# CVEs published 2025-10-25

39 CVEs were published on October 25, 2025: 4 critical, 6 high. Days are UTC.

- [CVE-2025-55757](https://cve.now/CVE-2025-55757.md): Extension - virtuemart.net - XSS in VirtueMart component 1.0.0 - 4.4.10 for Joomla (CVSS 6.1, virtuemart.net Virtuemart component for Joomla)
- [CVE-2025-12221](https://cve.now/CVE-2025-12221.md): CSRF Token not Properly Implemented (CVSS 2.1, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12220](https://cve.now/CVE-2025-12220.md): Busybox 1.31.1 - Multiple Known Vulnerabilities (CVSS 10.0, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12219](https://cve.now/CVE-2025-12219.md): Vulnerable Components in Azure Access OS (CVSS 10.0, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12218](https://cve.now/CVE-2025-12218.md): Weak Default Credentials (CVSS 10.0, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12217](https://cve.now/CVE-2025-12217.md): SNMP Default Community String (public) (CVSS 6.9, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12216](https://cve.now/CVE-2025-12216.md): Malicious / Malformed App can be Installed but not Uninstalled (CVSS 10.0, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-11897](https://cve.now/CVE-2025-11897.md): The7 — Ultimate WordPress & WooCommerce Theme \<= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7\_fancy\_title\_css' (CVSS 6.4, Dream-Theme The7 — Website and eCommerce Builder for WordPr…)
- [CVE-2025-11875](https://cve.now/CVE-2025-11875.md): SpendeOnline.org \<= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, dr-thomas-fuessl SpendeOnline.org)
- [CVE-2025-11976](https://cve.now/CVE-2025-11976.md): FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) \<= 1.1.23.0 - Cross-Site Request Forgery to Sync Rule Creation (CVSS 4.3, FuseWP – WordPress User Sync to Email List & Marketing Auto…)
- [CVE-2025-8416](https://cve.now/CVE-2025-8416.md): Product Filter by WBW \<= 2.9.7 - Unauthenticated SQL Injection (CVSS 7.5, woobewoo Product Filter for WooCommerce by WBW)
- [CVE-2025-4203](https://cve.now/CVE-2025-4203.md): wpForo Forum \<= 2.4.8 - Unauthenticated SQL Injection via get\_members Function (CVSS 7.5, tomdever wpForo Forum)
- [CVE-2025-10637](https://cve.now/CVE-2025-10637.md): Social Feed Gallery \<= 4.9.2 - Missing Authorization to Unauthenticated Information Exposure (CVSS 5.3, quadlayers Social Feed Gallery)
- [CVE-2025-8483](https://cve.now/CVE-2025-8483.md): Discussion Board – WordPress Forum Plugin \<= 2.5.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 6.3, marketingfire Discussion Board – WordPress Forum Plugin)
- [CVE-2025-9322](https://cve.now/CVE-2025-9322.md): Stripe Payment Forms \<= 8.3.1 - Unauthenticated SQL Injection (CVSS 7.5, themeisle Stripe Payment Forms by WP Full Pay – Accept Cred…)
- [CVE-2025-10580](https://cve.now/CVE-2025-10580.md): Widget Options – The #1 WordPress Widget & Block Control Plugin \<= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, marketingfire Widget Options – Advanced Conditional Visibil…)
- [CVE-2025-11255](https://cve.now/CVE-2025-11255.md): Password Policy Manager | Password Manager \<= 2.0.5 - Missing Authorization to Authenticated (Subscriber+) Configuration Log Out (CVSS 4.3, cyberlord92 Password Policy Manager | Password Manager)
- [CVE-2025-11497](https://cve.now/CVE-2025-11497.md): Advanced Database Cleaner \<= 3.1.6 - Cross-Site Request Forgery to Settings Manipulation (CVSS 4.3, symptote Advanced Database Cleaner – Optimize & Clean Datab…)
- [CVE-2025-11893](https://cve.now/CVE-2025-11893.md): Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More \<= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, smub Charitable – Donation Plugin for WordPress – Fundraisi…)
- [CVE-2025-10488](https://cve.now/CVE-2025-10488.md): Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings \<= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move (CVSS 8.1, wpwax Directorist: AI-Powered Business Directory, Listings…)
- [CVE-2025-12034](https://cve.now/CVE-2025-12034.md): Fast Velocity Minify \<= 3.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, alignak Fast Velocity Minify)
- [CVE-2025-12095](https://cve.now/CVE-2025-12095.md): Simple Registration for WooCommerce \<= 1.5.8 - Cross-Site Request Forgery to Privilege Escalation via Role Request Approval (CVSS 8.8, astoundify Simple Registration for WooCommerce)
- [CVE-2025-12005](https://cve.now/CVE-2025-12005.md): WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress \<= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update (CVSS 4.3, rextheme WP VR – 360 Panorama and Free Virtual Tour Builder…)
- [CVE-2025-10694](https://cve.now/CVE-2025-10694.md): User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds \<= 1.8.0 - Missing Authorization to Information Disclosure (CVSS 5.3, smub UserFeedback – Create Interactive Feedback Form, User…)
- [CVE-2025-6639](https://cve.now/CVE-2025-6639.md): Tutor LMS Pro – eLearning and online course solution \<= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments (CVSS 5.4, themeum Tutor LMS Pro)
- [CVE-2025-11888](https://cve.now/CVE-2025-11888.md): ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution \<= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update (CVSS 2.7, roxnor ShopEngine Elementor WooCommerce Builder Addon – All…)
- [CVE-2025-10737](https://cve.now/CVE-2025-10737.md): Open Source Genesis Framework \<= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes (CVSS 6.4, StudioPress Open Source Genesis Framework)
- [CVE-2025-11879](https://cve.now/CVE-2025-11879.md): GenerateBlocks \<= 2.1.1 - Improper Authorization to Authenticated (Contributor+) Arbitrary Options Disclosure (CVSS 6.5, edge22 GenerateBlocks)
- [CVE-2025-8588](https://cve.now/CVE-2025-8588.md): Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks \<= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, PublishPress Blocks – Block Controls, Block Visibility, Blo…)
- [CVE-2025-11244](https://cve.now/CVE-2025-11244.md): Password Protected \<= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing (CVSS 3.7, saadiqbal Password Protected — Lock Entire Site, Pages, Pos…)
- [CVE-2025-11564](https://cve.now/CVE-2025-11564.md): Tutor LMS – eLearning and online course solution \<= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update (CVSS 5.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2025-8666](https://cve.now/CVE-2025-8666.md): Testimonial Carousel For Elementor \<= 11.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, uapp Testimonial Carousel For Elementor)
- [CVE-2025-6680](https://cve.now/CVE-2025-6680.md): Tutor LMS \<= 3.8.3 - Missing Authorization to Sensitive Information Exposure (CVSS 4.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2025-8413](https://cve.now/CVE-2025-8413.md): Listeo \<= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundcloud Shortcode (CVSS 6.4, purethemes Listeo - Directory & Listings With Booking - Wor…)
- [CVE-2025-11238](https://cve.now/CVE-2025-11238.md): Watu Quiz \<= 3.4.4 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer (CVSS 7.2, prasunsen Watu Quiz)
- [CVE-2025-11269](https://cve.now/CVE-2025-11269.md): Product Filter by WBW \<= 3.0.0 - Missing Authorization to Unauthenticated Settings Update (CVSS 5.3, woobewoo Product Filter for WooCommerce by WBW)
- [CVE-2025-11823](https://cve.now/CVE-2025-11823.md): ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution \<= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2025-10579](https://cve.now/CVE-2025-10579.md): BackWPup \<= 5.5.0 - Missing Authorization to Sensitive Information Exposure (CVSS 5.3, wp\_media BackWPup – WordPress Backup & Restore Plugin)
- [CVE-2025-11760](https://cve.now/CVE-2025-11760.md): eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams \<= 1.5.6 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, digitalmeactivecampaign eRoom – Webinar & Meeting Plugin fo…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.