CVEs published November 1, 2025
33 CVEs were published on November 1, 2025: 5 critical, 9 high.
- Published
- 33
- Critical
- 5
- High
- 9
- Medium
- 17
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Azure Access Technology BLU-IC2 · Azure Access Technology B…
- 5
- aonetheme Service Finder Bookings
- 2
- hogash KALLYAS - Creative eCommerce Multi-Purpose WordPress…
- 2
- anthonyeden RESTful Content Syndication
- 1
- barn2media Document Library Lite
- 1
- emarket-design Employee Spotlight – Team Member Showcase &…
- 1
- essekia Tablesome Table – Contact Form DB – WPForms, CF7, G…
- 1
- fernandobt List category posts
- 1
- gijo Flying Images: Optimize and Lazy Load Images for Faste…
- 1
- IBM i
- 1
Critical 5
- CVE-2025-12601Denial of Service Due to SlowLorisAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12600Web UI MalfunctionAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12599Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)Azure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-11499Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File Uploadessekia Tablesome Table – Contact Form DB – WPForms, CF7, G…
- CVE-2025-11833Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosuresaadiqbal Post SMTP – Complete Email Deliverability and SMT…
High 9
- CVE-2025-36367IBM i is affected by a privilege escalation in IBM i SQL servicesIBM i
- CVE-2025-6990Kallyas <= 4.24.0 - Authenticated (Contributor+) Remote Code Executionhogash KALLYAS - Creative eCommerce Multi-Purpose WordPress…
- CVE-2025-12171RESTful Content Syndication 1.1.0 - 1.5.0 - Authenticated (Contributor+) Arbitrary File Uploadanthonyeden RESTful Content Syndication
- CVE-2025-11755Delicious Recipes <= 1.9.0 - Authenticated (Contributor+) Arbitrary File Uploadwpdelicious WP Delicious – Recipe Plugin for Food Bloggers
- CVE-2025-10487Advanced Ads <= 2.0.12 - Unauthenticated Limited Code Executionmonetizemore Advanced Ads – Ad Manager & AdSense
- CVE-2025-6574Service Finder Bookings < 6.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeoveraonetheme Service Finder Bookings
- CVE-2025-5949Service Finder Bookings <= 6.0 - Authenticated (Subscriber+) Privilege Escalation via change_candidate_passwordaonetheme Service Finder Bookings
- CVE-2025-11995Community Events <= 1.5.2 - Unauthenticated Stored Cross-Site Scriptingjackdewey Community Events
- CVE-2025-11920WPCOM Member <= 1.7.14 - Authenticated (Contributor+) Local File Inclusion via Shortcodewhyun WPCOM Member
Medium, low and unrated 19
- CVE-2025-12603/etc/timezone can be Arbitrarily WrittenAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12602/etc/avahi/services/z9.service can be Arbitrarily WrittenAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-6988Kallyas <= 4.23.0 - Authenticated (Contributor+) Stored Cross-Site Scriptinghogash KALLYAS - Creative eCommerce Multi-Purpose WordPress…
- CVE-2025-12137Import WP – Export and Import CSV and XML files to WordPress <= 2.14.16 - Authenticated (Admin+) Arbitrary File Readjcollings Import WP – Export and Import CSV and XML files t…
- CVE-2025-11502Schema & Structured Data for WP & AMP <= 1.51 - Authenticated (Contributor+) Stored Cross-Site Scriptingmagazine3 Schema & Structured Data for WP & AMP
- CVE-2025-11740wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injectiontomdever wpForo Forum
- CVE-2025-12038Folderly <= 0.3 - Incorrect Authorization to Authenticated (Author+) Term Deletionwpfolderly Folderly
- CVE-2025-11983WP Discourse <= 2.5.9 - Authenticated (Author+) Information Exposurescossar WP Discourse
- CVE-2025-12090Employee Spotlight – Team Member Showcase & Meet the Team Plugin <= 5.1.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingemarket-design Employee Spotlight – Team Member Showcase &…
- CVE-2025-12180Qi Blocks <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Updateqodeinteractive Qi Blocks
- CVE-2025-11927Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.14 - Authenticated (Admin+) Stored Cross-Site Scriptinggijo Flying Images: Optimize and Lazy Load Images for Faste…
- CVE-2025-12118Schema Scalpel <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in JSON-LD Schemakevingillispie Schema Scalpel
- CVE-2025-11377List category posts <= 0.92.0 - Authenticated (Contributor+) Information Exposurefernandobt List category posts
- CVE-2025-11928CSS & JavaScript Toolbox <= 12.0.5 - Authenticated (Admin+) Stored Cross-Site Scriptingwipeoutmedia CSS & JavaScript Toolbox
- CVE-2025-12367SiteSEO – SEO Simplified <= 1.3.1 - Missing Authorization to Authenticated (Author+) Plugin Settings Updatesoftaculous SiteSEO – SEO Simplified
- CVE-2025-62275Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 thrLiferay Portal · Liferay DXP +1
- CVE-2025-11922Inactive Logout <= 3.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scriptingj_3rk Inactive Logout
- CVE-2025-11174Document Library Lite <= 1.1.6 - Missing Authorization to Sensitive Information Exposurebarn2media Document Library Lite
- CVE-2025-11816Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.5.1 - Missing Authorization to Unauthenticated API Disconnectwplegalpages Privacy Policy Generator – WPLP Legal Pages