# CVEs published 2025-11-01

33 CVEs were published on November 1, 2025: 5 critical, 9 high. Days are UTC.

- [CVE-2025-12603](https://cve.now/CVE-2025-12603.md): /etc/timezone can be Arbitrarily Written (CVSS 2.3, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12602](https://cve.now/CVE-2025-12602.md): /etc/avahi/services/z9.service can be Arbitrarily Written (CVSS 2.3, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12601](https://cve.now/CVE-2025-12601.md): Denial of Service Due to SlowLoris (CVSS 10.0, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12600](https://cve.now/CVE-2025-12600.md): Web UI Malfunction (CVSS 10.0, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12599](https://cve.now/CVE-2025-12599.md): Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000) (CVSS 10.0, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-36367](https://cve.now/CVE-2025-36367.md): IBM i is affected by a privilege escalation in IBM i SQL services (CVSS 8.8, IBM i)
- [CVE-2025-6988](https://cve.now/CVE-2025-6988.md): Kallyas \<= 4.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, hogash KALLYAS - Creative eCommerce Multi-Purpose WordPress…)
- [CVE-2025-6990](https://cve.now/CVE-2025-6990.md): Kallyas \<= 4.24.0 - Authenticated (Contributor+) Remote Code Execution (CVSS 8.8, hogash KALLYAS - Creative eCommerce Multi-Purpose WordPress…)
- [CVE-2025-12137](https://cve.now/CVE-2025-12137.md): Import WP – Export and Import CSV and XML files to WordPress \<= 2.14.16 - Authenticated (Admin+) Arbitrary File Read (CVSS 4.9, jcollings Import WP – Export and Import CSV and XML files t…)
- [CVE-2025-12171](https://cve.now/CVE-2025-12171.md): RESTful Content Syndication 1.1.0 - 1.5.0 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, anthonyeden RESTful Content Syndication)
- [CVE-2025-11755](https://cve.now/CVE-2025-11755.md): Delicious Recipes \<= 1.9.0 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, wpdelicious WP Delicious – Recipe Plugin for Food Bloggers)
- [CVE-2025-10487](https://cve.now/CVE-2025-10487.md): Advanced Ads \<= 2.0.12 - Unauthenticated Limited Code Execution (CVSS 7.3, monetizemore Advanced Ads – Ad Manager & AdSense)
- [CVE-2025-11499](https://cve.now/CVE-2025-11499.md): Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent \<= 1.1.32 - Unauthenticated Arbitrary File Upload (CVSS 9.8, essekia Tablesome Table – Contact Form DB – WPForms, CF7, G…)
- [CVE-2025-6574](https://cve.now/CVE-2025-6574.md): Service Finder Bookings \< 6.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover (CVSS 8.8, aonetheme Service Finder Bookings)
- [CVE-2025-11502](https://cve.now/CVE-2025-11502.md): Schema & Structured Data for WP & AMP \<= 1.51 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, magazine3 Schema & Structured Data for WP & AMP)
- [CVE-2025-11740](https://cve.now/CVE-2025-11740.md): wpForo Forum \<= 2.4.9 - Authenticated (Susbscriber+) SQL Injection (CVSS 6.5, tomdever wpForo Forum)
- [CVE-2025-12038](https://cve.now/CVE-2025-12038.md): Folderly \<= 0.3 - Incorrect Authorization to Authenticated (Author+) Term Deletion (CVSS 4.3, wpfolderly Folderly)
- [CVE-2025-11983](https://cve.now/CVE-2025-11983.md): WP Discourse \<= 2.5.9 - Authenticated (Author+) Information Exposure (CVSS 4.3, scossar WP Discourse)
- [CVE-2025-12090](https://cve.now/CVE-2025-12090.md): Employee Spotlight – Team Member Showcase & Meet the Team Plugin \<= 5.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, emarket-design Employee Spotlight – Team Member Showcase &…)
- [CVE-2025-12180](https://cve.now/CVE-2025-12180.md): Qi Blocks \<= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update (CVSS 4.3, qodeinteractive Qi Blocks)
- [CVE-2025-11927](https://cve.now/CVE-2025-11927.md): Flying Images: Optimize and Lazy Load Images for Faster Page Speed \<= 2.4.14 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, gijo Flying Images: Optimize and Lazy Load Images for Faste…)
- [CVE-2025-5949](https://cve.now/CVE-2025-5949.md): Service Finder Bookings \<= 6.0 - Authenticated (Subscriber+) Privilege Escalation via change\_candidate\_password (CVSS 8.8, aonetheme Service Finder Bookings)
- [CVE-2025-12118](https://cve.now/CVE-2025-12118.md): Schema Scalpel \<= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in JSON-LD Schema (CVSS 6.4, kevingillispie Schema Scalpel)
- [CVE-2025-11995](https://cve.now/CVE-2025-11995.md): Community Events \<= 1.5.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, jackdewey Community Events)
- [CVE-2025-11377](https://cve.now/CVE-2025-11377.md): List category posts \<= 0.92.0 - Authenticated (Contributor+) Information Exposure (CVSS 4.3, fernandobt List category posts)
- [CVE-2025-11928](https://cve.now/CVE-2025-11928.md): CSS & JavaScript Toolbox \<= 12.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, wipeoutmedia CSS & JavaScript Toolbox)
- [CVE-2025-12367](https://cve.now/CVE-2025-12367.md): SiteSEO – SEO Simplified \<= 1.3.1 - Missing Authorization to Authenticated (Author+) Plugin Settings Update (CVSS 4.3, softaculous SiteSEO – SEO Simplified)
- [CVE-2025-11833](https://cve.now/CVE-2025-11833.md): Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App \<= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure (CVSS 9.8, saadiqbal Post SMTP – Complete Email Deliverability and SMT…)
- [CVE-2025-62275](https://cve.now/CVE-2025-62275.md): Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 thr (CVSS 6.9, Liferay Portal · Liferay DXP +1)
- [CVE-2025-11922](https://cve.now/CVE-2025-11922.md): Inactive Logout \<= 3.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, j\_3rk Inactive Logout)
- [CVE-2025-11920](https://cve.now/CVE-2025-11920.md): WPCOM Member \<= 1.7.14 - Authenticated (Contributor+) Local File Inclusion via Shortcode (CVSS 8.8, whyun WPCOM Member)
- [CVE-2025-11174](https://cve.now/CVE-2025-11174.md): Document Library Lite \<= 1.1.6 - Missing Authorization to Sensitive Information Exposure (CVSS 5.3, barn2media Document Library Lite)
- [CVE-2025-11816](https://cve.now/CVE-2025-11816.md): Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages \<= 3.5.1 - Missing Authorization to Unauthenticated API Disconnect (CVSS 5.3, wplegalpages Privacy Policy Generator – WPLP Legal Pages)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.