control vulnerability (CVSS 5.3, bdthemes ZoloBlocks)
- [CVE-2025-49901](https://cve.now/CVE-2025-49901.md): WordPress Simple Link Directory plugin \< 14.8.1 - Broken Authentication vulnerability (CVSS 9.8, quantumcloud Simple Link Directory)
- [CVE-2025-49899](https://cve.now/CVE-2025-49899.md): WordPress Whydonate plugin \<= 4.0.15 - Broken Access Control vulnerability (CVSS 5.3, jjlemstra Whydonate)
- [CVE-2025-49380](https://cve.now/CVE-2025-49380.md): WordPress WooCommerce Vehicle Parts Finder plugin \<= 3.7 - PHP Object Injection vulnerability (CVSS 9.8, wpinstinct WooCommerce Vehicle Parts Finder)
- [CVE-2025-49378](https://cve.now/CVE-2025-49378.md): WordPress Hydra Booking plugin \<= 1.1.10 - SQL Injection vulnerability (CVSS 8.5, Themefic Hydra Booking)
- [CVE-2025-49377](https://cve.now/CVE-2025-49377.md): WordPress Hydra Booking plugin \<= 1.1.9 - Broken Access Control vulnerability (CVSS 6.3, Themefic Hydra Booking)
- [CVE-2025-49376](https://cve.now/CVE-2025-49376.md): WordPress DELUCKS SEO plugin \<= 2.5.9 - Broken Access Control vulnerability (CVSS 5.3, DELUCKS SEO)
- [CVE-2025-49374](https://cve.now/CVE-2025-49374.md): WordPress Captcha.eu plugin \<= 1.0.61 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, Captcha.eu)
- [CVE-2025-49373](https://cve.now/CVE-2025-49373.md): WordPress Evergreen Content Poster plugin \<= 1.4.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Evergreen Content Poster)
- [CVE-2025-49060](https://cve.now/CVE-2025-49060.md): WordPress Wastia theme \< 1.1.3 - Arbitrary File Upload vulnerability (CVSS 10.0, CMSSuperHeroes Wastia)
- [CVE-2025-48338](https://cve.now/CVE-2025-48338.md): WordPress WP Abstracts plugin \<= 2.7.4 - Local File Inclusion vulnerability (CVSS 7.5, Kevon Adonis WP Abstracts)
- [CVE-2025-48106](https://cve.now/CVE-2025-48106.md): WordPress Clanora theme \< 1.3.1 - Arbitrary File Upload vulnerability (CVSS 10.0, CMSSuperHeroes Clanora)
- [CVE-2025-48099](https://cve.now/CVE-2025-48099.md): WordPress Search & Filter plugin \<= 1.2.17 - Cross Site Request Forgery (CSRF) to Open Redirect vulnerability (CVSS 4.7, Code Amp Search & Filter)
- [CVE-2025-48098](https://cve.now/CVE-2025-48098.md): WordPress Survey Maker plugin \<= 5.1.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ays Pro Survey Maker)
- [CVE-2025-48097](https://cve.now/CVE-2025-48097.md): WordPress WSAnalytics plugin \<= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Shiva WSAnalytics)
- [CVE-2025-48096](https://cve.now/CVE-2025-48096.md): WordPress Custom CSS plugin \<= 1.4.0 - Broken Access Control vulnerability (CVSS 6.5, FRESHFACE Custom CSS)
- [CVE-2025-48095](https://cve.now/CVE-2025-48095.md): WordPress Survey Maker plugin \<= 5.1.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Ays Pro Survey Maker)
- [CVE-2025-48093](https://cve.now/CVE-2025-48093.md): WordPress Password only login plugin \<= 0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Calvaweb Password only login)
- [CVE-2025-48092](https://cve.now/CVE-2025-48092.md): WordPress Fix Multiple Redirects plugin \<= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jurajpuchky Fix Multiple Redirects)
- [CVE-2025-48091](https://cve.now/CVE-2025-48091.md): WordPress AnyComment plugin \<= 0.3.6 - SQL Injection vulnerability (CVSS 8.5, Alexander AnyComment)
- [CVE-2025-48082](https://cve.now/CVE-2025-48082.md): WordPress Progress Planner plugin \<= 1.8.0 - Privilege Escalation vulnerability (CVSS 8.8, Progress Planner)
- [CVE-2025-39534](https://cve.now/CVE-2025-39534.md): WordPress Terms Dictionary Plugin \<= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Somonator Terms Dictionary)
- [CVE-2025-32657](https://cve.now/CVE-2025-32657.md): WordPress Testimonial Slider and Showcase Pro plugin \<= 2.1.7 - Local File Inclusion vulnerability (CVSS 7.5, RadiusTheme Testimonial Slider And Showcase Pro)
- [CVE-2025-32283](https://cve.now/CVE-2025-32283.md): WordPress Solar Energy theme \<= 3.5 - PHP Object Injection Vulnerability (CVSS 8.8, designthemes Solar Energy)
- [CVE-2025-31634](https://cve.now/CVE-2025-31634.md): WordPress Insurance theme \<= 3.5 - PHP Object Injection Vulnerability (CVSS 8.8, designthemes Insurance)
- [CVE-2025-30944](https://cve.now/CVE-2025-30944.md): WordPress Tablesome Table Premium \<= 1.1.23 - Broken Access Control Vulnerability (CVSS 7.5, Essekia Tablesome Table Premium)
- [CVE-2025-57870](https://cve.now/CVE-2025-57870.md): BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services. (CVSS 10.0, Esri ArcGIS Server)
- [CVE-2016-15048](https://cve.now/CVE-2016-15048.md): AMTT HiBOS Command Injection RCE via server\_ping.php (CVSS 10.0, Anmei Century (Beijing) Technology Co. Hotel Broadband Oper…)
- [CVE-2025-8848](https://cve.now/CVE-2025-8848.md): HTML Injection in Accept-Language Header in danny-avila/librechat (CVSS 4.8, danny-avila/librechat)
- [CVE-2023-53732](https://cve.now/CVE-2023-53732.md): fs/ntfs3: Fix NULL dereference in ni\_write\_inode (no CVSS, Linux)
- [CVE-2023-53731](https://cve.now/CVE-2023-53731.md): netlink: fix potential deadlock in netlink\_set\_err() (no CVSS, Linux)
- [CVE-2023-53730](https://cve.now/CVE-2023-53730.md): blk-iocost: use spin\_lock\_irqsave in adjust\_inuse\_and\_calc\_cost (no CVSS, Linux)
- [CVE-2023-53729](https://cve.now/CVE-2023-53729.md): soc: qcom: qmi\_encdec: Restrict string length in decode (CVSS 7.8, Linux)
- [CVE-2023-53728](https://cve.now/CVE-2023-53728.md): posix-timers: Ensure timer ID search-loop limit is valid (no CVSS, Linux)
- [CVE-2023-53727](https://cve.now/CVE-2023-53727.md): net/sched: fq\_pie: avoid stalls in fq\_pie\_timer() (no CVSS, Linux)
- [CVE-2023-53726](https://cve.now/CVE-2023-53726.md): arm64: csum: Fix OoB access in IP checksum code for negative lengths (CVSS 7.1, Linux)
- [CVE-2023-53725](https://cve.now/CVE-2023-53725.md): clocksource/drivers/cadence-ttc: Fix memory leak in ttc\_timer\_probe (no CVSS, Linux)
- [CVE-2023-53724](https://cve.now/CVE-2023-53724.md): mfd: pcf50633-adc: Fix potential memleak in pcf50633\_adc\_async\_read() (no CVSS, Linux)
- [CVE-2023-53723](https://cve.now/CVE-2023-53723.md): drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend (no CVSS, Linux)
- [CVE-2023-53722](https://cve.now/CVE-2023-53722.md): md: raid1: fix potential OOB in raid1\_remove\_disk() (no CVSS, Linux)
- [CVE-2023-53721](https://cve.now/CVE-2023-53721.md): wifi: ath12k: Fix a NULL pointer dereference in ath12k\_mac\_op\_hw\_scan() (no CVSS, Linux)
- [CVE-2023-53720](https://cve.now/CVE-2023-53720.md): net/mlx5e: Release the label when replacing existing ct entry (no CVSS, Linux)
- [CVE-2023-53719](https://cve.now/CVE-2023-53719.md): serial: arc\_uart: fix of\_iomap leak in \`arc\_serial\_probe\` (no CVSS, Linux)
- [CVE-2023-53718](https://cve.now/CVE-2023-53718.md): ring-buffer: Do not swap cpu\_buffer during resize process (CVSS 7.8, Linux)
- [CVE-2023-53717](https://cve.now/CVE-2023-53717.md): wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k\_wmi\_rsp\_callback() (no CVSS, Linux)
- [CVE-2023-53716](https://cve.now/CVE-2023-53716.md): net: fix skb leak in \_\_skb\_tstamp\_tx() (no CVSS, Linux)
- [CVE-2023-53715](https://cve.now/CVE-2023-53715.md): wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex (no CVSS, Linux)
- [CVE-2023-53714](https://cve.now/CVE-2023-53714.md): drm/stm: ltdc: fix late dereference check (no CVSS, Linux)
- [CVE-2023-53713](https://cve.now/CVE-2023-53713.md): arm64: sme: Use STR P to clear FFR context field in streaming SVE mode (CVSS 7.8, Linux)
- [CVE-2023-53712](https://cve.now/CVE-2023-53712.md): ARM: 9317/1: kexec: Make smp stop calls asynchronous (no CVSS, Linux)
- [CVE-2023-53711](https://cve.now/CVE-2023-53711.md): NFS: Fix a potential data corruption (CVSS 8.2, Linux)
- [CVE-2023-53710](https://cve.now/CVE-2023-53710.md): wifi: mt76: mt7921: fix error code of return in mt7921\_acpi\_read (no CVSS, Linux)
- [CVE-2023-53709](https://cve.now/CVE-2023-53709.md): ring-buffer: Handle race between rb\_move\_tail and rb\_check\_pages (no CVSS, Linux)
- [CVE-2023-53708](https://cve.now/CVE-2023-53708.md): ACPI: x86: s2idle: Catch multiple ACPI\_TYPE\_PACKAGE objects (no CVSS, Linux)
- [CVE-2023-53707](https://cve.now/CVE-2023-53707.md): drm/amdgpu: Fix integer overflow in amdgpu\_cs\_pass1 (CVSS 7.8, Linux)
- [CVE-2023-53706](https://cve.now/CVE-2023-53706.md): mm/vmemmap/devdax: fix kernel crash when probing devdax devices (no CVSS, Linux)
- [CVE-2023-53705](https://cve.now/CVE-2023-53705.md): ipv6: Fix out-of-bounds access in ipv6\_find\_tlv() (CVSS 8.2, Linux)
- [CVE-2023-53704](https://cve.now/CVE-2023-53704.md): clk: imx: clk-imx8mp: improve error handling in imx8mp\_clocks\_probe() (no CVSS, Linux)
- [CVE-2023-53703](https://cve.now/CVE-2023-53703.md): HID: amd\_sfh: Fix for shift-out-of-bounds (no CVSS, Linux)
- [CVE-2023-53702](https://cve.now/CVE-2023-53702.md): s390/crypto: use vector instructions only if available for ChaCha20 (no CVSS, Linux)
- [CVE-2023-53700](https://cve.now/CVE-2023-53700.md): media: max9286: Fix memleak in max9286\_v4l2\_register() (no CVSS, Linux)
- [CVE-2023-53699](https://cve.now/CVE-2023-53699.md): riscv: move memblock\_allow\_resize() after linear mapping is ready (no CVSS, Linux)
- [CVE-2023-53698](https://cve.now/CVE-2023-53698.md): xsk: fix refcount underflow in error path (CVSS 7.8, Linux)
- [CVE-2023-53697](https://cve.now/CVE-2023-53697.md): nvdimm: Fix memleak of pmu attr\_groups in unregister\_nvdimm\_pmu() (no CVSS, Linux)
- [CVE-2023-53696](https://cve.now/CVE-2023-53696.md): scsi: qla2xxx: Fix memory leak in qla2x00\_probe\_one() (no CVSS, Linux)
- [CVE-2023-53695](https://cve.now/CVE-2023-53695.md): udf: Detect system inodes linked into directory hierarchy (CVSS 7.8, Linux)
- [CVE-2023-53694](https://cve.now/CVE-2023-53694.md): riscv: ftrace: Fixup panic by disabling preemption (no CVSS, Linux)
- [CVE-2023-53693](https://cve.now/CVE-2023-53693.md): USB: gadget: Fix the memory leak in raw\_gadget driver (no CVSS, Linux)
- [CVE-2023-53692](https://cve.now/CVE-2023-53692.md): ext4: fix use-after-free read in ext4\_find\_extent for bigalloc + inline (CVSS 7.8, Linux)
- [CVE-2022-50582](https://cve.now/CVE-2022-50582.md): regulator: core: Prevent integer underflow (no CVSS, Linux)
- [CVE-2022-50581](https://cve.now/CVE-2022-50581.md): hfs: fix OOB Read in \_\_hfs\_brec\_find (CVSS 7.8, Linux)
- [CVE-2022-50580](https://cve.now/CVE-2022-50580.md): blk-throttle: prevent overflow while calculating wait time (no CVSS, Linux)
- [CVE-2022-50579](https://cve.now/CVE-2022-50579.md): arm64: ftrace: fix module PLTs with mcount (no CVSS, Linux)
- [CVE-2022-50578](https://cve.now/CVE-2022-50578.md): class: fix possible memory leak in \_\_class\_register() (no CVSS, Linux)
- [CVE-2022-50577](https://cve.now/CVE-2022-50577.md): ima: Fix memory leak in \_\_ima\_inode\_hash() (no CVSS, Linux)
- [CVE-2022-50576](https://cve.now/CVE-2022-50576.md): serial: pch: Fix PCI device refcount leak in pch\_request\_dma() (no CVSS, Linux)
- [CVE-2022-50575](https://cve.now/CVE-2022-50575.md): xen/privcmd: Fix a possible warning in privcmd\_ioctl\_mmap\_resource() (no CVSS, Linux)
- [CVE-2022-50574](https://cve.now/CVE-2022-50574.md): drm/omap: dss: Fix refcount leak bugs (no CVSS, Linux)
- [CVE-2022-50573](https://cve.now/CVE-2022-50573.md): wifi: mt76: mt7915: fix mt7915\_rate\_txpower\_get() resource leaks (no CVSS, Linux)
- [CVE-2022-50572](https://cve.now/CVE-2022-50572.md): ASoC: audio-graph-card: fix refcount leak of cpu\_ep in \_\_graph\_for\_each\_link() (no CVSS, Linux)
- [CVE-2022-50571](https://cve.now/CVE-2022-50571.md): btrfs: call \_\_btrfs\_remove\_free\_space\_cache\_locked on cache load failure (no CVSS, Linux)
- [CVE-2022-50570](https://cve.now/CVE-2022-50570.md): platform/chrome: fix memory corruption in ioctl (CVSS 7.8, Linux)
- [CVE-2022-50569](https://cve.now/CVE-2022-50569.md): xfrm: Update ipcomp\_scratches with NULL when freed (CVSS 7.8, Linux)
- [CVE-2022-50568](https://cve.now/CVE-2022-50568.md): usb: gadget: f\_hid: fix f\_hidg lifetime vs cdev (no CVSS, Linux)
- [CVE-2022-50567](https://cve.now/CVE-2022-50567.md): fs: jfs: fix shift-out-of-bounds in dbAllocAG (CVSS 7.8, Linux)
- [CVE-2022-50566](https://cve.now/CVE-2022-50566.md): mtd: Fix device name leak when register device failed in add\_mtd\_device() (no CVSS, Linux)
- [CVE-2022-50565](https://cve.now/CVE-2022-50565.md): wifi: plfxlc: fix potential memory leak in \_\_lf\_x\_usb\_enable\_rx() (no CVSS, Linux)
- [CVE-2022-50564](https://cve.now/CVE-2022-50564.md): s390/netiucv: Fix return type of netiucv\_tx() (no CVSS, Linux)
- [CVE-2022-50563](https://cve.now/CVE-2022-50563.md): dm thin: Fix UAF in run\_timer\_softirq() (no CVSS, Linux)
- [CVE-2022-50562](https://cve.now/CVE-2022-50562.md): tpm: acpi: Call acpi\_put\_table() to fix memory leak (no CVSS, Linux)
- [CVE-2022-50561](https://cve.now/CVE-2022-50561.md): iio: fix memory leak in iio\_device\_register\_eventset() (no CVSS, Linux)
- [CVE-2022-50560](https://cve.now/CVE-2022-50560.md): drm/meson: explicitly remove aggregate driver at module unload time (no CVSS, Linux)
- [CVE-2022-50559](https://cve.now/CVE-2022-50559.md): clk: imx: scu: fix memleak on platform\_device\_add() fails (no CVSS, Linux)
- [CVE-2022-50558](https://cve.now/CVE-2022-50558.md): regmap-irq: Use the new num\_config\_regs property in regmap\_add\_irq\_chip\_fwnode (no CVSS, Linux)
- [CVE-2022-50557](https://cve.now/CVE-2022-50557.md): pinctrl: thunderbay: fix possible memory leak in thunderbay\_build\_functions() (no CVSS, Linux)
- [CVE-2022-50556](https://cve.now/CVE-2022-50556.md): drm: Fix potential null-ptr-deref due to drmm\_mode\_config\_init() (no CVSS, Linux)
- [CVE-2025-11844](https://cve.now/CVE-2025-11844.md): XPath Injection in Hugging Face Smolagents search\_item\_ctrl\_f Function (CVSS 5.4, huggingface/smolagents · smolagents)
- [CVE-2025-11750](https://cve.now/CVE-2025-11750.md): User Enumeration via Distinct Error Messages in langgenius/dify-web (CVSS 4.3, langgenius/dify)
- [CVE-2025-11411](https://cve.now/CVE-2025-11411.md): Possible domain hijacking via promiscuous records in the authority section (CVSS 5.7, NLnet Labs Unbound)
- [CVE-2025-11086](https://cve.now/CVE-2025-11086.md): Academy LMS Pro \<= 3.3.7 - Unauthenticated Privilege Escalation via Social Login Addon (CVSS 8.1, academylms Academy LMS Pro)
- [CVE-2025-6833](https://cve.now/CVE-2025-6833.md): All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier \<= 2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Clocking In/Out (CVSS 4.3, codebangers All in One Time Clock Lite – Tracking Employee…)
- [CVE-2025-11915](https://cve.now/CVE-2025-11915.md): HTTP Desynchronisation in Vertex AI for certain third-party models (CVSS 6.9, Google Cloud Vertex AI: Partner Models for MaaS · Google… +1)
- [CVE-2025-11825](https://cve.now/CVE-2025-11825.md): Playerzbr \<= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Meta Field (CVSS 6.4, pedrolaxe Playerzbr)
- [CVE-2025-10047](https://cve.now/CVE-2025-10047.md): Email Tracker \<= 5.3.15 - Authenticated (Admin+) SQL Injection (CVSS 4.9, pmbaldha Email Tracker)
- [CVE-2025-11883](https://cve.now/CVE-2025-11883.md): Responsive Progress Bar \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, rene-puchinger Responsive Progress Bar)
- [CVE-2025-11817](https://cve.now/CVE-2025-11817.md): Simple Tableau Viz \<= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, garyhukkeri Simple Tableau Viz)
- [CVE-2025-11870](https://cve.now/CVE-2025-11870.md): Simple Business Data \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, dmbarber Simple Business Data)
- [CVE-2025-11867](https://cve.now/CVE-2025-11867.md): Bg Book Publisher \<= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, vbog Bg Book Publisher)
- [CVE-2025-11819](https://cve.now/CVE-2025-11819.md): WP-Thumbnail \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, robocasters WP-Thumbnail)
- [CVE-2025-11824](https://cve.now/CVE-2025-11824.md): Cinza Grid \<= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Skin Content Field (CVSS 6.4, madebycinza Cinza Grid)
- [CVE-2025-11866](https://cve.now/CVE-2025-11866.md): Photographers galleries \<= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, aurelienpierre Photographers galleries)
- [CVE-2025-11830](https://cve.now/CVE-2025-11830.md): WP Restaurant Listings \<= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdrift WP Restaurant Listings)
- [CVE-2025-11880](https://cve.now/CVE-2025-11880.md): SM CountDown Widget \<= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, sierramike SM CountDown Widget)
- [CVE-2025-11811](https://cve.now/CVE-2025-11811.md): Simple Youtube Shortcode \<= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, matthewmarichiba Simple Youtube Shortcode)
- [CVE-2025-11813](https://cve.now/CVE-2025-11813.md): Responsive iframe GoogleMap \<= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, pressmaninc Responsive iframe GoogleMap)
- [CVE-2025-11810](https://cve.now/CVE-2025-11810.md): Print Button Shortcode \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, chrishurst Name: Print Button Shortcode)
- [CVE-2025-11818](https://cve.now/CVE-2025-11818.md): WP Responsive Meet The Team \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, vobi WP Responsive Meet The Team)
- [CVE-2025-11807](https://cve.now/CVE-2025-11807.md): Mixlr Shortcode \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, mrgeorgegray Mixlr Shortcode)
- [CVE-2025-10138](https://cve.now/CVE-2025-10138.md): This-or-That by André Boekhorst \<= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, andrex84 This-or-That)
- [CVE-2025-11827](https://cve.now/CVE-2025-11827.md): Oboxmedia Ads \<= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, oboxgroup Oboxmedia Ads)
- [CVE-2025-11878](https://cve.now/CVE-2025-11878.md): ST Categories Widget \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, beautifultemplates ST Categories Widget)
- [CVE-2025-11809](https://cve.now/CVE-2025-11809.md): WP-Force Images Download \<= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, nazakatali32 WP-Force Images Download)
- [CVE-2025-11872](https://cve.now/CVE-2025-11872.md): Material Design Iconic Font Integration \<= 2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mcostales84 Material Design Iconic Font Integration)
- [CVE-2025-11804](https://cve.now/CVE-2025-11804.md): JB News Ticker \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, jobair JB News Ticker)
- [CVE-2025-11834](https://cve.now/CVE-2025-11834.md): WP AD Gallery \<= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wiellyam WP AD Gallery)
- [CVE-2025-11952](https://cve.now/CVE-2025-11952.md): Stored Cross-Site Scripting (XSS) in Oct8ne Chatbot (CVSS 5.3, Oct8ne Chatbot)
- [CVE-2025-41110](https://cve.now/CVE-2025-41110.md): Improper Authentication vulnerability in Ghost Robotics' Vision 60 (CVSS 7.0, Ghost Robotics Vision)
- [CVE-2025-41109](https://cve.now/CVE-2025-41109.md): Use of Hard-coded Credentials vulnerability in Ghost Robotics' Vision 60 (CVSS 8.7, Ghost Robotics Vision)
- [CVE-2025-41108](https://cve.now/CVE-2025-41108.md): Improper Authentication vulnerability in Ghost Robotics' Vision 60 (CVSS 9.2, Ghost Robotics Vision)
- [CVE-2025-41724](https://cve.now/CVE-2025-41724.md): Sauter: Crash via Incomplete SOAP Request (CVSS 7.5, Sauter modulo 6 devices modu680-AS · Sauter modulo 6 dev… +4)
- [CVE-2025-41723](https://cve.now/CVE-2025-41723.md): Sauter: Directory Traversal in importFile SOAP Method (CVSS 9.8, Sauter modulo 6 devices modu680-AS · Sauter modulo 6 dev… +4)
- [CVE-2025-41722](https://cve.now/CVE-2025-41722.md): Sauter: Hard-coded Authentication Credentials (CVSS 7.5, Sauter modulo 6 devices modu680-AS · Sauter modulo 6 dev… +4)
- [CVE-2025-41721](https://cve.now/CVE-2025-41721.md): Sauter: Command Injection (CVSS 2.7, Sauter modulo 6 devices modu680-AS · Sauter modulo 6 dev… +4)
- [CVE-2025-41720](https://cve.now/CVE-2025-41720.md): Sauter: Arbitrary File Upload (CVSS 4.3, Sauter modulo 6 devices modu680-AS · Sauter modulo 6 dev… +4)
- [CVE-2025-41719](https://cve.now/CVE-2025-41719.md): Sauter: Improper Validation of user-controlled data (CVSS 8.8, Sauter modulo 6 devices modu680-AS · Sauter modulo 6 dev… +4)
- [CVE-2025-10570](https://cve.now/CVE-2025-10570.md): Flexible Refund and Return Order for WooCommerce \<= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund (CVSS 4.3, wpdesk Flexible Refund and Return Order for WooCommerce)
- [CVE-2025-12033](https://cve.now/CVE-2025-12033.md): Simple Banner \<= 3.0.10 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, rpetersen29 Simple Banner – Easily add multiple Banners/Bar…)
- [CVE-2025-10588](https://cve.now/CVE-2025-10588.md): PixelYourSite \<= 11.1.2 – Cross-Site Request Forgery to GDPR Options Modification (CVSS 4.3, PixelYourSite – Your smart PIXEL (TAG) & API Manager)
- [CVE-2025-5983](https://cve.now/CVE-2025-5983.md): Meta Tag Manager \< 3.3 - Contributor+ Open Redirect (CVSS 6.5, Meta Tag Manager)
- [CVE-2025-10638](https://cve.now/CVE-2025-10638.md): NS Maintenance Mode for WP \<= 1.3.1 - Unauthenticated Subscribers Export (CVSS 5.3, NS Maintenance Mode for WP)
- [CVE-2025-10651](https://cve.now/CVE-2025-10651.md): Welcart e-Commerce \<= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order\_mail (CVSS 5.5, uscnanbu Welcart e-Commerce)
- [CVE-2025-22167](https://cve.now/CVE-2025-22167.md): This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of (CVSS 8.7, Atlassian Jira Software Data Center · Atlassian Jira Softwa…)
- [CVE-2023-53691](https://cve.now/CVE-2023-53691.md): Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2023-06-25 allows file upload via /center/api/files direc (CVSS 8.3, Hikvision CSMP iSecure Center)
- [CVE-2024-58274](https://cve.now/CVE-2024-58274.md): Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in / (CVSS 8.3, Hikvision CSMP iSecure Center)
- [CVE-2025-56447](https://cve.now/CVE-2025-56447.md): TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure. (CVSS 9.8)
- [CVE-2025-60331](https://cve.now/CVE-2025-60331.md): D-Link DIR-823G A1 v1.0.2B05 was discovered to contain a buffer overflow in the FillMacCloneMac parameter in the /EXCU\_SHELL endpoint. (CVSS 7.5)
- [CVE-2025-60332](https://cve.now/CVE-2025-60332.md): A NULL pointer dereference in the SetWLanRadioSettings function of D-Link DIR-823G A1 v1.0.2B05 allows attackers to cause a Denial of Servic (CVSS 7.5)
- [CVE-2025-60333](https://cve.now/CVE-2025-60333.md): TOTOLINK N600R v4.3.0cu.7866\_B20220506 was discovered to contain a stack overflow in the wepkey2 parameter in the setWiFiMultipleConfig func (CVSS 7.5)
- [CVE-2025-60334](https://cve.now/CVE-2025-60334.md): TOTOLINK N600R v4.3.0cu.7866\_B20220506 was discovered to contain a stack overflow in the ssid parameter in the setWiFiBasicConfig function. (CVSS 7.5)
- [CVE-2025-60335](https://cve.now/CVE-2025-60335.md): A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866\_B20220506 allows attackers to cause a Denial of Service (DoS (CVSS 7.5)
- [CVE-2025-60336](https://cve.now/CVE-2025-60336.md): A NULL pointer dereference in the sub\_41773C function of TOTOLINK N600R v4.3.0cu.7866\_B20220506 allows attackers to cause a Denial of Servic (CVSS 7.5)
- [CVE-2025-60337](https://cve.now/CVE-2025-60337.md): Tenda AC6 V2.0 15.03.06.50 was discovered to contain a buffer overflow in the speed\_dir parameter in the SetSpeedWan function. (CVSS 7.5)
- [CVE-2025-60338](https://cve.now/CVE-2025-60338.md): Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the DhcpListClient function. (CVSS 7.5)
- [CVE-2025-60339](https://cve.now/CVE-2025-60339.md): Multiple buffer overflow vulnerabilities in the openSchedWifi function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial of Serv (CVSS 7.5)
- [CVE-2025-60340](https://cve.now/CVE-2025-60340.md): Multiple buffer overflows in the SetClientState function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial of Service (DoS) via (CVSS 7.5)
- [CVE-2025-60341](https://cve.now/CVE-2025-60341.md): Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the ssid parameter in the fast\_setting\_wifi\_set function. (CVSS 7.5)
- [CVE-2025-60342](https://cve.now/CVE-2025-60342.md): Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the addressNat function. (CVSS 7.5)
- [CVE-2025-60343](https://cve.now/CVE-2025-60343.md): Multiple buffer overflows in the AdvSetMacMtuWan function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial of Service (DoS) via (CVSS 7.5)
- [CVE-2025-61035](https://cve.now/CVE-2025-61035.md): The seffaflik thru 0.0.9 is vulnerable to symlink attacks due to incorrect default permissions given to the .kimlik file and .seffaflik file (CVSS 7.7)
- [CVE-2025-62771](https://cve.now/CVE-2025-62771.md): Mercku M6a devices through 2.1.0 allow password changes via intranet CSRF attacks. (CVSS 7.5, Mercku M6a)
- [CVE-2025-62772](https://cve.now/CVE-2025-62772.md): On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases. (CVSS 3.1, Mercku M6a)
- [CVE-2025-62773](https://cve.now/CVE-2025-62773.md): Mercku M6a devices through 2.1.0 allow TELNET sessions via a router.telnet.enabled.update request by an administrator. (CVSS 2.4, Mercku M6a)
- [CVE-2025-62774](https://cve.now/CVE-2025-62774.md): On Mercku M6a devices through 2.1.0, the authentication system uses predictable session tokens based on timestamps. (CVSS 3.1, Mercku M6a)
- [CVE-2025-62775](https://cve.now/CVE-2025-62775.md): Mercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password. (CVSS 8.0, Mercku M6a)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.