# CVEs published 2025-11-06

243 CVEs were published on November 6, 2025: 31 critical, 141 high. Days are UTC.

- [CVE-2025-12789](https://cve.now/CVE-2025-12789.md): Rhsso: open redirect (CVSS 6.1, Red Hat Single Sign-On)
- [CVE-2025-58423](https://cve.now/CVE-2025-58423.md): Advantech DeviceOn/iEdge Path Traversal (CVSS 8.8, Advantech DeviceOn/iEdge)
- [CVE-2025-59171](https://cve.now/CVE-2025-59171.md): Advantech DeviceOn/iEdge Path Traversal (CVSS 7.5, Advantech DeviceOn/iEdge)
- [CVE-2025-62630](https://cve.now/CVE-2025-62630.md): Advantech DeviceOn/iEdge Path Traversal (CVSS 8.8, Advantech DeviceOn/iEdge)
- [CVE-2025-11460](https://cve.now/CVE-2025-11460.md): Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execute arbitrary code via a crafted video fi (CVSS 8.8, Google Chrome)
- [CVE-2025-11458](https://cve.now/CVE-2025-11458.md): Heap buffer overflow in Sync in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to perform an out of bounds memory read via a (CVSS 8.1, Google Chrome)
- [CVE-2025-11756](https://cve.now/CVE-2025-11756.md): Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker who had compromised the renderer process (CVSS 8.8, Google Chrome)
- [CVE-2025-12036](https://cve.now/CVE-2025-12036.md): Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker to perform out of bounds memory access (CVSS 8.8, Google Chrome)
- [CVE-2025-64302](https://cve.now/CVE-2025-64302.md): Advantech DeviceOn/iEdge Cross-site Scripting (CVSS 6.4, Advantech DeviceOn/iEdge)
- [CVE-2025-12636](https://cve.now/CVE-2025-12636.md): Ubia Ubox (CVSS 6.5, Ubia Ubox Android · Ubia Ubox IOS)
- [CVE-2025-11219](https://cve.now/CVE-2025-11219.md): Use after free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access vi (CVSS 3.1, Google Chrome)
- [CVE-2025-11216](https://cve.now/CVE-2025-11216.md): Inappropriate implementation in Storage in Google Chrome on Mac prior to 141.0.7390.54 allowed a remote attacker to perform domain spoofing (CVSS 6.3, Google Chrome)
- [CVE-2025-11215](https://cve.now/CVE-2025-11215.md): Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a craft (CVSS 4.3, Google Chrome)
- [CVE-2025-11213](https://cve.now/CVE-2025-11213.md): Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker who convinced a user to (CVSS 6.3, Google Chrome)
- [CVE-2025-11212](https://cve.now/CVE-2025-11212.md): Inappropriate implementation in Media in Google Chrome on Windows prior to 141.0.7390.54 allowed a remote attacker who convinced a user to e (CVSS 6.3, Google Chrome)
- [CVE-2025-11211](https://cve.now/CVE-2025-11211.md): Out of bounds read in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory ac (CVSS 7.5, Google Chrome)
- [CVE-2025-11210](https://cve.now/CVE-2025-11210.md): Side-channel information leakage in Tab in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in (CVSS 5.4, Google Chrome)
- [CVE-2025-11209](https://cve.now/CVE-2025-11209.md): Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker to spoof the contents o (CVSS 8.2, Google Chrome)
- [CVE-2025-11208](https://cve.now/CVE-2025-11208.md): Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in sp (CVSS 6.3, Google Chrome)
- [CVE-2025-11207](https://cve.now/CVE-2025-11207.md): Side-channel information leakage in Storage in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform arbitrary read/writ (CVSS 6.5, Google Chrome)
- [CVE-2025-11206](https://cve.now/CVE-2025-11206.md): Heap buffer overflow in Video in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform a sandbox escape via (CVSS 7.1, Google Chrome)
- [CVE-2025-11205](https://cve.now/CVE-2025-11205.md): Heap buffer overflow in WebGPU in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who had compromised the renderer process to (CVSS 8.8, Google Chrome)
- [CVE-2025-64179](https://cve.now/CVE-2025-64179.md): lakeFS: Unauthenticated access to API usage metrics (CVSS 5.3, treeverse lakeFS · github.com/treeverse/lakefs)
- [CVE-2024-12125](https://cve.now/CVE-2024-12125.md): 3scale-porta: readonly fields not validated server-side (CVSS 7.5, 3scale porta · Red Hat 3scale API Management Platform)
- [CVE-2025-64178](https://cve.now/CVE-2025-64178.md): Jellysweep uses uncontrolled data in image cache API endpoint (CVSS 8.9, jon4hz jellysweep · github.com/jon4hz/jellysweep)
- [CVE-2025-64177](https://cve.now/CVE-2025-64177.md): ThinkDashboard: Stored XSS in Dashboard via Malicious Bookmark (CVSS 5.4, MatiasDesuu ThinkDashboard)
- [CVE-2025-64176](https://cve.now/CVE-2025-64176.md): ThinkDashboard: Arbitrary File Upload vulnerability in the Backup Import Feature (CVSS 5.3, MatiasDesuu ThinkDashboard)
- [CVE-2025-12790](https://cve.now/CVE-2025-12790.md): Rubygem-mqtt: rubygem-mqtt hostname validation (CVSS 7.4, Nicholas J Humfrey ruby-mqtt · Red Hat Satellite +1)
- [CVE-2025-64327](https://cve.now/CVE-2025-64327.md): ThinkDashboard: Blind Server-Side Request Forgery (SSRF) vulnerability in /api/ping Endpoint (CVSS 5.3, MatiasDesuu ThinkDashboard)
- [CVE-2025-64326](https://cve.now/CVE-2025-64326.md): Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log (CVSS 2.6, WeblateOrg weblate · late +1)
- [CVE-2025-64174](https://cve.now/CVE-2025-64174.md): OpenMage is vulnerable to XSS in Admin Notifications (CVSS 4.6, OpenMage magento-lts · openmage/magento-lts)
- [CVE-2025-33110](https://cve.now/CVE-2025-33110.md): IBM OpenPages Vulnerable to HTML Injection (CVSS 5.4, IBM OpenPages)
- [CVE-2025-64173](https://cve.now/CVE-2025-64173.md): Apollo Router Core: Access Control Bypass on Polymorphic Types (CVSS 7.5, apollographql router · apollo-router)
- [CVE-2025-52881](https://cve.now/CVE-2025-52881.md): runc: LSM labels can be bypassed with malicious config using dummy procfs files (CVSS 7.3, opencontainers runc · github.com/opencontainers/runc +1)
- [CVE-2025-12486](https://cve.now/CVE-2025-12486.md): Heimdall Data Database Proxy Cross-Site Scripting Remote Code Execution Vulnerability (CVSS 8.8, Heimdall Data Database Proxy)
- [CVE-2025-12487](https://cve.now/CVE-2025-12487.md): oobabooga text-generation-webui trust\_remote\_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability (CVSS 9.8, oobabooga text-generation-webui)
- [CVE-2025-12488](https://cve.now/CVE-2025-12488.md): oobabooga text-generation-webui trust\_remote\_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability (CVSS 9.8, oobabooga text-generation-webui)
- [CVE-2025-12489](https://cve.now/CVE-2025-12489.md): evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability (CVSS 7.8, evernote-mcp-server)
- [CVE-2025-12490](https://cve.now/CVE-2025-12490.md): Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability (CVSS 8.8, Netgate pfSense)
- [CVE-2025-52565](https://cve.now/CVE-2025-52565.md): container escape due to /dev/console mount and related races (CVSS 8.4, opencontainers runc · github.com/opencontainers/runc)
- [CVE-2022-50590](https://cve.now/CVE-2022-50590.md): SuiteCRM \< 7.12.6 Type Confusion via 'deleteAttachment' Functionality (CVSS 8.8, SuiteCRM)
- [CVE-2022-50589](https://cve.now/CVE-2022-50589.md): SuiteCRM \< 7.12.6 SQL Injection via 'export' Functionality (CVSS 9.3, SuiteCRM)
- [CVE-2022-50596](https://cve.now/CVE-2022-50596.md): D-Link DIR-1260 \<= v1.20B05 GetDeviceSettings Unauthenticated Command Injection (CVSS 9.3, D-Link DIR-1260)
- [CVE-2022-50595](https://cve.now/CVE-2022-50595.md): Advantech iView \< v5.7.04 Build 6425 ztp\_search\_value Parameter SQL Injection RCE (CVSS 9.3, Advantech iView)
- [CVE-2022-50591](https://cve.now/CVE-2022-50591.md): Advantech iView \< v5.7.04 Build 6425 ztp\_config\_id Parameter SQL Injection Information Disclosure (CVSS 8.8, Advantech iView)
- [CVE-2022-50593](https://cve.now/CVE-2022-50593.md): Advantech iView \< v5.7.04 Build 6425 search\_term Parameter SQL Injection RCE (CVSS 9.3, Advantech iView)
- [CVE-2022-50592](https://cve.now/CVE-2022-50592.md): Advantech iView \< v5.7.04 Build 6425 getInventoryReportData Parameter SQL Injection RCE (CVSS 9.3, Advantech iView)
- [CVE-2022-50594](https://cve.now/CVE-2022-50594.md): Advantech iView \< v5.7.04 Build 6425 data Parameter SQL Injection Information Disclosure (CVSS 8.8, Advantech iView)
- [CVE-2025-34247](https://cve.now/CVE-2025-34247.md): Advantech WebAccess/VPN \< 1.1.5 SQL Injection via NetworksController.addNetworkAction() (CVSS 5.1, Advantech WebAccess/VPN)
- [CVE-2025-34246](https://cve.now/CVE-2025-34246.md): Advantech WebAccess/VPN \< 1.1.5 SQL Injection via AjaxPrevalidationController.ajaxAction() (CVSS 5.3, Advantech WebAccess/VPN)
- [CVE-2025-34245](https://cve.now/CVE-2025-34245.md): Advantech WebAccess/VPN \< 1.1.5 SQL Injection via AjaxStandaloneVpnClientsController.ajaxAction() (CVSS 5.3, Advantech WebAccess/VPN)
- [CVE-2025-34244](https://cve.now/CVE-2025-34244.md): Advantech WebAccess/VPN \< 1.1.5 SQL Injection via AjaxFwRulesController.ajaxDeviceFwRulesAction() (CVSS 5.3, Advantech WebAccess/VPN)
- [CVE-2025-34243](https://cve.now/CVE-2025-34243.md): Advantech WebAccess/VPN \< 1.1.5 SQL Injection via AjaxFwRulesController.ajaxNetworkFwRulesAction() (CVSS 5.3, Advantech WebAccess/VPN)
- [CVE-2025-34242](https://cve.now/CVE-2025-34242.md): Advantech WebAccess/VPN \< 1.1.5 SQL Injection via AjaxNetworkController.ajaxAction() (CVSS 8.6, Advantech WebAccess/VPN)
- [CVE-2025-34241](https://cve.now/CVE-2025-34241.md): Advantech WebAccess/VPN \< 1.1.5 SQL Injection via AjaxDeviceController.ajaxDeviceAction() (CVSS 5.3, Advantech WebAccess/VPN)
- [CVE-2025-34240](https://cve.now/CVE-2025-34240.md): Advantech WebAccess/VPN \< 1.1.5 SQL Injection via AppManagementController.appUpgradeAction() (CVSS 8.6, Advantech WebAccess/VPN)
- [CVE-2025-34239](https://cve.now/CVE-2025-34239.md): Advantech WebAccess/VPN \< 1.1.5 Command Injection in AppManagementController.appUpgradeAction() (CVSS 8.6, Advantech WebAccess/VPN)
- [CVE-2025-34238](https://cve.now/CVE-2025-34238.md): Advantech WebAccess/VPN \< 1.1.5 Path Traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() (CVSS 6.9, Advantech WebAccess/VPN)
- [CVE-2025-34237](https://cve.now/CVE-2025-34237.md): Advantech WebAccess/VPN \< 1.1.5 Stored XSS via StandaloneVpnClientsController.addStandaloneVpnClientAction() (CVSS 6.3, Advantech WebAccess/VPN)
- [CVE-2025-34236](https://cve.now/CVE-2025-34236.md): Advantech WebAccess/VPN \< 1.1.5 Stored XSS via NetworksController.addNetworkAction() (CVSS 6.2, Advantech WebAccess/VPN)
- [CVE-2025-31133](https://cve.now/CVE-2025-31133.md): runc container escape via "masked path" abuse due to mount race conditions (CVSS 7.3, opencontainers runc · github.com/opencontainers/runc)
- [CVE-2025-22397](https://cve.now/CVE-2025-22397.md): Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and D (CVSS 6.7, Integrated Dell Remote Access Controller 9 14G Versions… +1)
- [CVE-2024-25621](https://cve.now/CVE-2024-25621.md): containerd affected by a local privilege escalation via wide permissions on CRI directory (CVSS 7.3, containerd · github.com/containerd/containerd +1)
- [CVE-2025-12815](https://cve.now/CVE-2025-12815.md): An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025. (CVSS 5.3, AWS Research and Engineering Studio)
- [CVE-2025-10885](https://cve.now/CVE-2025-10885.md): Privilege Escalation Vulnerability (CVSS 7.8, Autodesk Installer)
- [CVE-2025-12485](https://cve.now/CVE-2025-12485.md): Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate (CVSS 8.8, Devolutions Server)
- [CVE-2025-12808](https://cve.now/CVE-2025-12808.md): Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custo (CVSS 6.5, Devolutions Server)
- [CVE-2025-64287](https://cve.now/CVE-2025-64287.md): WordPress Alloggio - Hotel Booking Theme theme \<= 1.8 - Local File Inclusion vulnerability (CVSS 8.1, Edge-Themes Alloggio - Hotel Booking)
- [CVE-2025-64232](https://cve.now/CVE-2025-64232.md): WordPress Import from YML plugin \<= 3.1.17 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, icopydoc Import from YML)
- [CVE-2025-64224](https://cve.now/CVE-2025-64224.md): WordPress Grand Conference Theme Custom Post Type plugin \< 2.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeGoods Grand Conference Theme Custom Post Type)
- [CVE-2025-64198](https://cve.now/CVE-2025-64198.md): WordPress Easy Social Share Buttons plugin \< 10.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, appscreo Easy Social Share Buttons)
- [CVE-2025-64196](https://cve.now/CVE-2025-64196.md): WordPress Booster for WooCommerce plugin \<= 7.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pluggabl Booster for WooCommerce)
- [CVE-2025-6327](https://cve.now/CVE-2025-6327.md): WordPress King Addons for Elementor plugin \<= 51.1.36 - Arbitrary File Upload vulnerability (CVSS 10.0, KingAddons.com King Addons for Elementor)
- [CVE-2025-6325](https://cve.now/CVE-2025-6325.md): WordPress King Addons for Elementor plugin \<= 51.1.36 - Privilege Escalation vulnerability (CVSS 9.8, KingAddons.com King Addons for Elementor)
- [CVE-2025-62950](https://cve.now/CVE-2025-62950.md): WordPress Contest Gallery plugin \<= 28.0.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Wasiliy Strecker / ContestGallery developer Contest Gallery)
- [CVE-2025-62914](https://cve.now/CVE-2025-62914.md): WordPress Effect Maker plugin \<= 1.2.1 - Broken Access Control vulnerability (CVSS 6.5, anibalwainstein Effect Maker)
- [CVE-2025-62076](https://cve.now/CVE-2025-62076.md): WordPress Simple Payment plugin \<= 2.4.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ido Kobelkowsky Simple Payment)
- [CVE-2025-62075](https://cve.now/CVE-2025-62075.md): WordPress Simple Payment plugin \<= 2.4.6 - Local File Inclusion vulnerability (CVSS 7.5, Ido Kobelkowsky Simple Payment)
- [CVE-2025-62074](https://cve.now/CVE-2025-62074.md): WordPress WPMobile.App plugin \<= 11.71 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Amauri WPMobile.App)
- [CVE-2025-62067](https://cve.now/CVE-2025-62067.md): WordPress Savory theme \<= 2.5 - Local File Inclusion vulnerability (CVSS 8.1, Elated-Themes Savory)
- [CVE-2025-62066](https://cve.now/CVE-2025-62066.md): WordPress Revolution theme \< 2.5.8 - Local File Inclusion vulnerability (CVSS 7.5, fuelthemes Revolution)
- [CVE-2025-62065](https://cve.now/CVE-2025-62065.md): WordPress RTMKit plugin \<= 1.6.5 - Arbitrary File Upload vulnerability (CVSS 9.9, Rometheme RTMKit)
- [CVE-2025-62064](https://cve.now/CVE-2025-62064.md): WordPress Search & Go theme \<= 2.7 - Broken Authentication vulnerability (CVSS 9.8, Elated-Themes Search & Go)
- [CVE-2025-62059](https://cve.now/CVE-2025-62059.md): WordPress SureRank plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Brainstorm Force SureRank)
- [CVE-2025-62057](https://cve.now/CVE-2025-62057.md): WordPress Houzez Theme - Functionality plugin \< 4.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, favethemes Houzez Theme - Functionality)
- [CVE-2025-62055](https://cve.now/CVE-2025-62055.md): WordPress Academist theme \< 1.3 - Local File Inclusion vulnerability (CVSS 8.1, Elated-Themes Academist)
- [CVE-2025-62053](https://cve.now/CVE-2025-62053.md): WordPress Houzez theme \< 4.2.0 - Local File Inclusion vulnerability (CVSS 8.1, favethemes Houzez)
- [CVE-2025-62051](https://cve.now/CVE-2025-62051.md): WordPress UDesign Core plugin \<= 4.14.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, AndonDesign UDesign Core)
- [CVE-2025-62049](https://cve.now/CVE-2025-62049.md): WordPress Cost Calculator Builder plugin \<= 3.5.32 - Broken Access Control vulnerability (CVSS 6.5, Stylemix Cost Calculator Builder)
- [CVE-2025-62047](https://cve.now/CVE-2025-62047.md): WordPress Case Addons plugin \< 1.3.0 - Arbitrary File Upload vulnerability (CVSS 9.9, Case-Themes Case Addons)
- [CVE-2025-62046](https://cve.now/CVE-2025-62046.md): WordPress TheGem Demo Import (for WPBakery) plugin \<= 5.10.5 - Arbitrary Content Deletion vulnerability (CVSS 6.5, CodexThemes TheGem Demo Import)
- [CVE-2025-62045](https://cve.now/CVE-2025-62045.md): WordPress TheGem Theme Elements (for WPBakery) plugin \<= 5.10.5.1 - Local File Inclusion vulnerability (CVSS 8.1, CodexThemes TheGem Theme Elements)
- [CVE-2025-62044](https://cve.now/CVE-2025-62044.md): WordPress TheGem Theme Elements (for WPBakery) plugin \<= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CodexThemes TheGem Theme Elements)
- [CVE-2025-62041](https://cve.now/CVE-2025-62041.md): WordPress TheGem (Elementor) theme \<= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CodexThemes TheGem)
- [CVE-2025-62040](https://cve.now/CVE-2025-62040.md): WordPress YOP Poll plugin \<= 6.5.37 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, YOP Poll)
- [CVE-2025-62039](https://cve.now/CVE-2025-62039.md): WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin \<= 2.6.6 - Sensitive Data Exposure vulnerability (CVSS 7.5, Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS)
- [CVE-2025-62038](https://cve.now/CVE-2025-62038.md): WordPress MeetingHub plugin \<= 1.23.9 - Sensitive Data Exposure vulnerability (CVSS 6.5, Sovlix MeetingHub)
- [CVE-2025-62037](https://cve.now/CVE-2025-62037.md): WordPress Togo theme \< 1.0.4 - Broken Access Control vulnerability (CVSS 6.5, uxper Togo)
- [CVE-2025-62036](https://cve.now/CVE-2025-62036.md): WordPress Togo theme \< 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, uxper Togo)
- [CVE-2025-62035](https://cve.now/CVE-2025-62035.md): WordPress Togo theme \< 1.0.4 - PHP Object Injection vulnerability (CVSS 8.8, uxper Togo)
- [CVE-2025-62034](https://cve.now/CVE-2025-62034.md): WordPress Togo theme \< 1.0.4 - Privilege Escalation vulnerability (CVSS 8.8, uxper Togo)
- [CVE-2025-62033](https://cve.now/CVE-2025-62033.md): WordPress Togo theme \< 1.0.4 - Broken Access Control vulnerability (CVSS 6.5, uxper Togo)
- [CVE-2025-62032](https://cve.now/CVE-2025-62032.md): WordPress tagDiv Cloud Library plugin \< 3.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, tagDiv Cloud Library)
- [CVE-2025-62031](https://cve.now/CVE-2025-62031.md): WordPress tagDiv Composer plugin \<= 5.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tagDiv Composer)
- [CVE-2025-62030](https://cve.now/CVE-2025-62030.md): WordPress tagDiv Composer plugin \<= 5.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, tagDiv Composer)
- [CVE-2025-62028](https://cve.now/CVE-2025-62028.md): WordPress Salient theme \< 17.4.0 - Broken Access Control vulnerability (CVSS 4.3, ThemeNectar Salient)
- [CVE-2025-62018](https://cve.now/CVE-2025-62018.md): WordPress Kallyas theme \<= 4.22.0 - Broken Access Control vulnerability (CVSS 5.3, hogash KALLYAS)
- [CVE-2025-62017](https://cve.now/CVE-2025-62017.md): WordPress Kallyas theme \<= 4.22.0 - Broken Access Control vulnerability (CVSS 5.4, hogash KALLYAS)
- [CVE-2025-62016](https://cve.now/CVE-2025-62016.md): WordPress Kallyas theme \<= 4.22.0 - Arbitrary File Upload vulnerability (CVSS 9.9, hogash KALLYAS)
- [CVE-2025-62014](https://cve.now/CVE-2025-62014.md): WordPress ITok theme \<= 1.1.42 - Local File Inclusion vulnerability (CVSS 8.1, ApusTheme ITok)
- [CVE-2025-62012](https://cve.now/CVE-2025-62012.md): WordPress TheGem (Elementor) theme \<= 5.10.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CodexThemes TheGem)
- [CVE-2025-62011](https://cve.now/CVE-2025-62011.md): WordPress TheGem theme \<= 5.10.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CodexThemes TheGem)
- [CVE-2025-62010](https://cve.now/CVE-2025-62010.md): WordPress Famita theme \<= 1.54 - Local File Inclusion vulnerability (CVSS 8.1, ApusTheme Famita)
- [CVE-2025-60248](https://cve.now/CVE-2025-60248.md): WordPress WPC Product Options for WooCommerce plugin \<= 3.1.3 - Local File Inclusion vulnerability (CVSS 7.5, WPClever WPC Product Options for WooCommerce)
- [CVE-2025-60247](https://cve.now/CVE-2025-60247.md): WordPress Bux Woocommerce plugin \<= 1.2.3 - Broken Access Control vulnerability (CVSS 6.5, Bux Woocommerce)
- [CVE-2025-60245](https://cve.now/CVE-2025-60245.md): WordPress WP User Manager plugin \<= 2.9.12 - PHP Object Injection vulnerability (CVSS 9.8, WP User Manager)
- [CVE-2025-60244](https://cve.now/CVE-2025-60244.md): WordPress TableOn plugin \<= 1.0.5.1 - Content Injection vulnerability (CVSS 7.1, RealMag777 TableOn)
- [CVE-2025-60243](https://cve.now/CVE-2025-60243.md): WordPress Selling Commander for WooCommerce plugin \<= 1.2.46 - Privilege Escalation vulnerability (CVSS 9.8, Holest Engineering Selling Commander for WooCommerce)
- [CVE-2025-60242](https://cve.now/CVE-2025-60242.md): WordPress Download Counter plugin \<= 1.4 - Arbitrary File Download vulnerability (CVSS 7.5, Anatoly Download Counter)
- [CVE-2025-60241](https://cve.now/CVE-2025-60241.md): WordPress Premmerce plugin \<= 1.3.19 - Local File Inclusion vulnerability (CVSS 7.5, Premmerce)
- [CVE-2025-60240](https://cve.now/CVE-2025-60240.md): WordPress AnyComment plugin \<= 0.3.6 - Local File Inclusion vulnerability (CVSS 7.5, Alexander AnyComment)
- [CVE-2025-60239](https://cve.now/CVE-2025-60239.md): WordPress CoSchool LMS plugin \<= 1.4.3 - SQL Injection vulnerability (CVSS 8.5, Codexpert CoSchool LMS)
- [CVE-2025-60235](https://cve.now/CVE-2025-60235.md): WordPress Support Ticket System for WooCommerce plugin \<= 2.0.7 - Arbitrary File Upload vulnerability (CVSS 10.0, Plugify Support Ticket System for WooCommerce)
- [CVE-2025-60207](https://cve.now/CVE-2025-60207.md): WordPress Custom User Registration Fields for WooCommerce plugin \<= 2.1.2 - Arbitrary File Upload Vulnerability (CVSS 10.0, Addify Custom User Registration Fields for WooCommerce)
- [CVE-2025-60204](https://cve.now/CVE-2025-60204.md): WordPress WooCommerce Store Toolkit plugin \<= 2.4.3 - Local File Inclusion vulnerability (CVSS 7.5, Josh Kohlbach WooCommerce Store Toolkit)
- [CVE-2025-60203](https://cve.now/CVE-2025-60203.md): WordPress Store Exporter plugin \<= 2.7.6 - Local File Inclusion vulnerability (CVSS 7.5, Josh Kohlbach Store Exporter)
- [CVE-2025-60202](https://cve.now/CVE-2025-60202.md): WordPress Favorites plugin \<= 2.3.6 - Local File Inclusion vulnerability (CVSS 7.5, Kyle Phillips Favorites)
- [CVE-2025-60201](https://cve.now/CVE-2025-60201.md): WordPress WP Customer Area plugin \<= 8.3.5 - Local File Inclusion vulnerability (CVSS 7.5, aguilatechnologies WP Customer Area)
- [CVE-2025-60200](https://cve.now/CVE-2025-60200.md): WordPress LearnPress Export Import plugin \<= 4.1.2 - Local File Inclusion vulnerability (CVSS 7.5, ThimPress LearnPress Export Import)
- [CVE-2025-60199](https://cve.now/CVE-2025-60199.md): WordPress InHype - Blog & Magazine WordPress Theme theme \<= 1.5.2 - Local File Inclusion vulnerability (CVSS 8.1, dedalx InHype - Blog & Magazine WordPress Theme)
- [CVE-2025-60198](https://cve.now/CVE-2025-60198.md): WordPress Saxon - Viral Content Blog & Magazine Marketing WordPress Theme theme \<= 1.9.3 - Local File Inclusion vulnerability (CVSS 8.1, dedalx Saxon - Viral Content Blog & Magazine Marketing Word…)
- [CVE-2025-60197](https://cve.now/CVE-2025-60197.md): WordPress Simple Contact Forms plugin \<= 1.6.4 - Local File Inclusion vulnerability (CVSS 8.1, owenr88 Simple Contact Forms)
- [CVE-2025-60196](https://cve.now/CVE-2025-60196.md): WordPress Clearblue® Ovulation Calculator plugin \<= 1.2.4 - Local File Inclusion vulnerability (CVSS 7.5, Clearblue® Ovulation Calculator)
- [CVE-2025-60195](https://cve.now/CVE-2025-60195.md): WordPress Atarim plugin \<= 4.2.1 - Privilege Escalation vulnerability (CVSS 9.8, Vito Peleg Atarim)
- [CVE-2025-60194](https://cve.now/CVE-2025-60194.md): WordPress Premmerce Product Search for WooCommerce plugin \<= 2.2.4 - Local File Inclusion vulnerability (CVSS 7.5, Premmerce Product Search for WooCommerce)
- [CVE-2025-60193](https://cve.now/CVE-2025-60193.md): WordPress Premmerce User Roles plugin \<= 1.0.13 - Local File Inclusion vulnerability (CVSS 7.5, Premmerce User Roles)
- [CVE-2025-60192](https://cve.now/CVE-2025-60192.md): WordPress Premmerce Wholesale Pricing for WooCommerce plugin \<= 1.1.10 - Local File Inclusion vulnerability (CVSS 7.5, Premmerce Wholesale Pricing for WooCommerce)
- [CVE-2025-60191](https://cve.now/CVE-2025-60191.md): WordPress Premmerce Wishlist for WooCommerce plugin \<= 1.1.10 - Local File Inclusion vulnerability (CVSS 7.5, Premmerce Wishlist for WooCommerce)
- [CVE-2025-60190](https://cve.now/CVE-2025-60190.md): WordPress Immocaster WordPress Plugin plugin \<= 1.3.6 - Local File Inclusion vulnerability (CVSS 8.1, Hinnerk Altenburg Immocaster WordPress Plugin)
- [CVE-2025-60189](https://cve.now/CVE-2025-60189.md): WordPress PoloPag – Pix Automático para Woocommerce plugin \<= 2.0.9 - Local File Inclusion vulnerability (CVSS 7.5, PoloPag – Pix Automático para Woocommerce)
- [CVE-2025-60188](https://cve.now/CVE-2025-60188.md): WordPress Atarim plugin \<= 4.2.1 - Sensitive Data Exposure vulnerability (CVSS 7.5, Vito Peleg Atarim)
- [CVE-2025-60187](https://cve.now/CVE-2025-60187.md): WordPress Atarim plugin \<= 4.2.1 - Arbitrary File Upload vulnerability (CVSS 4.8, Vito Peleg Atarim)
- [CVE-2025-60074](https://cve.now/CVE-2025-60074.md): WordPress Lazy Load Optimizer plugin \<= 1.4.7 - Local File Inclusion vulnerability (CVSS 7.5, Processby Lazy Load Optimizer)
- [CVE-2025-60073](https://cve.now/CVE-2025-60073.md): WordPress Responsive Sidebar plugin \<= 1.2.2 - Local File Inclusion vulnerability (CVSS 7.5, Processby Responsive Sidebar)
- [CVE-2025-59556](https://cve.now/CVE-2025-59556.md): WordPress GoStore theme \< 1.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, skygroup GoStore)
- [CVE-2025-58998](https://cve.now/CVE-2025-58998.md): WordPress s2Member Plugin \<= 250701 - PHP Object Injection Vulnerability (CVSS 9.8, Cristián Lávaque s2Member)
- [CVE-2025-58996](https://cve.now/CVE-2025-58996.md): WordPress Advanced Settings Plugin \<= 3.1.1 - Arbitrary File Upload Vulnerability (CVSS 9.1, Helmut Wandl Advanced Settings)
- [CVE-2025-58995](https://cve.now/CVE-2025-58995.md): WordPress Leblix Theme \<= 2.4 - Local File Inclusion Vulnerability (CVSS 8.1, Creatives\_Planet Leblix)
- [CVE-2025-58994](https://cve.now/CVE-2025-58994.md): WordPress Greenify theme \<= 2.2 - Local File Inclusion vulnerability (CVSS 8.1, designervily Greenify)
- [CVE-2025-58986](https://cve.now/CVE-2025-58986.md): WordPress Jock On Air Now (JOAN) plugin \<= 6.0.4 - Broken Access Control vulnerability (CVSS 6.5, ganddser Jock On Air Now)
- [CVE-2025-58972](https://cve.now/CVE-2025-58972.md): WordPress Barcode Scanner with Inventory & Order Manager plugin \<= 1.10.4 - Path Traversal vulnerability (CVSS 7.2, Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inve…)
- [CVE-2025-58964](https://cve.now/CVE-2025-58964.md): WordPress Enzy theme \< 1.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, skygroup Enzy)
- [CVE-2025-58638](https://cve.now/CVE-2025-58638.md): WordPress Institutions Directory Plugin \<= 1.3.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, e-plugins Institutions Directory)
- [CVE-2025-58636](https://cve.now/CVE-2025-58636.md): WordPress WP Gravity Forms Keap/Infusionsoft Plugin \<= 1.2.3 - Deserialization of untrusted data Vulnerability (CVSS 9.8, CRM Perks WP Gravity Forms Keap/Infusionsoft)
- [CVE-2025-58629](https://cve.now/CVE-2025-58629.md): WordPress Miraculous theme \< 2.0.9 - Arbitrary Content Deletion vulnerability (CVSS 7.5, kamleshyadav Miraculous)
- [CVE-2025-58627](https://cve.now/CVE-2025-58627.md): WordPress Miraculous Core Plugin plugin \< 2.0.9 - Insecure Direct Object References (IDOR) vulnerability (CVSS 9.8, kamleshyadav Miraculous Core Plugin)
- [CVE-2025-58619](https://cve.now/CVE-2025-58619.md): WordPress Falang multilanguage Plugin \<= 1.3.65 - PHP Object Injection Vulnerability (CVSS 8.8, sbouey Falang multilanguage)
- [CVE-2025-58595](https://cve.now/CVE-2025-58595.md): WordPress All In One Login plugin \<= 2.0.8 - Bypass Vulnerability vulnerability (CVSS 5.3, Saad Iqbal All In One Login)
- [CVE-2025-58592](https://cve.now/CVE-2025-58592.md): WordPress TranslatePress Plugin \<= 2.10.2 - Deserialization of untrusted data Vulnerability (CVSS 8.1, Cozmoslabs TranslatePress)
- [CVE-2025-58243](https://cve.now/CVE-2025-58243.md): WordPress imEvent Theme \<= 3.4.0 - Broken Access Control Vulnerability (CVSS 5.3, Jthemes imEvent)
- [CVE-2025-58207](https://cve.now/CVE-2025-58207.md): WordPress Ai Image Alt Text Generator for WP Plugin \<= 1.1.5 - Broken Access Control Vulnerability (CVSS 8.2, WP Messiah Ai Image Alt Text Generator for WP)
- [CVE-2025-5803](https://cve.now/CVE-2025-5803.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.8.2 - Broken Access Control vulnerability (CVSS 5.3, e4jvikwp VikBooking Hotel Booking Engine & PMS)
- [CVE-2025-54737](https://cve.now/CVE-2025-54737.md): WordPress Jobmonster theme \<= 4.7.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NooTheme Jobmonster)
- [CVE-2025-54722](https://cve.now/CVE-2025-54722.md): WordPress WooTour plugin \<= 3.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ex-Themes WooTour)
- [CVE-2025-54721](https://cve.now/CVE-2025-54721.md): WordPress Resca theme \<= 3.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThimPress Resca)
- [CVE-2025-54719](https://cve.now/CVE-2025-54719.md): WordPress Yogi - Health Beauty & Yoga Theme \<= 2.9.2 - Deserialization of untrusted data Vulnerability (CVSS 8.8, NooTheme Yogi - Health Beauty & Yoga)
- [CVE-2025-54718](https://cve.now/CVE-2025-54718.md): WordPress Yogi - Health Beauty & Yoga theme \<= 2.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NooTheme Yogi - Health Beauty & Yoga)
- [CVE-2025-54711](https://cve.now/CVE-2025-54711.md): WordPress Info Cards Plugin \<= 1.0.11 - Broken Access Control Vulnerability (CVSS 7.1, bPlugins Info Cards)
- [CVE-2025-53586](https://cve.now/CVE-2025-53586.md): WordPress WeMusic Theme \<= 1.9.1 - PHP Object Injection Vulnerability (CVSS 8.8, NooTheme WeMusic)
- [CVE-2025-53585](https://cve.now/CVE-2025-53585.md): WordPress WeMusic theme \<= 1.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NooTheme WeMusic)
- [CVE-2025-53574](https://cve.now/CVE-2025-53574.md): WordPress Doliconnect Plugin \<= 9.3.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, ptibogxiv Doliconnect)
- [CVE-2025-53573](https://cve.now/CVE-2025-53573.md): WordPress Epic Review Plugin \<= 1.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, jegtheme Epic Review)
- [CVE-2025-53349](https://cve.now/CVE-2025-53349.md): WordPress Kalium Theme \<= 3.18.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Laborator Kalium)
- [CVE-2025-53324](https://cve.now/CVE-2025-53324.md): WordPress Gutenify Plugin \<= 1.5.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, CodeYatri Gutenify)
- [CVE-2025-53316](https://cve.now/CVE-2025-53316.md): WordPress WP GDPR Cookie Consent plugin \<= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Shahjahan Jewel WP GDPR Cookie Consent)
- [CVE-2025-53286](https://cve.now/CVE-2025-53286.md): WordPress Dropify plugin \<= 4.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jhainey Milevis Dropify)
- [CVE-2025-53283](https://cve.now/CVE-2025-53283.md): WordPress Drop Uploader for CF7 - Drag&Drop File Uploader Addon Plugin \<= 2.4.1 - Arbitrary File Upload Vulnerability (CVSS 10.0, borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader…)
- [CVE-2025-53252](https://cve.now/CVE-2025-53252.md): WordPress Zegen Theme \<= 1.1.9 - Local File Inclusion Vulnerability (CVSS 7.5, zozothemes Zegen)
- [CVE-2025-53246](https://cve.now/CVE-2025-53246.md): WordPress Backup and Move Plugin \<= 0.1 - Broken Access Control Vulnerability (CVSS 6.5, Gaurav Aggarwal Backup and Move)
- [CVE-2025-53245](https://cve.now/CVE-2025-53245.md): WordPress WP Logo Changer Plugin \<= 1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Afzal Multani WP Logo Changer)
- [CVE-2025-53242](https://cve.now/CVE-2025-53242.md): WordPress Seil Theme \<= 1.7.1 - Deserialization of untrusted data Vulnerability (CVSS 9.8, VictorThemes Seil)
- [CVE-2025-53239](https://cve.now/CVE-2025-53239.md): WordPress User Registration Aide Plugin \<= 1.5.3.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, bnovotny User Registration Aide)
- [CVE-2025-53214](https://cve.now/CVE-2025-53214.md): WordPress Sertifier Certificate & Badge Maker plugin \<= 1.21 - Broken Access Control Vulnerability (CVSS 6.5, Sertifier Certificate & Badge Maker)
- [CVE-2025-52773](https://cve.now/CVE-2025-52773.md): WordPress HieCOR Payment Gateway plugin plugin \<= 1.5.11 - SQL Injection vulnerability (CVSS 9.3, HieCOR Payment Gateway Plugin)
- [CVE-2025-52764](https://cve.now/CVE-2025-52764.md): WordPress flexoslider plugin \<= 1.0004 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, marielav flexoslider)
- [CVE-2025-49909](https://cve.now/CVE-2025-49909.md): WordPress Penci Bookmark & Follow plugin \< 2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PenciDesign Penci Bookmark & Follow)
- [CVE-2025-49905](https://cve.now/CVE-2025-49905.md): WordPress Range Slider Addon for Gravity Forms plugin \<= 1.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PluginsCafe Range Slider Addon for Gravity Forms)
- [CVE-2025-49904](https://cve.now/CVE-2025-49904.md): WordPress Booking and Rental Manager plugin \<= 2.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, magepeopleteam Booking and Rental Manager)
- [CVE-2025-49900](https://cve.now/CVE-2025-49900.md): WordPress Advanced scrollbar plugin \<= 1.1.8 - Privilege Escalation vulnerability (CVSS 8.8, bPlugins Advanced scrollbar)
- [CVE-2025-49398](https://cve.now/CVE-2025-49398.md): WordPress Easy Appointments plugin \<= 3.12.14 - Content Injection vulnerability (CVSS 6.5, Easy Appointments)
- [CVE-2025-49394](https://cve.now/CVE-2025-49394.md): WordPress Image Gallery block – Create and display photo gallery/photo album. plugin \<= 1.0.7 - Broken Authentication vulnerability (CVSS 7.1, bPlugins Image Gallery block – Create and display photo gal…)
- [CVE-2025-49393](https://cve.now/CVE-2025-49393.md): WordPress Sign-up Sheets Plugin \<= 2.3.2 - PHP Object Injection Vulnerability (CVSS 9.8, Fetch Designs Sign-up Sheets)
- [CVE-2025-49390](https://cve.now/CVE-2025-49390.md): WordPress Cookie Notice & Consent plugin \<= 1.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, christophrado Cookie Notice & Consent)
- [CVE-2025-49386](https://cve.now/CVE-2025-49386.md): WordPress Preserve Code Formatting Plugin \<= 4.0.1 - PHP Object Injection Vulnerability (CVSS 8.8, Scott Reilly Preserve Code Formatting)
- [CVE-2025-49372](https://cve.now/CVE-2025-49372.md): WordPress HAPPY plugin \<= 1.0.7 - Remote Code Execution (RCE) vulnerability (CVSS 10.0, VillaTheme HAPPY)
- [CVE-2025-48330](https://cve.now/CVE-2025-48330.md): WordPress Real Time Validation for Gravity Forms \<= 1.7.0 - Local File Inclusion Vulnerability (CVSS 7.5, Daman Jeet Real Time Validation for Gravity Forms)
- [CVE-2025-48290](https://cve.now/CVE-2025-48290.md): WordPress Kinsley theme \<= 3.4.4 - Local File Inclusion vulnerability (CVSS 8.1, bslthemes Kinsley)
- [CVE-2025-48090](https://cve.now/CVE-2025-48090.md): WordPress Blanka - One Page WordPress Theme Theme \< 1.5 - Local File Inclusion Vulnerability (CVSS 8.1, CocoBasic Blanka - One Page WordPress Theme)
- [CVE-2025-48089](https://cve.now/CVE-2025-48089.md): WordPress Education WordPress Theme | HiStudy theme \< 3.1.0 - SQL Injection vulnerability (CVSS 9.3, Rainbow-Themes Education WordPress Theme | HiStudy)
- [CVE-2025-48086](https://cve.now/CVE-2025-48086.md): WordPress Ajax Search Lite plugin \<= 4.13.3 - PHP Object Injection vulnerability (CVSS 5.5, wpdreams Ajax Search Lite)
- [CVE-2025-48085](https://cve.now/CVE-2025-48085.md): WordPress Simple Stripe plugin \<= 0.9.17 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, ZIPANG Simple Stripe)
- [CVE-2025-48083](https://cve.now/CVE-2025-48083.md): WordPress wpNamedUsers plugin \<= 0.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, andriassundskard wpNamedUsers)
- [CVE-2025-48078](https://cve.now/CVE-2025-48078.md): WordPress Slick Google Map plugin \<= 0.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, Norbert Slick Google Map)
- [CVE-2025-48077](https://cve.now/CVE-2025-48077.md): WordPress Block Country plugin \<= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, nitinmaurya12 Block Country)
- [CVE-2025-47588](https://cve.now/CVE-2025-47588.md): WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin \<= 4.5.9 - Arbitrary Code Execution vulnerability (CVSS 9.1, acowebs Dynamic Pricing With Discount Rules for WooCommerce)
- [CVE-2025-39468](https://cve.now/CVE-2025-39468.md): WordPress Modal Survey plugin \<= 2.0.2.0.1 - Local File Inclusion vulnerability (CVSS 8.1, pantherius Modal Survey)
- [CVE-2025-39467](https://cve.now/CVE-2025-39467.md): WordPress Wanderland theme \<= 1.7.1 - Local File Inclusion Vulnerability (CVSS 8.1, Mikado-Themes Wanderland)
- [CVE-2025-39466](https://cve.now/CVE-2025-39466.md): WordPress Dør theme \<= 2.4 - Local File Inclusion Vulnerability (CVSS 8.1, Mikado-Themes Dør)
- [CVE-2025-39465](https://cve.now/CVE-2025-39465.md): WordPress Advanced Google Maps plugin \<= 5.8.4 - Broken Access Control vulnerability (CVSS 4.3, flippercode Advanced Google Maps)
- [CVE-2025-39463](https://cve.now/CVE-2025-39463.md): WordPress Dessau theme \< 1.9 - Local File Inclusion vulnerability (CVSS 7.5, Select-Themes Dessau)
- [CVE-2025-32222](https://cve.now/CVE-2025-32222.md): WordPress Widget Logic \<= 6.0.5 - Remote Code Execution (RCE) Vulnerability (CVSS 9.9, Widgetlogic.org Widget Logic)
- [CVE-2025-31029](https://cve.now/CVE-2025-31029.md): WordPress replyMail plugin \<= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, bingu replyMail)
- [CVE-2025-28953](https://cve.now/CVE-2025-28953.md): WordPress smart SEO plugin \<= 4.0 - SQL Injection Vulnerability (CVSS 8.5, axiomthemes smart SEO)
- [CVE-2025-22288](https://cve.now/CVE-2025-22288.md): WordPress Smush Image Compression and Optimization plugin \<= 3.17.0 - Directory Traversal vulnerability (CVSS 4.1, WPMU DEV - Your All-in-One WordPress Platform Smush Image C…)
- [CVE-2025-12556](https://cve.now/CVE-2025-12556.md): IDIS ICM Viewer Argument Injection (CVSS 8.7, IDIS ICM Viewer)
- [CVE-2025-11956](https://cve.now/CVE-2025-11956.md): XSS in Proliz's OBS (CVSS 8.9, Proliz Software Ltd. OBS)
- [CVE-2025-10955](https://cve.now/CVE-2025-10955.md): HTML Injection in Netcad Software's Netigma (CVSS 6.1, Netcad Software Netigma)
- [CVE-2025-37735](https://cve.now/CVE-2025-37735.md): Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defen (CVSS 7.0, Elastic Kibana)
- [CVE-2025-36054](https://cve.now/CVE-2025-36054.md): Cross-site scripting vulnerability affect IBM Business Automation Workflow Process Federation Server - (CVSS 6.1, IBM Business Automation Workflow containers · IBM Business…)
- [CVE-2025-11268](https://cve.now/CVE-2025-11268.md): Strong Testimonials \<= 3.2.16 - Unauthenticated Arbitrary Shortcode Execution (CVSS 4.3, wpchill Strong Testimonials)
- [CVE-2025-12360](https://cve.now/CVE-2025-12360.md): Better Find and Replace \<= 1.7.7 - Missing Authorization (CVSS 4.3, codesolz Better Find and Replace – AI-Powered Suggestions)
- [CVE-2025-10259](https://cve.now/CVE-2025-10259.md): Denial-of-Service(DoS) Vulnerability in TCP Communication Function on MELSEC iQ-F Series CPU module (CVSS 5.3, Mitsubishi Electric MELSEC iQ-F Series FX5U-32MT/ES · M… +81)
- [CVE-2025-12471](https://cve.now/CVE-2025-12471.md): Hubbub Lite \<= 1.36.0 - Reflected Cross-Site Scripting (CVSS 6.1, nerdpressteam Hubbub Lite – Fast, free social sharing and f…)
- [CVE-2025-9338](https://cve.now/CVE-2025-9338.md): A improper restriction of operations within the bounds of a memory buffer exists in AsIO3.sys driver. (CVSS 7.3, ASUS Armoury Crate)
- [CVE-2025-12560](https://cve.now/CVE-2025-12560.md): Blog2Social: Social Media Auto Post & Scheduler \<= 8.6.0 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via post\_url (CVSS 4.3, pr-gateway Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2025-11271](https://cve.now/CVE-2025-11271.md): Easy Digital Download \<= 3.5.2 - Insufficient Verification to Order Manipulation (CVSS 5.3, smub Easy Digital Downloads – eCommerce Payments and Subscr…)
- [CVE-2025-12563](https://cve.now/CVE-2025-12563.md): Blog2Social: Social Media Auto Post & Scheduler \<= 8.6.0 - Incorrect Authorization to Video File Upload (CVSS 4.3, pr-gateway Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2025-61994](https://cve.now/CVE-2025-61994.md): Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. (CVSS 5.4, GROWI)
- [CVE-2025-10691](https://cve.now/CVE-2025-10691.md): Easy Email Subscription \<= 1.3 - Cross-Site Request Forgery to Arbitrary Subscriber Deletion (CVSS 4.3, yudiz Easy Email Subscription)
- [CVE-2025-10683](https://cve.now/CVE-2025-10683.md): Easy Email Subscription \<= 1.3 - Authenticated (Admin+) SQL Injection via uid (CVSS 4.9, yudiz Easy Email Subscription)
- [CVE-2025-64171](https://cve.now/CVE-2025-64171.md): MARIN3R: Cross-Namespace Vulnerability in the Operator (CVSS 8.7, 3scale-sre marin3r · github.com/3scale-sre/marin3r)
- [CVE-2025-64164](https://cve.now/CVE-2025-64164.md): DataEase is vulnerable to Oracle JNDI Injection (CVSS 8.9, dataease)
- [CVE-2025-27916](https://cve.now/CVE-2025-27916.md): An issue was discovered in AnyDesk for Windows before 9.0.6 and AnyDesk for Android before 8.0.0. (CVSS 7.5)
- [CVE-2025-27917](https://cve.now/CVE-2025-27917.md): An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS (CVSS 7.5)
- [CVE-2025-27918](https://cve.now/CVE-2025-27918.md): An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS (CVSS 9.8)
- [CVE-2025-27919](https://cve.now/CVE-2025-27919.md): An issue was discovered in AnyDesk through 9.0.4. (CVSS 8.2)
- [CVE-2025-59392](https://cve.now/CVE-2025-59392.md): On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inserting a USB drive (co (CVSS 6.8)
- [CVE-2025-60541](https://cve.now/CVE-2025-60541.md): A Server-Side Request Forgery (SSRF) in the /api/proxy/ component of linshenkx prompt-optimizer v1.3.0 to v1.4.2 allows attackers to scan in (CVSS 7.3)
- [CVE-2025-63307](https://cve.now/CVE-2025-63307.md): alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). (CVSS 8.1)
- [CVE-2025-63551](https://cve.now/CVE-2025-63551.md): A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Man (CVSS 7.5)
- [CVE-2025-63560](https://cve.now/CVE-2025-63560.md): An issue in KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder Firmware v.1.20.0006 allows a remote attacker to cause a denial of ser (CVSS 7.5)
- [CVE-2025-63588](https://cve.now/CVE-2025-63588.md): An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and ex (CVSS 7.1)
- [CVE-2025-63589](https://cve.now/CVE-2025-63589.md): A reflected XSS vulnerability exists in CMSimple\_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encod (CVSS 7.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.