# CVEs published 2025-11-22

8 CVEs were published on November 22, 2025: 0 critical, 2 high. Days are UTC.

- [CVE-2025-13526](https://cve.now/CVE-2025-13526.md): OneClick Chat to Order \<= 1.0.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure (CVSS 7.5, walterpinem OneClick Chat to Order)
- [CVE-2025-13318](https://cve.now/CVE-2025-13318.md): Booking Calendar Contact Form \<= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex\_bccf\_ipn' Parameter (CVSS 5.3, codepeople Booking Calendar Contact Form)
- [CVE-2025-13136](https://cve.now/CVE-2025-13136.md): GSheetConnector For Ninja Forms \<= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) System Information Exposure (CVSS 4.3, westerndeal GSheetConnector For Ninja Forms)
- [CVE-2025-12877](https://cve.now/CVE-2025-12877.md): IDonate – Blood Donation, Request And Donor Management System \<= 2.1.15 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (CVSS 5.3, faysal61 IDonate – Blood Donation, Request And Donor Manage…)
- [CVE-2025-12752](https://cve.now/CVE-2025-12752.md): Subscriptions & Memberships for PayPal \<= 1.1.7 - Unauthenticated Fake Payment Creation (CVSS 5.3, scottpaterson Subscriptions & Memberships for PayPal)
- [CVE-2025-13384](https://cve.now/CVE-2025-13384.md): CP Contact Form with PayPal \<= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmation (CVSS 7.5, codepeople CP Contact Form with PayPal)
- [CVE-2025-13317](https://cve.now/CVE-2025-13317.md): Appointment Booking Calendar \<= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc\_ipncheck' Parameter (CVSS 5.3, codepeople Appointment Booking Calendar)
- [CVE-2025-11186](https://cve.now/CVE-2025-11186.md): Cookie Notice & Compliance for GDPR / CCPA \<= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, humanityco Cookie Notice & Compliance for GDPR / CCPA)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.