CVEs published October 25, 2025
39 CVEs were published on October 25, 2025: 4 critical, 6 high.
- Published
- 39
- Critical
- 4
- High
- 6
- Medium
- 26
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- Azure Access Technology BLU-IC2 · Azure Access Technology B…
- 6
- themeum Tutor LMS – eLearning and online course solution
- 2
- woobewoo Product Filter for WooCommerce by WBW
- 2
- alignak Fast Velocity Minify
- 1
- astoundify Simple Registration for WooCommerce
- 1
- cyberlord92 Password Policy Manager | Password Manager
- 1
- devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…
- 1
- digitalmeactivecampaign eRoom – Webinar & Meeting Plugin fo…
- 1
- dr-thomas-fuessl SpendeOnline.org
- 1
- Dream-Theme The7 — Website and eCommerce Builder for WordPr…
- 1
Critical 4
- CVE-2025-12220Busybox 1.31.1 - Multiple Known VulnerabilitiesAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12219Vulnerable Components in Azure Access OSAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12218Weak Default CredentialsAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12216Malicious / Malformed App can be Installed but not UninstalledAzure Access Technology BLU-IC2 · Azure Access Technology B…
High 6
- CVE-2025-8416Product Filter by WBW <= 2.9.7 - Unauthenticated SQL Injectionwoobewoo Product Filter for WooCommerce by WBW
- CVE-2025-4203wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Functiontomdever wpForo Forum
- CVE-2025-9322Stripe Payment Forms <= 8.3.1 - Unauthenticated SQL Injectionthemeisle Stripe Payment Forms by WP Full Pay – Accept Cred…
- CVE-2025-10488Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Movewpwax Directorist: AI-Powered Business Directory, Listings…
- CVE-2025-12095Simple Registration for WooCommerce <= 1.5.8 - Cross-Site Request Forgery to Privilege Escalation via Role Request Approvalastoundify Simple Registration for WooCommerce
- CVE-2025-11238Watu Quiz <= 3.4.4 - Unauthenticated Stored Cross-Site Scripting via HTTP Refererprasunsen Watu Quiz
Medium, low and unrated 29
- CVE-2025-55757Extension - virtuemart.net - XSS in VirtueMart component 1.0.0 - 4.4.10 for Joomlavirtuemart.net Virtuemart component for Joomla
- CVE-2025-12221CSRF Token not Properly ImplementedAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12217SNMP Default Community String (public)Azure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-11897The7 — Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css'Dream-Theme The7 — Website and eCommerce Builder for WordPr…
- CVE-2025-11875SpendeOnline.org <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingdr-thomas-fuessl SpendeOnline.org
- CVE-2025-11976FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Cross-Site Request Forgery to Sync Rule CreationFuseWP – WordPress User Sync to Email List & Marketing Auto…
- CVE-2025-10637Social Feed Gallery <= 4.9.2 - Missing Authorization to Unauthenticated Information Exposurequadlayers Social Feed Gallery
- CVE-2025-8483Discussion Board – WordPress Forum Plugin <= 2.5.5 - Authenticated (Subscriber+) Arbitrary Shortcode Executionmarketingfire Discussion Board – WordPress Forum Plugin
- CVE-2025-10580Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingmarketingfire Widget Options – Advanced Conditional Visibil…
- CVE-2025-11255Password Policy Manager | Password Manager <= 2.0.5 - Missing Authorization to Authenticated (Subscriber+) Configuration Log Outcyberlord92 Password Policy Manager | Password Manager
- CVE-2025-11497Advanced Database Cleaner <= 3.1.6 - Cross-Site Request Forgery to Settings Manipulationsymptote Advanced Database Cleaner – Optimize & Clean Datab…
- CVE-2025-11893Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injectionsmub Charitable – Donation Plugin for WordPress – Fundraisi…
- CVE-2025-12034Fast Velocity Minify <= 3.5.1 - Authenticated (Admin+) Stored Cross-Site Scriptingalignak Fast Velocity Minify
- CVE-2025-12005WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Updaterextheme WP VR – 360 Panorama and Free Virtual Tour Builder…
- CVE-2025-10694User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.8.0 - Missing Authorization to Information Disclosuresmub UserFeedback – Create Interactive Feedback Form, User…
- CVE-2025-6639Tutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignmentsthemeum Tutor LMS Pro
- CVE-2025-11888ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Updateroxnor ShopEngine Elementor WooCommerce Builder Addon – All…
- CVE-2025-10737Open Source Genesis Framework <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple ShortcodesStudioPress Open Source Genesis Framework
- CVE-2025-11879GenerateBlocks <= 2.1.1 - Improper Authorization to Authenticated (Contributor+) Arbitrary Options Disclosureedge22 GenerateBlocks
- CVE-2025-8588Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingPublishPress Blocks – Block Controls, Block Visibility, Blo…
- CVE-2025-11244Password Protected <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofingsaadiqbal Password Protected — Lock Entire Site, Pages, Pos…
- CVE-2025-11564Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Updatethemeum Tutor LMS – eLearning and online course solution
- CVE-2025-8666Testimonial Carousel For Elementor <= 11.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetsuapp Testimonial Carousel For Elementor
- CVE-2025-6680Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposurethemeum Tutor LMS – eLearning and online course solution
- CVE-2025-8413Listeo <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundcloud Shortcodepurethemes Listeo - Directory & Listings With Booking - Wor…
- CVE-2025-11269Product Filter by WBW <= 3.0.0 - Missing Authorization to Unauthenticated Settings Updatewoobewoo Product Filter for WooCommerce by WBW
- CVE-2025-11823ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodedevitemsllc ShopLentor – All-in-One WooCommerce Growth & St…
- CVE-2025-10579BackWPup <= 5.5.0 - Missing Authorization to Sensitive Information Exposurewp_media BackWPup – WordPress Backup & Restore Plugin
- CVE-2025-11760eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.5.6 - Unauthenticated Sensitive Information Exposuredigitalmeactivecampaign eRoom – Webinar & Meeting Plugin fo…