# CVEs published 2025-11-21

163 CVEs were published on November 21, 2025: 6 critical, 30 high. Days are UTC.

- [CVE-2025-12889](https://cve.now/CVE-2025-12889.md): TLS 1.2 Client Can Downgrade Digest Used (CVSS 2.3, wolfSSL)
- [CVE-2025-11932](https://cve.now/CVE-2025-11932.md): Timing Side-Channel in PSK Binder Verification (CVSS 2.3, wolfSSL)
- [CVE-2025-11931](https://cve.now/CVE-2025-11931.md): Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt (CVSS 2.1, wolfSSL)
- [CVE-2025-12888](https://cve.now/CVE-2025-12888.md): Constant Time Issue with Xtensa-based ESP32 and X22519 (CVSS 1.0, wolfSSL)
- [CVE-2025-11936](https://cve.now/CVE-2025-11936.md): Potential DoS Vulnerability through Multiple KeyShareEntry with Same Group in TLS 1.3 ClientHello (CVSS 6.3, wolfSSL)
- [CVE-2025-11933](https://cve.now/CVE-2025-11933.md): DoS Vulnerability in wolfSSL TLS 1.3 CKS Extension (CVSS 2.3, wofSSL wolfSSL)
- [CVE-2025-65947](https://cve.now/CVE-2025-65947.md): thread-amount is Vulnerable to Resource Exhaustion (Memory and Handle Leaks) on Windows and macOS (CVSS 8.7, jzeuzs thread-amount · thread-amount)
- [CVE-2025-11934](https://cve.now/CVE-2025-11934.md): Improper Validation of Signature Algorithm Used in TLS 1.3 CertificateVerify (CVSS 2.1, wolfSSL)
- [CVE-2025-65946](https://cve.now/CVE-2025-65946.md): Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug (CVSS 8.1, RooCodeInc Roo-Code)
- [CVE-2025-11935](https://cve.now/CVE-2025-11935.md): Forward Secrecy Violation in WolfSSL TLS 1.3 (CVSS 6.3, wolfSSL)
- [CVE-2025-65111](https://cve.now/CVE-2025-65111.md): SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results (CVSS 2.9, authzed spicedb · github.com/authzed/spicedb)
- [CVE-2025-65109](https://cve.now/CVE-2025-65109.md): Minder does not sandbox http.send in Rego programs (CVSS 8.5, mindersec minder · github.com/mindersec/minder)
- [CVE-2025-65108](https://cve.now/CVE-2025-65108.md): md-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front matter (CVSS 10.0, simonhaenisch md-to-pdf · md-to-pdf)
- [CVE-2025-65107](https://cve.now/CVE-2025-65107.md): Langfuse SSO Account Takeover via CSRF or phishing attack (CVSS 6.5, langfuse)
- [CVE-2025-65106](https://cve.now/CVE-2025-65106.md): LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates (CVSS 8.3, langchain-ai langchain · langchain-core)
- [CVE-2025-65102](https://cve.now/CVE-2025-65102.md): PJSIP is vulnerable to buffer overflow in Opus PLC (CVSS 8.7, pjsip pjproject)
- [CVE-2025-65092](https://cve.now/CVE-2025-65092.md): ESP32-P4 JPEG Decoder Header Parsing Vulnerability (CVSS 6.9, espressif esp-idf)
- [CVE-2025-0504](https://cve.now/CVE-2025-0504.md): Black Duck SCA Project Privilege Escalation (CVSS 5.3, Black Duck SCA)
- [CVE-2025-31216](https://cve.now/CVE-2025-31216.md): The issue was addressed with improved checks. (CVSS 2.4, Apple iOS and iPadOS · Apple iPadOS)
- [CVE-2025-31266](https://cve.now/CVE-2025-31266.md): A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name. (CVSS 4.3, Apple Safari · Apple macOS)
- [CVE-2025-43374](https://cve.now/CVE-2025-43374.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 4.3, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-31248](https://cve.now/CVE-2025-31248.md): A parsing issue in the handling of directory paths was addressed with improved path validation. (CVSS 5.5, Apple macOS)
- [CVE-2025-11087](https://cve.now/CVE-2025-11087.md): Zegen Core \<= 2.0.1 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 8.8, zozothemes Zegen Core)
- [CVE-2025-13524](https://cve.now/CVE-2025-13524.md): Improper resource release in the call termination process in AWS Wickr before version 6.62.13 on Windows, macOS and Linux may allow a call p (CVSS 5.7, AWS Wickr)
- [CVE-2025-36149](https://cve.now/CVE-2025-36149.md): IBM Concert Software clickjacking (CVSS 6.3, IBM Concert Software)
- [CVE-2025-48502](https://cve.now/CVE-2025-48502.md): Improper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting in crash or denial o (CVSS 5.5, AMD μProf)
- [CVE-2025-62609](https://cve.now/CVE-2025-62609.md): MLX has Wild Pointer Dereference in load\_gguf() (CVSS 5.5, ml-explore mlx · mlx)
- [CVE-2025-62608](https://cve.now/CVE-2025-62608.md): MLX has heap-buffer-overflow in load() (CVSS 5.5, ml-explore mlx · mlx)
- [CVE-2025-62626](https://cve.now/CVE-2025-62626.md): Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instru (CVSS 7.2, AMD Ryzen™ 9000HX Series Processors · AMD EPYC™ 9005 Series…)
- [CVE-2025-64767](https://cve.now/CVE-2025-64767.md): hpke-js reuses AEAD nonces (CVSS 9.1, dajiaji hpke-js · @hpke/core)
- [CVE-2025-29934](https://cve.now/CVE-2025-29934.md): A bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resulti (CVSS 5.3, AMD EPYC™ 9004 Series Processors · AMD EPYC™ 9005 Series… +5)
- [CVE-2025-64169](https://cve.now/CVE-2025-64169.md): Wazuh NULL pointer dereference in fim\_alert line 666 (CVSS 5.1, wazuh)
- [CVE-2025-54866](https://cve.now/CVE-2025-54866.md): Wazuh installation fails to protected authd.pass on Windows (CVSS 1.8, wazuh)
- [CVE-2025-30201](https://cve.now/CVE-2025-30201.md): Wazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration Capabilities (CVSS 7.7, wazuh)
- [CVE-2025-13132](https://cve.now/CVE-2025-13132.md): Dia: Increased Spoof Risk; Missing full screen toast (CVSS 7.4, The Browser Company of New York Dia)
- [CVE-2025-64483](https://cve.now/CVE-2025-64483.md): Wazuh API – Agent Configuration Has Improper Access Control in Agent Enrollment Endpoint (CVSS 5.3, wazuh-dashboard-plugins)
- [CVE-2025-13470](https://cve.now/CVE-2025-13470.md): RNP 0.18.0 Vulnerable PKESK session keys (CVSS 7.7, Ribose RNP)
- [CVE-2025-12747](https://cve.now/CVE-2025-12747.md): Tainacan \<= 1.0.0 - Unauthenticated Information Exposure (CVSS 5.3, Tainacan)
- [CVE-2025-12973](https://cve.now/CVE-2025-12973.md): S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator \<= 1.7.8 - Authenticated (Editor+) Arbitrary File Upload (CVSS 7.2, oc3dots S2B AI Assistant – ChatBot, AI Agents, ChatGPT API,…)
- [CVE-2025-13357](https://cve.now/CVE-2025-13357.md): Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method (CVSS 7.4, HashiCorp Tooling · github.com/hashicorp/terraform-provider…)
- [CVE-2025-41115](https://cve.now/CVE-2025-41115.md): Incorrect privilege assignment (CVSS 10.0, Grafana Enterprise · github.com/grafana/grafana)
- [CVE-2025-13432](https://cve.now/CVE-2025-13432.md): Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access (CVSS 4.3, HashiCorp Terraform Enterprise)
- [CVE-2025-11127](https://cve.now/CVE-2025-11127.md): Mstoreapp Mobile (App \<= 2.08, Multivendor \<= 9.0.1) - Unauthenticated Privilege Escalation (CVSS 9.8, Mstoreapp Mobile App · Mstoreapp Mobile Multivendor)
- [CVE-2025-66115](https://cve.now/CVE-2025-66115.md): WordPress Easy Invoice plugin \<= 2.1.4 - Local File Inclusion vulnerability (CVSS 6.6, MatrixAddons Easy Invoice)
- [CVE-2025-66114](https://cve.now/CVE-2025-66114.md): WordPress Show Variations as Single Products Woocommerce plugin \<= 2.0 - Broken Access Control vulnerability (CVSS 5.3, theme funda Show Variations as Single Products Woocommerce)
- [CVE-2025-66113](https://cve.now/CVE-2025-66113.md): WordPress Better Chat Support for Messenger plugin \<= 1.2.18 - Broken Access Control vulnerability (CVSS 5.3, ThemeAtelier Better Chat Support for Messenger)
- [CVE-2025-66112](https://cve.now/CVE-2025-66112.md): WordPress Accessibility Toolkit by WebYes plugin \<= 2.0.4 - Broken Access Control vulnerability (CVSS 4.3, WebToffee Accessibility Toolkit by WebYes)
- [CVE-2025-66111](https://cve.now/CVE-2025-66111.md): WordPress Nelio Popups plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Nelio Software Nelio Popups)
- [CVE-2025-66110](https://cve.now/CVE-2025-66110.md): WordPress Tiktok Feed plugin \<= 1.0.23 - Broken Access Control vulnerability (CVSS 5.3, bPlugins Tiktok Feed)
- [CVE-2025-66109](https://cve.now/CVE-2025-66109.md): WordPress Cart Weight for WooCommerce plugin \<= 1.9.11 - Broken Access Control vulnerability (CVSS 5.3, Octolize Shipping Plugins Cart Weight for WooCommerce)
- [CVE-2025-66108](https://cve.now/CVE-2025-66108.md): WordPress TNC Toolbox: Web Performance plugin \<= 2.0.4 - Broken Access Control vulnerability (CVSS 4.3, Merlot Digital (by TNC) TNC Toolbox: Web Performance)
- [CVE-2025-66107](https://cve.now/CVE-2025-66107.md): WordPress Subscriptions & Memberships for PayPal plugin \<= 1.1.7 - Broken Access Control vulnerability (CVSS 5.3, Scott Paterson Subscriptions & Memberships for PayPal)
- [CVE-2025-66106](https://cve.now/CVE-2025-66106.md): WordPress Featured Post Creative plugin \<= 1.5.5 - Broken Access Control vulnerability (CVSS 4.3, Essential Plugin Featured Post Creative)
- [CVE-2025-66101](https://cve.now/CVE-2025-66101.md): WordPress CBX Bookmark & Favorite plugin \<= 2.0.1 - Broken Access Control vulnerability (CVSS 4.3, Sabuj Kundu CBX Bookmark & Favorite)
- [CVE-2025-66099](https://cve.now/CVE-2025-66099.md): WordPress Chat Help plugin \<= 3.1.3 - Broken Access Control vulnerability (CVSS 5.3, ThemeAtelier Chat Help)
- [CVE-2025-66098](https://cve.now/CVE-2025-66098.md): WordPress Travelers' Map plugin \<= 2.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Camille V Travelers' Map)
- [CVE-2025-66097](https://cve.now/CVE-2025-66097.md): WordPress I Order Terms plugin \<= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Igor Jerosimić I Order Terms)
- [CVE-2025-66096](https://cve.now/CVE-2025-66096.md): WordPress Table Block by Tableberg plugin \<= 0.6.9 - Broken Access Control vulnerability (CVSS 4.3, Imtiaz Rayhan Table Block by Tableberg)
- [CVE-2025-66095](https://cve.now/CVE-2025-66095.md): WordPress KiviCare plugin \<= 3.6.13 - SQL Injection vulnerability (CVSS 8.5, Iqonic Design KiviCare)
- [CVE-2025-66093](https://cve.now/CVE-2025-66093.md): WordPress Extensions for Leaflet Map plugin \<= 4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, hupe13 Extensions for Leaflet Map)
- [CVE-2025-66092](https://cve.now/CVE-2025-66092.md): WordPress Accordion Slider plugin \<= 1.9.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bqworks Accordion Slider)
- [CVE-2025-66091](https://cve.now/CVE-2025-66091.md): WordPress Stylish Cost Calculator plugin \<= 8.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Design Stylish Cost Calculator)
- [CVE-2025-66090](https://cve.now/CVE-2025-66090.md): WordPress SKT Skill Bar plugin \<= 2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sonalsinha21 SKT Skill Bar)
- [CVE-2025-66089](https://cve.now/CVE-2025-66089.md): WordPress Product Feed for WooCommerce plugin \<= 2.3.1 - Broken Access Control vulnerability (CVSS 4.3, WebToffee Product Feed for WooCommerce)
- [CVE-2025-66087](https://cve.now/CVE-2025-66087.md): WordPress PropertyHive plugin \<= 2.1.12 - Broken Access Control vulnerability (CVSS 4.3, Property Hive PropertyHive)
- [CVE-2025-66086](https://cve.now/CVE-2025-66086.md): WordPress SMS Alert Order Notifications plugin \<= 3.8.8 - Broken Access Control vulnerability (CVSS 5.3, Cozy Vision SMS Alert Order Notifications)
- [CVE-2025-66085](https://cve.now/CVE-2025-66085.md): WordPress Arconix Shortcodes plugin \<= 2.1.18 - Broken Access Control vulnerability (CVSS 4.3, tychesoftwares Arconix Shortcodes)
- [CVE-2025-66084](https://cve.now/CVE-2025-66084.md): WordPress FluentCommunity plugin \<= 2.0.0 - Broken Access Control vulnerability (CVSS 4.3, Shahjahan Jewel FluentCommunity)
- [CVE-2025-66083](https://cve.now/CVE-2025-66083.md): WordPress WpEvently plugin \<= 5.0.4 - Broken Access Control vulnerability (CVSS 5.3, magepeopleteam WpEvently)
- [CVE-2025-66082](https://cve.now/CVE-2025-66082.md): WordPress WpEvently plugin \<= 5.0.4 - Broken Access Control vulnerability (CVSS 5.3, magepeopleteam WpEvently)
- [CVE-2025-66081](https://cve.now/CVE-2025-66081.md): WordPress Head Meta Data plugin \<= 20250327 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Jeff Starr Head Meta Data)
- [CVE-2025-66079](https://cve.now/CVE-2025-66079.md): WordPress Gutenverse Form plugin \<= 2.2.0 - Broken Access Control vulnerability (CVSS 6.5, Jegstudio Gutenverse Form)
- [CVE-2025-66077](https://cve.now/CVE-2025-66077.md): WordPress Legal Pages plugin \<= 1.4.6 - Broken Access Control vulnerability (CVSS 5.3, wpWax Legal Pages)
- [CVE-2025-66075](https://cve.now/CVE-2025-66075.md): WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin \<= 4.0.3 - Broken Access Control vulnerability (CVSS 4.3, WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy C…)
- [CVE-2025-66073](https://cve.now/CVE-2025-66073.md): WordPress WP Webhooks plugin \<= 3.3.8 - PHP Object Injection vulnerability (CVSS 7.2, Cozmoslabs WP Webhooks)
- [CVE-2025-66072](https://cve.now/CVE-2025-66072.md): WordPress UsersWP plugin \<= 1.2.47 - Broken Access Control vulnerability (CVSS 5.3, Stiofan UsersWP)
- [CVE-2025-66071](https://cve.now/CVE-2025-66071.md): WordPress Custom Order Numbers for WooCommerce plugin \<= 1.11.0 - Broken Access Control vulnerability (CVSS 5.3, tychesoftwares Custom Order Numbers for WooCommerce)
- [CVE-2025-66069](https://cve.now/CVE-2025-66069.md): WordPress PPOM for WooCommerce plugin \<= 33.0.16 - Broken Access Control vulnerability (CVSS 4.3, Themeisle PPOM for WooCommerce)
- [CVE-2025-66067](https://cve.now/CVE-2025-66067.md): WordPress Funnel Builder by FunnelKit plugin \<= 3.13.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Aman Funnel Builder by FunnelKit)
- [CVE-2025-66066](https://cve.now/CVE-2025-66066.md): WordPress Envo Extra plugin \<= 1.9.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, EnvoThemes Envo Extra)
- [CVE-2025-66065](https://cve.now/CVE-2025-66065.md): WordPress Gutenverse plugin \<= 3.2.1 - Broken Access Control vulnerability (CVSS 6.5, Jegstudio Gutenverse)
- [CVE-2025-66064](https://cve.now/CVE-2025-66064.md): WordPress Giveaways and Contests by RafflePress plugin \<= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Syed Balkhi Giveaways and Contests by RafflePress)
- [CVE-2025-66063](https://cve.now/CVE-2025-66063.md): WordPress WP Google Review Slider plugin \<= 17.4 - Broken Access Control vulnerability (CVSS 5.4, jgwhite33 WP Google Review Slider)
- [CVE-2025-66062](https://cve.now/CVE-2025-66062.md): WordPress WP YouTube Lyte plugin \<= 1.7.28 - Open Redirection vulnerability (CVSS 3.4, Frank Goossens WP YouTube Lyte)
- [CVE-2025-66061](https://cve.now/CVE-2025-66061.md): WordPress Seriously Simple Podcasting plugin \<= 3.13.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Craig Hewitt Seriously Simple Podcasting)
- [CVE-2025-66060](https://cve.now/CVE-2025-66060.md): WordPress Seriously Simple Podcasting plugin \<= 3.13.0 - Broken Access Control vulnerability (CVSS 5.3, Craig Hewitt Seriously Simple Podcasting)
- [CVE-2025-66059](https://cve.now/CVE-2025-66059.md): WordPress Seriously Simple Podcasting plugin \<= 3.13.0 - Sensitive Data Exposure vulnerability (CVSS 5.3, Craig Hewitt Seriously Simple Podcasting)
- [CVE-2025-66057](https://cve.now/CVE-2025-66057.md): WordPress Bold Page Builder plugin \<= 5.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, boldthemes Bold Page Builder)
- [CVE-2025-66056](https://cve.now/CVE-2025-66056.md): WordPress Uncanny Automator plugin \< 6.10.0 - Sensitive Data Exposure vulnerability (CVSS 4.3, Uncanny Owl Uncanny Automator)
- [CVE-2025-66055](https://cve.now/CVE-2025-66055.md): WordPress Email Subscribers & Newsletters plugin \<= 5.9.10 - PHP Object Injection vulnerability (CVSS 7.2, Icegram Email Subscribers & Newsletters)
- [CVE-2025-66053](https://cve.now/CVE-2025-66053.md): WordPress Enfold theme \<= 7.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Kriesi Enfold)
- [CVE-2025-10039](https://cve.now/CVE-2025-10039.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh\_crm\_ticket\_single\_view\_client' (CVSS 4.3, elextensions ELEX WordPress HelpDesk & Customer Ticketing S…)
- [CVE-2025-12935](https://cve.now/CVE-2025-12935.md): FluentCRM - Marketing Automation For WordPress \<= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm\_content' Shortcode (CVSS 6.4, techjewel FluentCRM – Email Newsletter, Automation, Email M…)
- [CVE-2025-10054](https://cve.now/CVE-2025-10054.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal (CVSS 4.3, elextensions ELEX WordPress HelpDesk & Customer Ticketing S…)
- [CVE-2025-40211](https://cve.now/CVE-2025-40211.md): ACPI: video: Fix use-after-free in acpi\_video\_switch\_brightness() (no CVSS, Linux)
- [CVE-2025-40210](https://cve.now/CVE-2025-40210.md): Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" (CVSS 7.5, Linux)
- [CVE-2025-40209](https://cve.now/CVE-2025-40209.md): btrfs: fix memory leak of qgroup\_list in btrfs\_add\_qgroup\_relation (no CVSS, Linux)
- [CVE-2025-12750](https://cve.now/CVE-2025-12750.md): Groundhogg \<= 4.2.6.1 - Authenticated (Admin+) SQL Injection (CVSS 4.9, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2025-12160](https://cve.now/CVE-2025-12160.md): Simple User Registration \<= 6.6 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, nmedia Simple User Registration)
- [CVE-2025-12066](https://cve.now/CVE-2025-12066.md): WP Delete Post Copies \<= 6.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, etruel WP Delete Post Copies)
- [CVE-2025-12964](https://cve.now/CVE-2025-12964.md): Magical Products Display \<= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via MPD Pricing Table Widget (CVSS 6.4, nalam-1 Magical Shop Builder – WooCommerce Template Builder…)
- [CVE-2025-13138](https://cve.now/CVE-2025-13138.md): WP Directory Kit \<= 1.4.3 - Unauthenticated SQL Injection via select\_2\_ajax() Function (CVSS 7.5, wpdirectorykit WP Directory Kit)
- [CVE-2025-13156](https://cve.now/CVE-2025-13156.md): Vitepos – Point of Sale (POS) for WooCommerce \<= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code Execution (CVSS 8.8, appsbd Vitepos – Point of Sale (POS) for WooCommerce)
- [CVE-2025-11808](https://cve.now/CVE-2025-11808.md): Shortcode for Google Street View \<= 0.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, antiochinteractive Shortcode for Google Street View)
- [CVE-2025-13141](https://cve.now/CVE-2025-13141.md): HT Mega – Absolute Addons For Elementor \<= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2025-13149](https://cve.now/CVE-2025-13149.md): Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories \<= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification (CVSS 4.3, Schedule Post Changes With PublishPress Future: Unpublish,…)
- [CVE-2025-11826](https://cve.now/CVE-2025-11826.md): WP Company Info \<= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, bdeleasa WP Company Info)
- [CVE-2025-11973](https://cve.now/CVE-2025-11973.md): 简数采集器 \<= 2.6.3 - Authenticated (Admin+) Arbitrary File Read (CVSS 4.9, zhengdon 简数采集器)
- [CVE-2025-12039](https://cve.now/CVE-2025-12039.md): BigBuy Dropshipping Connector for WooCommerce \<= 2.0.5 - Unauthenticated IP Spoofing to phpinfo() Exposure (CVSS 5.3, devsmip BigBuy Dropshipping Connector for WooCommerce)
- [CVE-2025-11803](https://cve.now/CVE-2025-11803.md): WPSite Shortcode \<= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpfanyi WPSite Shortcode)
- [CVE-2025-11800](https://cve.now/CVE-2025-11800.md): Surbma | MiniCRM Shortcode \<= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Surbma | MiniCRM Shortcode)
- [CVE-2025-11985](https://cve.now/CVE-2025-11985.md): Realty Portal \<= 0.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, nootheme Realty Portal)
- [CVE-2025-11802](https://cve.now/CVE-2025-11802.md): Bulma Shortcodes \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bartboy011 Bulma Shortcodes)
- [CVE-2025-11773](https://cve.now/CVE-2025-11773.md): Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO \<= 2.4.7 - Missing Authorization to Authenticated (Subscriber+) Contract Address Update (CVSS 4.3, beycanpress Cryptocurrency (Token), Launchpad (Presale), IC…)
- [CVE-2025-11763](https://cve.now/CVE-2025-11763.md): Display Pages Shortcode \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, rustybadrobot Display Pages Shortcode)
- [CVE-2025-13135](https://cve.now/CVE-2025-13135.md): HotelRunner Booking Widget \<= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, integrationshotelrunner HotelRunner Booking Widget)
- [CVE-2025-11764](https://cve.now/CVE-2025-11764.md): Shortcodes Bootstrap \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, fastmover Shortcodes Bootstrap)
- [CVE-2025-10938](https://cve.now/CVE-2025-10938.md): UiPress lite \<= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 6.5, admintwentytwenty UiPress lite | Effortless custom dashboar…)
- [CVE-2025-11771](https://cve.now/CVE-2025-11771.md): Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO \<= 2.4.7 - Missing Authentication to Unauthenticated Presale Update (CVSS 5.3, beycanpress Cryptocurrency (Token), Launchpad (Presale), IC…)
- [CVE-2025-11003](https://cve.now/CVE-2025-11003.md): UiPress lite \<= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, admintwentytwenty UiPress lite | Effortless custom dashboar…)
- [CVE-2025-11799](https://cve.now/CVE-2025-11799.md): Affiliate AI Lite \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, rustaurius Affiliate AI Lite)
- [CVE-2025-11456](https://cve.now/CVE-2025-11456.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.1 - Unauthenticated Arbitrary File Upload (CVSS 9.8, elextensions ELEX WordPress HelpDesk & Customer Ticketing S…)
- [CVE-2025-12881](https://cve.now/CVE-2025-12881.md): Return Refund and Exchange For WooCommerce \<= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Order Message Read (CVSS 5.4, wpswings Return Refund and Exchange For WooCommerce)
- [CVE-2025-11815](https://cve.now/CVE-2025-11815.md): UiPress lite | Effortless custom dashboards, admin themes and pages \<= 3.5.08 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update (CVSS 4.3, admintwentytwenty UiPress lite | Effortless custom dashboar…)
- [CVE-2025-13159](https://cve.now/CVE-2025-13159.md): Flo Forms – Easy Drag & Drop Form Builder \<= 1.0.43 - Unauthenticated Stored Cross-Site Scripting via SVG Upload (CVSS 7.1, flothemesplugins Flo Forms – Easy Drag & Drop Form Builder)
- [CVE-2025-13134](https://cve.now/CVE-2025-13134.md): AuthorSure \<= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, powerblogservice AuthorSure)
- [CVE-2025-12135](https://cve.now/CVE-2025-12135.md): WPBookit \<= 1.0.6 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, iqonicdesign WPBookit)
- [CVE-2025-11885](https://cve.now/CVE-2025-11885.md): EchBay Admin Security \<= 1.3.0 - Reflected Cross-Site Scripting (CVSS 6.1, itvn9online EchBay Admin Security)
- [CVE-2025-13142](https://cve.now/CVE-2025-13142.md): Custom Post Type \<= 1.0 - Cross-Site Request Forgery to Custom Post Type Deletion (CVSS 4.3, farvehandleren Custom Post Type)
- [CVE-2025-11768](https://cve.now/CVE-2025-11768.md): Islamic Phrases \<= 2.12.2015 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, darto Islamic Phrases)
- [CVE-2025-11770](https://cve.now/CVE-2025-11770.md): BrightTALK WordPress Shortcode \<= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, billybigpotatoes BrightTALK WordPress Shortcode)
- [CVE-2025-11767](https://cve.now/CVE-2025-11767.md): Tips Shortcode \<= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, fpcorso Tips Shortcode)
- [CVE-2025-12894](https://cve.now/CVE-2025-12894.md): Import WP – Export and Import CSV and XML files to WordPress \<= 2.14.17 - Unauthenticated Information Exposure (CVSS 5.3, jcollings Import WP – Export and Import CSV and XML files t…)
- [CVE-2025-11801](https://cve.now/CVE-2025-11801.md): AudioTube \<= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, davidangel AudioTube)
- [CVE-2025-12138](https://cve.now/CVE-2025-12138.md): URL Image Importer \<= 1.0.6 - Authenticated (Author+) Arbitrary File Upload (CVSS 8.8, bww URL Image Importer)
- [CVE-2025-11765](https://cve.now/CVE-2025-11765.md): Stock Tools \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, developdaly Stock Tools)
- [CVE-2025-12170](https://cve.now/CVE-2025-12170.md): Checkbox \<= 2.8.10 - Missing Authorization to Unauthenticated Log Clearing (CVSS 5.3, bandido Checkbox)
- [CVE-2025-12086](https://cve.now/CVE-2025-12086.md): Return Refund and Exchange For WooCommerce \<= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation (CVSS 4.3, wpswings Return Refund and Exchange For WooCommerce)
- [CVE-2025-12661](https://cve.now/CVE-2025-12661.md): Pollcaster Shortcode Plugin \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, qzzr Pollcaster Shortcode Plugin)
- [CVE-2025-13322](https://cve.now/CVE-2025-13322.md): WP AUDIO GALLERY \<= 2.0 - Authenticated (Subscriber+) Arbitrary File Deletion via 'audio\_upload' Parameter (CVSS 8.1, husainali52 WP AUDIO GALLERY)
- [CVE-2025-12660](https://cve.now/CVE-2025-12660.md): Padlet Shortcode \<= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, coffeebite Padlet Shortcode)
- [CVE-2025-12746](https://cve.now/CVE-2025-12746.md): Tainacan \<= 1.0.0 - Reflected Cross-Site Scripting (CVSS 6.1, Tainacan)
- [CVE-2025-64695](https://cve.now/CVE-2025-64695.md): Uncontrolled search path element issue exists in the installer of LogStare Collector (for Windows). (CVSS 7.8, Installer of LogStare Collector)
- [CVE-2025-64299](https://cve.now/CVE-2025-64299.md): LogStare Collector improperly handles the password hash data. (CVSS 4.9, LogStare Collector)
- [CVE-2025-62687](https://cve.now/CVE-2025-62687.md): Cross-site request forgery vulnerability exists in LogStare Collector. (CVSS 6.5, LogStare Collector)
- [CVE-2025-62189](https://cve.now/CVE-2025-62189.md): LogStare Collector contains an incorrect authorization vulnerability in UserRegistration. (CVSS 4.3, LogStare Collector)
- [CVE-2025-61949](https://cve.now/CVE-2025-61949.md): LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. (CVSS 5.4, LogStare Collector)
- [CVE-2025-58097](https://cve.now/CVE-2025-58097.md): The installation directory of LogStare Collector is configured with incorrect access permissions. (CVSS 5.5, LogStare Collector)
- [CVE-2025-13499](https://cve.now/CVE-2025-13499.md): Access of Uninitialized Pointer in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2025-9825](https://cve.now/CVE-2025-9825.md): Missing Authorization in GitLab (CVSS 5.0, GitLab)
- [CVE-2025-12169](https://cve.now/CVE-2025-12169.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.0 - Missing Authorization to Authenitcated (Subscriber+) to Scheduled Trigger Deletion (CVSS 4.3, elextensions ELEX WordPress HelpDesk & Customer Ticketing S…)
- [CVE-2025-12022](https://cve.now/CVE-2025-12022.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Restore (CVSS 4.3, elextensions ELEX WordPress HelpDesk & Customer Ticketing S…)
- [CVE-2025-12085](https://cve.now/CVE-2025-12085.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Empty (CVSS 4.3, elextensions ELEX WordPress HelpDesk & Customer Ticketing S…)
- [CVE-2025-12023](https://cve.now/CVE-2025-12023.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Ticket Restore (CVSS 4.3, elextensions ELEX WordPress HelpDesk & Customer Ticketing S…)
- [CVE-2025-11368](https://cve.now/CVE-2025-11368.md): LearnPress – WordPress LMS Plugin \<= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure (CVSS 5.3, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2025-64310](https://cve.now/CVE-2025-64310.md): EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. (CVSS 9.8, EPSON WebConfig for SEIKO EPSON Projector Products · Epson…)
- [CVE-2025-64762](https://cve.now/CVE-2025-64762.md): authkit-nextjs may let session cookies be cached in CDNs (CVSS 8.0, workos authkit-nextjs · @workos-inc/authkit-nextjs)
- [CVE-2025-64751](https://cve.now/CVE-2025-64751.md): OpenFGA Improper Policy Enforcement (CVSS 5.8, openfga · github.com/openfga/openfga)
- [CVE-2025-62372](https://cve.now/CVE-2025-62372.md): vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs (CVSS 8.3, vllm-project vllm · vllm)
- [CVE-2025-62426](https://cve.now/CVE-2025-62426.md): vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted \`chat\_template\_kwargs\` (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2025-62164](https://cve.now/CVE-2025-62164.md): VLLM deserialization vulnerability leading to DoS and potential RCE (CVSS 8.8, vllm-project vllm · vllm)
- [CVE-2025-64755](https://cve.now/CVE-2025-64755.md): @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes (CVSS 8.7, anthropics claude-code · @anthropic-ai/claude-code)
- [CVE-2025-13485](https://cve.now/CVE-2025-13485.md): itsourcecode Online File Management System ajax.php sql injection (CVSS 6.9, itsourcecode Online File Management System)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.