# CVEs published 2025-12-31

218 CVEs were published on December 31, 2025: 3 critical, 56 high. Days are UTC.

- [CVE-2025-69412](https://cve.now/CVE-2025-69412.md): KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which mi (CVSS 3.4, KDE messagelib)
- [CVE-2025-67711](https://cve.now/CVE-2025-67711.md): Reflected XSS vulnerability in ArcGIS Server. (CVSS 6.1, Esri ArcGIS Server)
- [CVE-2025-67710](https://cve.now/CVE-2025-67710.md): Stored XSS vulnerability in ArcGIS Server (CVSS 6.1, Esri ArcGIS Server)
- [CVE-2025-67709](https://cve.now/CVE-2025-67709.md): There is a cross site scripting issue in ArcGIS Server. (CVSS 6.1, Esri ArcGIS Server)
- [CVE-2025-67708](https://cve.now/CVE-2025-67708.md): Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server. (CVSS 6.1, Esri ArcGIS Server)
- [CVE-2025-67707](https://cve.now/CVE-2025-67707.md): Unvalidated File Upload vulnerability in ArcGIS Server. (CVSS 5.6, Esri ArcGIS Server)
- [CVE-2025-67706](https://cve.now/CVE-2025-67706.md): Unvalidated File Upload vulnerability in ArcGIS Server. (CVSS 5.6, Esri ArcGIS Server)
- [CVE-2025-67705](https://cve.now/CVE-2025-67705.md): Reflected XSS vulnerability in ArcGIS Server. (CVSS 6.1, Esri ArcGIS Server)
- [CVE-2025-67704](https://cve.now/CVE-2025-67704.md): Stored XSS vulnerability in ArcGIS Server. (CVSS 6.1, Esri ArcGIS Server)
- [CVE-2025-67703](https://cve.now/CVE-2025-67703.md): Stored XSS vulnerability in ArcGIS Server. (CVSS 6.1, Esri ArcGIS Server)
- [CVE-2025-15398](https://cve.now/CVE-2025-15398.md): Uasoft badaso Token BadasoAuthController.php forgetPassword password recovery (CVSS 6.3, Uasoft badaso)
- [CVE-2025-69288](https://cve.now/CVE-2025-69288.md): Titra has Remote Code Execution in Admin Functionality (CVSS 9.1, kromitgmbh titra)
- [CVE-2025-69286](https://cve.now/CVE-2025-69286.md): RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability (CVSS 8.9, infiniflow ragflow)
- [CVE-2023-7332](https://cve.now/CVE-2023-7332.md): PocketMine-MP \< 4.18.1 Improper Validation of Dropped Item Count Allows Remote Server Crash (CVSS 7.1, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2025-34469](https://cve.now/CVE-2025-34469.md): Cowrie \< 2.9.0 Unrestricted wget/curl Emulation Enables SSRF-Based DDoS Amplification (CVSS 6.9, Cowrie)
- [CVE-2025-68700](https://cve.now/CVE-2025-68700.md): RAGFlow Remote Code Execution Vulnerability (CVSS 8.6, infiniflow ragflow)
- [CVE-2023-7331](https://cve.now/CVE-2023-7331.md): PKrystian Full-Stack-Bank User sql injection (CVSS 5.1, PKrystian Full-Stack-Bank)
- [CVE-2015-10145](https://cve.now/CVE-2015-10145.md): Gargoyle 1.5.x Authenticated OS Command Execution via run\_commands.sh (CVSS 8.7, Gargoyle Router Management Utility)
- [CVE-2025-53235](https://cve.now/CVE-2025-53235.md): WordPress Easy Social plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, osuthorpe Easy Social)
- [CVE-2025-52739](https://cve.now/CVE-2025-52739.md): WordPress Sala theme \<= 1.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, uxper Sala)
- [CVE-2025-50053](https://cve.now/CVE-2025-50053.md): WordPress Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App Plugin \<= 0.8.8.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, nebelhorn Blappsta Mobile App Plugin – Your native, mobile…)
- [CVE-2025-47566](https://cve.now/CVE-2025-47566.md): WordPress ZoomSounds plugin \<= 6.91 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ZoomSounds)
- [CVE-2025-31054](https://cve.now/CVE-2025-31054.md): WordPress Bloggie theme \<= 2.0.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Themefy Bloggie)
- [CVE-2025-30628](https://cve.now/CVE-2025-30628.md): WordPress Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) plugin \<= 1.2 - SQL Injection Vulnerability (CVSS 8.5, AA-Team Amazon Affiliates Addon for WPBakery Page Builder)
- [CVE-2025-28973](https://cve.now/CVE-2025-28973.md): WordPress Pro Bulk Watermark Plugin for WordPress \<= 2.0 - Path Traversal Vulnerability (CVSS 6.5, AA-Team Pro Bulk Watermark Plugin for WordPress)
- [CVE-2025-28949](https://cve.now/CVE-2025-28949.md): WordPress Mediabay - WordPress Media Library Folders \<= 1.4 - SQL Injection Vulnerability (CVSS 8.5, Codedraft Mediabay - WordPress Media Library Folders)
- [CVE-2025-23757](https://cve.now/CVE-2025-23757.md): WordPress ZD Scribd iPaper plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Proloy Chakroborty ZD Scribd iPaper)
- [CVE-2025-23719](https://cve.now/CVE-2025-23719.md): WordPress ZhinaTwitterWidget plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, zckevin ZhinaTwitterWidget)
- [CVE-2025-23707](https://cve.now/CVE-2025-23707.md): WordPress En Masse plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Matamko En Masse)
- [CVE-2025-23705](https://cve.now/CVE-2025-23705.md): WordPress Zielke Design Project Gallery plugin \<= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Terry Zielke Zielke Design Project Gallery)
- [CVE-2025-23667](https://cve.now/CVE-2025-23667.md): WordPress custom-post-edit plugin \<= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Christopher Churchill custom-post-edit)
- [CVE-2025-66144](https://cve.now/CVE-2025-66144.md): WordPress Worker for Elementor plugin \<= 1.0.10 - Broken Access Control vulnerability (CVSS 5.4, merkulove Worker for Elementor)
- [CVE-2025-66145](https://cve.now/CVE-2025-66145.md): WordPress Worker for WPBakery plugin \<= 1.1.1 - Broken Access Control vulnerability (CVSS 5.4, merkulove Worker for WPBakery)
- [CVE-2025-66146](https://cve.now/CVE-2025-66146.md): WordPress Logger for Elementor plugin \<= 1.0.9 - Broken Access Control vulnerability (CVSS 5.4, merkulove Logger for Elementor)
- [CVE-2025-66148](https://cve.now/CVE-2025-66148.md): WordPress Conformer for Elementor plugin \<= 1.0.7 - Broken Access Control vulnerability (CVSS 5.4, merkulove Conformer for Elementor)
- [CVE-2025-15394](https://cve.now/CVE-2025-15394.md): iCMS POST Parameter ConfigAdmincp.php save code injection (CVSS 5.1, iCMS)
- [CVE-2021-47743](https://cve.now/CVE-2021-47743.md): COMMAX Biometric Access Control System 1.0.0 Reflected XSS via Cookie Parameters (CVSS 5.1, COMMAX Co. COMMAX Biometric Access Control System)
- [CVE-2021-47740](https://cve.now/CVE-2021-47740.md): KZTech JT3500V 4G LTE CPE 2.0.1 Insufficient Session Expiration Vulnerability (CVSS 6.9, KZ Broadband Technologies JT3500V · KZ Broadband Techno… +13)
- [CVE-2021-47725](https://cve.now/CVE-2021-47725.md): STVS ProVision 5.9.10 Authenticated Reflected Cross-Site Scripting via Files Parameter (CVSS 4.8, STVS SA STVS ProVision)
- [CVE-2025-34467](https://cve.now/CVE-2025-34467.md): ZwiiCMS \< 13.7.00 Lock Persistence Authenticated DoS Against Administrative Pages (CVSS 5.3, fredtempez ZwiiCMS)
- [CVE-2021-47747](https://cve.now/CVE-2021-47747.md): meterN 1.2.3 Authenticated Remote Code Execution via Admin Scripts (CVSS 8.6, meterN)
- [CVE-2021-47745](https://cve.now/CVE-2021-47745.md): Cypress Solutions CTM-200 2.7.1 Root Remote OS Command Injection via Firmware Upgrade (CVSS 8.6, Cypress)
- [CVE-2021-47744](https://cve.now/CVE-2021-47744.md): Cypress Solutions CTM-200/CTM-ONE 1.3.6 Hard-coded Credentials Remote Root (CVSS 9.3, Cypress ONE)
- [CVE-2021-47742](https://cve.now/CVE-2021-47742.md): Epic Games Psyonix Rocket League \<=1.95 Elevation of Privileges via Insecure Permissions (CVSS 8.5, Epic Games Psyonix Rocket League)
- [CVE-2021-47741](https://cve.now/CVE-2021-47741.md): ZBL EPON ONU Broadband Router V100R001 Privilege Escalation via Configuration Endpoint (CVSS 8.7, Zblchina ZBL EPON ONU Broadband Router)
- [CVE-2021-47726](https://cve.now/CVE-2021-47726.md): NuCom 11N Wireless Router 5.07.90 Privilege Escalation via Configuration Backup (CVSS 8.7, NuCom 11N Wireless Router)
- [CVE-2020-36904](https://cve.now/CVE-2020-36904.md): Selea CarPlateServer 4.0.1.6 Remote Program Execution via Configuration Endpoint (CVSS 9.3, Selea CarPlateServer)
- [CVE-2020-36903](https://cve.now/CVE-2020-36903.md): Selea CarPlateServer 4.0.1.6 Local Privilege Escalation via Unquoted Service Path (CVSS 8.5, Selea CarPlateServer)
- [CVE-2025-34468](https://cve.now/CVE-2025-34468.md): libcoap Stack-Based Buffer Overflow in Address Resolution DoS or Potential RCE (CVSS 8.2, libcoap)
- [CVE-2025-66149](https://cve.now/CVE-2025-66149.md): WordPress UnGrabber plugin \<= 3.1.3 - Broken Access Control vulnerability (CVSS 5.4, merkulove UnGrabber)
- [CVE-2025-66150](https://cve.now/CVE-2025-66150.md): WordPress Appender plugin \<= 1.1.1 - Broken Access Control vulnerability (CVSS 5.4, merkulove Appender)
- [CVE-2025-66151](https://cve.now/CVE-2025-66151.md): WordPress Countdowner for Elementor plugin \<= 1.0.4 - Broken Access Control vulnerability (CVSS 5.4, merkulove Countdowner for Elementor)
- [CVE-2025-66152](https://cve.now/CVE-2025-66152.md): WordPress Criptopayer for Elementor plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 5.4, merkulove Criptopayer for Elementor)
- [CVE-2025-15393](https://cve.now/CVE-2025-15393.md): Kohana KodiCMS Layout API Endpoint file.php save code injection (CVSS 5.3, Kohana KodiCMS)
- [CVE-2025-66153](https://cve.now/CVE-2025-66153.md): WordPress Headinger for Elementor plugin \<= 1.1.4 - Broken Access Control vulnerability (CVSS 5.4, merkulove Headinger for Elementor)
- [CVE-2025-15392](https://cve.now/CVE-2025-15392.md): Kohana KodiCMS Search API Endpoint page.php like sql injection (CVSS 5.3, Kohana KodiCMS)
- [CVE-2025-15391](https://cve.now/CVE-2025-15391.md): D-Link DIR-806A SSDP Request ssdpcgi\_main command injection (CVSS 5.3, D-Link DIR-806A)
- [CVE-2025-49355](https://cve.now/CVE-2025-49355.md): WordPress Accessibility Press plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, ikaes Accessibility Press)
- [CVE-2025-49337](https://cve.now/CVE-2025-49337.md): WordPress Dashboard Beacon plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, janhenckens Dashboard Beacon)
- [CVE-2025-59135](https://cve.now/CVE-2025-59135.md): WordPress Behance Portfolio Manager plugin \<= 1.7.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, eleopard Behance Portfolio Manager)
- [CVE-2025-62989](https://cve.now/CVE-2025-62989.md): WordPress Cooked plugin \<= 1.11.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Gora Tech Cooked)
- [CVE-2025-23608](https://cve.now/CVE-2025-23608.md): WordPress LIVE TV plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Omar Mohamed Mohamoud LIVE TV)
- [CVE-2025-62088](https://cve.now/CVE-2025-62088.md): WordPress WordPress & WooCommerce Scraper plugin, Import Data from Any Site plugin \<= 1.0.7 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, extendons WordPress & WooCommerce Scraper Plugin, Import Da…)
- [CVE-2025-59138](https://cve.now/CVE-2025-59138.md): WordPress Genemy theme \<= 1.6.6 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Jthemes Genemy)
- [CVE-2019-25262](https://cve.now/CVE-2019-25262.md): elinicksic Razgover Chat Message send.php cross site scripting (CVSS 5.1, elinicksic Razgover)
- [CVE-2025-66154](https://cve.now/CVE-2025-66154.md): WordPress Couponer for Elementor plugin \<= 1.1.7 - Broken Access Control vulnerability (CVSS 5.4, merkulove Couponer for Elementor)
- [CVE-2025-66155](https://cve.now/CVE-2025-66155.md): WordPress Questionar for Elementor plugin \<= 1.1.7 - Broken Access Control vulnerability (CVSS 5.4, merkulove Questionar for Elementor)
- [CVE-2025-66156](https://cve.now/CVE-2025-66156.md): WordPress Watcher for Elementor plugin \<= 1.0.9 - Broken Access Control vulnerability (CVSS 5.4, merkulove Watcher for Elementor)
- [CVE-2025-66157](https://cve.now/CVE-2025-66157.md): WordPress Sliper for Elementor plugin \<= 1.0.10 - Broken Access Control vulnerability (CVSS 5.4, merkulove Sliper for Elementor)
- [CVE-2025-66158](https://cve.now/CVE-2025-66158.md): WordPress Gmaper for Elementor plugin \<= 1.0.9 - Broken Access Control vulnerability (CVSS 5.4, merkulove Gmaper for Elementor)
- [CVE-2025-66159](https://cve.now/CVE-2025-66159.md): WordPress Walker for Elementor plugin \<= 1.1.6 - Broken Access Control vulnerability (CVSS 5.4, merkulove Walker for Elementor)
- [CVE-2025-66160](https://cve.now/CVE-2025-66160.md): WordPress Select Graphist for Elementor Graphist for Elementor plugin \<= 1.2.10 - Broken Access Control vulnerability (CVSS 5.4, merkulove Select Graphist for Elementor Graphist for Eleme…)
- [CVE-2025-63021](https://cve.now/CVE-2025-63021.md): WordPress Valenti Engine plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, codetipi Valenti Engine)
- [CVE-2025-62874](https://cve.now/CVE-2025-62874.md): WordPress AnyComment plugin \<= 0.3.6 - Broken Access Control vulnerability (CVSS 4.3, Alexander AnyComment)
- [CVE-2025-62099](https://cve.now/CVE-2025-62099.md): WordPress Signature Add-On for Gravity Forms plugin \<= 1.8.6 - Broken Access Control vulnerability (CVSS 4.3, approveme Signature Add-On for Gravity Forms)
- [CVE-2025-62101](https://cve.now/CVE-2025-62101.md): WordPress Pardakht Delkhah plugin \<= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Omid Shamloo Pardakht Delkhah)
- [CVE-2025-63038](https://cve.now/CVE-2025-63038.md): WordPress WP Custom Admin Interface plugin \<= 7.40 - Broken Access Control vulnerability (CVSS 4.3, Northern Beaches Websites WP Custom Admin Interface)
- [CVE-2025-62078](https://cve.now/CVE-2025-62078.md): WordPress Easy Upload Files During Checkout plugin \<= 3.0.0 - Broken Access Control vulnerability (CVSS 4.3, Fahad Mahmood Easy Upload Files During Checkout)
- [CVE-2025-49339](https://cve.now/CVE-2025-49339.md): WordPress Direct Payments WP plugin \<= 1.3.2 - Broken Access Control vulnerability (CVSS 4.3, Digages Direct Payments WP)
- [CVE-2025-49340](https://cve.now/CVE-2025-49340.md): WordPress Direct Payments WP plugin \<= 1.3.2 - Sensitive Data Exposure vulnerability (CVSS 4.3, Digages Direct Payments WP)
- [CVE-2025-62083](https://cve.now/CVE-2025-62083.md): WordPress BoomDevs WordPress Coming Soon plugin plugin \<= 1.0.4 - Sensitive Data Exposure vulnerability (CVSS 4.3, WP Messiah BoomDevs WordPress Coming Soon)
- [CVE-2025-62113](https://cve.now/CVE-2025-62113.md): WordPress Co-marquage service-public.fr plugin \<= 0.5.77 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, emendo\_seb Co-marquage service-public.fr)
- [CVE-2025-62115](https://cve.now/CVE-2025-62115.md): WordPress Hide Plugins plugin \<= 1.0.4 - Broken Access Control vulnerability (CVSS 4.3, ThemeBoy Hide Plugins)
- [CVE-2025-62123](https://cve.now/CVE-2025-62123.md): WordPress WP Gmail SMTP plugin \<= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, inkthemes WP Gmail SMTP)
- [CVE-2025-49352](https://cve.now/CVE-2025-49352.md): WordPress Order Cancellation & Returns for WooCommerce plugin \<= 1.1.10 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, YoOhw Studio Order Cancellation & Returns for WooCommerce)
- [CVE-2025-62087](https://cve.now/CVE-2025-62087.md): WordPress Sticky Notes for WP Dashboard plugin \<= 1.2.4 - Broken Access Control vulnerability (CVSS 4.3, Web Builder 143 Sticky Notes for WP Dashboard)
- [CVE-2025-63040](https://cve.now/CVE-2025-63040.md): WordPress Post Snippets plugin \<= 4.0.11 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Saad Iqbal Post Snippets)
- [CVE-2025-49356](https://cve.now/CVE-2025-49356.md): WordPress Orders Chat for WooCommerce plugin \<= 1.2.0 - Broken Access Control vulnerability (CVSS 4.3, Mykola Lukin Orders Chat for WooCommerce)
- [CVE-2025-63004](https://cve.now/CVE-2025-63004.md): WordPress All in One Accessibility plugin \<= 1.15 - Broken Access Control vulnerability (CVSS 4.3, Skynet Technologies USA All in One Accessibility)
- [CVE-2025-59130](https://cve.now/CVE-2025-59130.md): WordPress Appointify plugin \<= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Appointify)
- [CVE-2025-62130](https://cve.now/CVE-2025-62130.md): WordPress Accordion Slider Gallery plugin \<= 2.7 - Broken Access Control vulnerability (CVSS 4.3, wpdiscover Accordion Slider Gallery)
- [CVE-2025-62131](https://cve.now/CVE-2025-62131.md): WordPress Tasty Recipes Lite plugin \<= 1.1.5 - Broken Access Control vulnerability (CVSS 4.3, Strategy11 Team Tasty Recipes Lite)
- [CVE-2025-62132](https://cve.now/CVE-2025-62132.md): WordPress Tasty Recipes Lite plugin \<= 1.1.5 - Broken Access Control vulnerability (CVSS 4.3, Strategy11 Team Tasty Recipes Lite)
- [CVE-2025-62751](https://cve.now/CVE-2025-62751.md): WordPress Vireo theme \<= 1.0.24 - Broken Access Control vulnerability (CVSS 4.3, extendthemes Vireo)
- [CVE-2025-62133](https://cve.now/CVE-2025-62133.md): WordPress FormFacade plugin \<= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, manidoraisamy FormFacade)
- [CVE-2025-63014](https://cve.now/CVE-2025-63014.md): WordPress Gmedia Photo Gallery plugin \<= 1.25.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Serhii Pasyuk Gmedia Photo Gallery)
- [CVE-2025-62089](https://cve.now/CVE-2025-62089.md): WordPress Mergado Pack plugin \<= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Mergado Pack)
- [CVE-2025-62084](https://cve.now/CVE-2025-62084.md): WordPress iNext Woo Pincode Checker plugin \<= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Imdad Next Web iNext Woo Pincode Checker)
- [CVE-2025-62143](https://cve.now/CVE-2025-62143.md): WordPress Post Video Players plugin \<= 1.163 - Sensitive Data Exposure vulnerability (CVSS 4.3, nicashmu Post Video Players)
- [CVE-2025-62148](https://cve.now/CVE-2025-62148.md): WordPress Robots.txt rewrite plugin \<= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Eugen Bobrowski Robots.txt rewrite)
- [CVE-2025-62080](https://cve.now/CVE-2025-62080.md): WordPress Live Shopping & Shoppable Videos For WooCommerce plugin \<= 2.2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Channelize.io Team Live Shopping & Shoppable Videos For Woo…)
- [CVE-2025-62150](https://cve.now/CVE-2025-62150.md): WordPress History Timeline plugin \<= 1.0.6 - Broken Access Control vulnerability (CVSS 4.3, themesawesome History Timeline)
- [CVE-2025-62154](https://cve.now/CVE-2025-62154.md): WordPress AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One plugin \<= 1.1.7 - Broken Access Control vulnerability (CVSS 4.3, recorp AI Content Writing Assistant (Content Writer, ChatGP…)
- [CVE-2025-62114](https://cve.now/CVE-2025-62114.md): WordPress Download Media Library plugin \<= 0.2.1 - Sensitive Data Exposure vulnerability (CVSS 5.3, marcelotorres Download Media Library)
- [CVE-2025-62116](https://cve.now/CVE-2025-62116.md): WordPress AI Copilot plugin \<= 1.5.2 - Broken Access Control vulnerability (CVSS 5.3, quadlayers AI Copilot)
- [CVE-2025-62122](https://cve.now/CVE-2025-62122.md): WordPress Trash Duplicate and 301 Redirect plugin \<= 1.9.1 - Broken Access Control vulnerability (CVSS 5.3, solwininfotech Trash Duplicate and 301 Redirect)
- [CVE-2025-62079](https://cve.now/CVE-2025-62079.md): WordPress WP Export Categories & Taxonomies plugin \<= 1.0.3 - Broken Access Control vulnerability (CVSS 5.3, Damian WP Export Categories & Taxonomies)
- [CVE-2025-62126](https://cve.now/CVE-2025-62126.md): WordPress Varnish/Nginx Proxy Caching plugin \<= 1.8.3 - Sensitive Data Exposure vulnerability (CVSS 5.3, Razvan Stanga Varnish/Nginx Proxy Caching)
- [CVE-2025-49338](https://cve.now/CVE-2025-49338.md): WordPress Flowbox plugin \<= 1.1.6 - Broken Access Control vulnerability (CVSS 5.3, Flowbox)
- [CVE-2025-62747](https://cve.now/CVE-2025-62747.md): WordPress Featured Image Generator plugin \<= 1.3.4 - Broken Access Control vulnerability (CVSS 5.3, Aum Watcharapon Featured Image Generator)
- [CVE-2025-15390](https://cve.now/CVE-2025-15390.md): PHPGurukul Small CRM edit-user.php authorization (CVSS 5.3, PHPGurukul Small CRM)
- [CVE-2025-49334](https://cve.now/CVE-2025-49334.md): WordPress MyD Delivery plugin \<= 1.7.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, Eduardo Villão MyD Delivery)
- [CVE-2025-59136](https://cve.now/CVE-2025-59136.md): WordPress Gerencianet Oficial plugin \<= 3.1.3 - Sensitive Data Exposure vulnerability (CVSS 5.3, Efí Bank Gerencianet Oficial)
- [CVE-2025-62129](https://cve.now/CVE-2025-62129.md): WordPress RestroPress plugin \<= 3.2.7 - Broken Access Control vulnerability (CVSS 5.3, Magnigenie RestroPress)
- [CVE-2025-62092](https://cve.now/CVE-2025-62092.md): WordPress Wiremo plugin \<= 1.4.99 - Broken Access Control vulnerability (CVSS 5.3, Wiremo)
- [CVE-2025-62755](https://cve.now/CVE-2025-62755.md): WordPress GS Portfolio for Envato plugin \<= 1.4.2 - Broken Access Control vulnerability (CVSS 5.3, GS Plugins GS Portfolio for Envato)
- [CVE-2025-63031](https://cve.now/CVE-2025-63031.md): WordPress EasyTest – Simplify A/B Testing plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 5.3, WP Grids EasyTest – Simplify A/B Testing)
- [CVE-2025-62139](https://cve.now/CVE-2025-62139.md): WordPress Terms descriptions plugin \<= 3.4.10 - Sensitive Data Exposure vulnerability (CVSS 5.3, Vladimir Statsenko Terms descriptions)
- [CVE-2025-62141](https://cve.now/CVE-2025-62141.md): WordPress Wawp plugin \<= 4.4 - Broken Access Control vulnerability (CVSS 5.3, Information Technology Wawp)
- [CVE-2025-63022](https://cve.now/CVE-2025-63022.md): WordPress Simple Like Page plugin \<= 1.5.3 - Broken Access Control vulnerability (CVSS 5.3, topdevs.net Simple Like Page)
- [CVE-2025-63016](https://cve.now/CVE-2025-63016.md): WordPress QuadLayers TikTok Feed plugin \<= 4.6.5 - Broken Access Control vulnerability (CVSS 5.3, QuadLayers TikTok Feed)
- [CVE-2025-62145](https://cve.now/CVE-2025-62145.md): WordPress DMCA Protection Badge plugin \<= 2.2.0 - Broken Access Control vulnerability (CVSS 5.3, NewClarity DMCA Protection Badge)
- [CVE-2025-62147](https://cve.now/CVE-2025-62147.md): WordPress Realbig plugin \<= 1.1.3 - Broken Access Control vulnerability (CVSS 5.3, nikmelnik Realbig)
- [CVE-2025-62081](https://cve.now/CVE-2025-62081.md): WordPress Live Shopping & Shoppable Videos For WooCommerce plugin \<= 2.2.0 - Broken Access Control vulnerability (CVSS 5.3, Channelize.io Team Live Shopping & Shoppable Videos For Woo…)
- [CVE-2025-63053](https://cve.now/CVE-2025-63053.md): WordPress Master Addons for Elementor plugin \<= 2.0.9.9.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, Liton Arefin Master Addons for Elementor)
- [CVE-2025-63001](https://cve.now/CVE-2025-63001.md): WordPress Hotel Booking plugin \<= 3.8 - Broken Access Control vulnerability (CVSS 5.3, nicdark Hotel Booking)
- [CVE-2025-49349](https://cve.now/CVE-2025-49349.md): WordPress Reuters Direct plugin \<= 3.0.0 - Broken Access Control vulnerability (CVSS 5.3, Reuters News Agency Reuters Direct)
- [CVE-2025-62098](https://cve.now/CVE-2025-62098.md): WordPress Portfolio Gallery plugin \<= 1.4.8 - Broken Access Control vulnerability (CVSS 5.4, totalsoft Portfolio Gallery)
- [CVE-2025-62091](https://cve.now/CVE-2025-62091.md): WordPress Serial Codes Generator and Validator with WooCommerce Support plugin \<= 2.8.2 - Broken Access Control vulnerability (CVSS 5.4, Vollstart Serial Codes Generator and Validator with WooComm…)
- [CVE-2025-62108](https://cve.now/CVE-2025-62108.md): WordPress Add Custom Codes plugin \<= 4.80 - Broken Access Control vulnerability (CVSS 5.4, SaifuMak Add Custom Codes)
- [CVE-2025-62888](https://cve.now/CVE-2025-62888.md): WordPress WP Attachments plugin \<= 5.2 - Broken Access Control vulnerability (CVSS 5.4, Marco Milesi WP Attachments)
- [CVE-2025-62117](https://cve.now/CVE-2025-62117.md): WordPress EasyIndex plugin \<= 1.1.1704 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Jayce53 EasyIndex)
- [CVE-2025-62120](https://cve.now/CVE-2025-62120.md): WordPress OpenHook plugin \<= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Rick Beckman OpenHook)
- [CVE-2025-62134](https://cve.now/CVE-2025-62134.md): WordPress Contact Form Widget plugin \<= 1.5.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, A WP Life Contact Form Widget)
- [CVE-2025-62138](https://cve.now/CVE-2025-62138.md): WordPress WP Advanced PDF plugin \<= 1.1.7 - Other vulnerability Type vulnerability (CVSS 5.4, cedcommerce WP Advanced PDF)
- [CVE-2025-62144](https://cve.now/CVE-2025-62144.md): WordPress Core Web Vitals & PageSpeed Booster plugin \<= 1.0.28 - Broken Access Control vulnerability (CVSS 5.4, Mohammed Kaludi Core Web Vitals & PageSpeed Booster)
- [CVE-2025-59003](https://cve.now/CVE-2025-59003.md): WordPress ColorWay Theme \<= 4.2.3 - Sensitive Data Exposure Vulnerability (CVSS 5.8, inkthemescom ColorWay)
- [CVE-2025-62119](https://cve.now/CVE-2025-62119.md): WordPress Add Featured Image Custom Link plugin \<= 2.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, ViitorCloud Technologies Pvt Add Featured Image Custom Link)
- [CVE-2025-62121](https://cve.now/CVE-2025-62121.md): WordPress Logo Slider , Logo Carousel , Logo showcase , Client Logo plugin \<= 1.8.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Imran Emu Logo Slider , Logo Carousel , Logo showcase , Cli…)
- [CVE-2025-62124](https://cve.now/CVE-2025-62124.md): WordPress WP Post Signature plugin \<= 0.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Soli WP Post Signature)
- [CVE-2025-62750](https://cve.now/CVE-2025-62750.md): WordPress WooCommerce Parcelas plugin \<= 1.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Filipe Seabra WooCommerce Parcelas)
- [CVE-2025-62140](https://cve.now/CVE-2025-62140.md): WordPress Locatoraid Store Locator plugin \<= 3.9.68 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, plainware Locatoraid Store Locator)
- [CVE-2025-62142](https://cve.now/CVE-2025-62142.md): WordPress Post Video Players plugin \<= 1.163 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, nicashmu Post Video Players)
- [CVE-2025-62149](https://cve.now/CVE-2025-62149.md): WordPress Add Custom Codes plugin \<= 4.80 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, SaifuMak Add Custom Codes)
- [CVE-2025-62095](https://cve.now/CVE-2025-62095.md): WordPress Bootstrap Modals plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, neilgee Bootstrap Modals)
- [CVE-2025-62096](https://cve.now/CVE-2025-62096.md): WordPress Maximum Products per User for WooCommerce plugin \<= 4.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPFactory Maximum Products per User for WooCommerce)
- [CVE-2025-62097](https://cve.now/CVE-2025-62097.md): WordPress SEO Slider plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, seothemes SEO Slider)
- [CVE-2025-63020](https://cve.now/CVE-2025-63020.md): WordPress Postie plugin \<= 1.9.73 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Wayne Allen Postie)
- [CVE-2025-62111](https://cve.now/CVE-2025-62111.md): WordPress Extra Shortcodes plugin \<= 2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, webvitaly Extra Shortcodes)
- [CVE-2025-49357](https://cve.now/CVE-2025-49357.md): WordPress Audiomack plugin \<= 1.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Audiomack)
- [CVE-2025-62742](https://cve.now/CVE-2025-62742.md): WordPress Curator.io plugin \<= 1.9.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Curator.io)
- [CVE-2025-62118](https://cve.now/CVE-2025-62118.md): WordPress AdWords Conversion Tracking Code plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, kcseopro AdWords Conversion Tracking Code)
- [CVE-2025-62990](https://cve.now/CVE-2025-62990.md): WordPress Livemesh Addons for Beaver Builder plugin \<= 3.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Livemesh Addons for Beaver Builder)
- [CVE-2025-62125](https://cve.now/CVE-2025-62125.md): WordPress Custom Background Changer plugin \<= 3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Anshul Gangrade Custom Background Changer)
- [CVE-2025-62743](https://cve.now/CVE-2025-62743.md): WordPress MyBookTable Bookstore plugin \<= 3.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, zookatron MyBookTable Bookstore)
- [CVE-2025-62744](https://cve.now/CVE-2025-62744.md): WordPress Page Title Splitter plugin \<= 2.5.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Chris Steman Page Title Splitter)
- [CVE-2025-62748](https://cve.now/CVE-2025-62748.md): WordPress Web and WooCommerce Addons for WPBakery Builder plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Genetech Products Web and WooCommerce Addons for WPBakery B…)
- [CVE-2025-49358](https://cve.now/CVE-2025-49358.md): WordPress Content Fetcher plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ruhul Amin Content Fetcher)
- [CVE-2025-62749](https://cve.now/CVE-2025-62749.md): WordPress User Specific Content plugin \<= 1.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Bainternet User Specific Content)
- [CVE-2025-62752](https://cve.now/CVE-2025-62752.md): WordPress Calendar.online / Kalender.digital plugin \<= 1.0.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Kalender.digital)
- [CVE-2025-62135](https://cve.now/CVE-2025-62135.md): WordPress Responsive Block Control plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, landwire Responsive Block Control)
- [CVE-2025-62756](https://cve.now/CVE-2025-62756.md): WordPress The Moneytizer plugin \<= 10.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, lvaudore The Moneytizer)
- [CVE-2025-62757](https://cve.now/CVE-2025-62757.md): WordPress WebMan Amplifier plugin \<= 1.5.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WebMan Design | Oliver Juhas WebMan Amplifier)
- [CVE-2025-62991](https://cve.now/CVE-2025-62991.md): WordPress Minamaze theme \<= 1.10.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, thinkupthemes Minamaze)
- [CVE-2025-63032](https://cve.now/CVE-2025-63032.md): WordPress Consulting theme \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, thinkupthemes Consulting)
- [CVE-2025-15389](https://cve.now/CVE-2025-15389.md): QNO Technology｜VPN Firewall - OS Command Injection (CVSS 8.7, QNO Technology VPN Firewall)
- [CVE-2025-49028](https://cve.now/CVE-2025-49028.md): WordPress Zoho ZeptoMail plugin \<= 3.3.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, Zoho Mail Zoho ZeptoMail)
- [CVE-2025-15388](https://cve.now/CVE-2025-15388.md): QNO Technology｜VPN Firewall - OS Command Injection (CVSS 8.7, QNO Technology VPN Firewall)
- [CVE-2025-62136](https://cve.now/CVE-2025-62136.md): WordPress Melos theme \<= 1.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, thinkupthemes Melos)
- [CVE-2025-62992](https://cve.now/CVE-2025-62992.md): WordPress Everest Backup plugin \<= 2.3.11 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, everestthemes Everest Backup)
- [CVE-2025-62137](https://cve.now/CVE-2025-62137.md): WordPress Shuttle theme \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, shuttlethemes Shuttle)
- [CVE-2025-62758](https://cve.now/CVE-2025-62758.md): WordPress Funnelforms Free plugin \<= 3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Funnelforms Free)
- [CVE-2025-62759](https://cve.now/CVE-2025-62759.md): WordPress Series plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Justin Tadlock Series)
- [CVE-2025-62760](https://cve.now/CVE-2025-62760.md): WordPress BuddyPress Activity Shortcode plugin \<= 1.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BuddyDev BuddyPress Activity Shortcode)
- [CVE-2025-63000](https://cve.now/CVE-2025-63000.md): WordPress Sermon Manager plugin \<= 2.30.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpforchurch Sermon Manager)
- [CVE-2025-62146](https://cve.now/CVE-2025-62146.md): WordPress MX Time Zone Clocks plugin \<= 5.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Maksym Marko MX Time Zone Clocks)
- [CVE-2025-63005](https://cve.now/CVE-2025-63005.md): WordPress WordPress Tooltips plugin \<= 10.9.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tomas WordPress Tooltips)
- [CVE-2025-62761](https://cve.now/CVE-2025-62761.md): WordPress Knowledge Base documentation & wiki plugin – BasePress plugin \<= 2.17.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Knowledge Base documentation & wiki plugin – BasePress)
- [CVE-2025-15387](https://cve.now/CVE-2025-15387.md): QNO Technology｜VPN Firewall - Insufficient Entropy (CVSS 8.7, QNO Technology VPN Firewall)
- [CVE-2025-15017](https://cve.now/CVE-2025-15017.md): A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. (CVSS 7.0, Moxa NPort 5000AI-M12 Series · Moxa NPort 5100 Series +9)
- [CVE-2025-2026](https://cve.now/CVE-2025-2026.md): The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null (CVSS 7.1, Moxa NPort 6100-G2/6200-G2 Series)
- [CVE-2025-1977](https://cve.now/CVE-2025-1977.md): The NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges vulnerability (CVE-2025-1977) that allows an authen (CVSS 7.7, Moxa NPort 6100-G2/6200-G2 Series)
- [CVE-2025-15279](https://cve.now/CVE-2025-15279.md): FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, FontForge)
- [CVE-2025-15278](https://cve.now/CVE-2025-15278.md): FontForge GUtils XBM File Parsing Integer Overflow Remote Code Execution Vulnerability (CVSS 7.8, FontForge)
- [CVE-2025-15277](https://cve.now/CVE-2025-15277.md): FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, FontForge)
- [CVE-2025-15276](https://cve.now/CVE-2025-15276.md): FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, FontForge)
- [CVE-2025-15280](https://cve.now/CVE-2025-15280.md): FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 8.8, FontForge)
- [CVE-2025-15275](https://cve.now/CVE-2025-15275.md): FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, FontForge)
- [CVE-2025-15274](https://cve.now/CVE-2025-15274.md): FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, FontForge)
- [CVE-2025-15273](https://cve.now/CVE-2025-15273.md): FontForge PFB File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, FontForge)
- [CVE-2025-15272](https://cve.now/CVE-2025-15272.md): FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, FontForge)
- [CVE-2025-15271](https://cve.now/CVE-2025-15271.md): FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability (CVSS 8.8, FontForge)
- [CVE-2025-15270](https://cve.now/CVE-2025-15270.md): FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability (CVSS 8.8, FontForge)
- [CVE-2025-15269](https://cve.now/CVE-2025-15269.md): FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 8.8, FontForge)
- [CVE-2025-14783](https://cve.now/CVE-2025-14783.md): Easy Digital Downloads \<= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd\_redirect (CVSS 4.3, smub Easy Digital Downloads – eCommerce Payments and Subscr…)
- [CVE-2025-14434](https://cve.now/CVE-2025-14434.md): Ultimate Post Kit \< 4.0.16 – Unauthenticated Arbitrary Post Content Disclosure (CVSS 5.3, Ultimate Post Kit Addons for Elementor)
- [CVE-2025-13029](https://cve.now/CVE-2025-13029.md): Knowband Mobile App Builder for wooCommerce \< 3.0.0 – Unauthenticated Arbitrary User Deletion (CVSS 7.5, Knowband Mobile App Builder)
- [CVE-2025-49342](https://cve.now/CVE-2025-49342.md): WordPress Custom Style plugin \<= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, merzedes Custom Style)
- [CVE-2025-69277](https://cve.now/CVE-2025-69277.md): libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto\_core\_ed25519\_is\_valid\_poin (CVSS 4.5, libsodium · pynacl +2)
- [CVE-2025-49353](https://cve.now/CVE-2025-49353.md): WordPress Noindex by Path plugin \<= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Marcin Kijak Noindex by Path)
- [CVE-2025-68885](https://cve.now/CVE-2025-68885.md): WordPress Custom Post Status plugin \<= 1.1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, page-carbajal Custom Post Status)
- [CVE-2025-49354](https://cve.now/CVE-2025-49354.md): WordPress Recent Posts From Each Category plugin \<= 1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Mindstien Technologies Recent Posts From Each Category)
- [CVE-2025-49343](https://cve.now/CVE-2025-49343.md): WordPress Social Profilr plugin \<= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, socialprofilr Social Profilr)
- [CVE-2025-49344](https://cve.now/CVE-2025-49344.md): WordPress SensitiveTagCloud plugin \<= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, reneade SensitiveTagCloud)
- [CVE-2025-49345](https://cve.now/CVE-2025-49345.md): WordPress WP-EasyArchives plugin \<= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, mg12 WP-EasyArchives)
- [CVE-2025-15375](https://cve.now/CVE-2025-15375.md): EyouCMS arcpagelist Ajax.php unserialize deserialization (CVSS 5.3, EyouCMS)
- [CVE-2025-49346](https://cve.now/CVE-2025-49346.md): WordPress Simple Archive Generator plugin \<= 5.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, peterwsterling Simple Archive Generator)
- [CVE-2025-59137](https://cve.now/CVE-2025-59137.md): WordPress Behance Portfolio Manager plugin \<= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, eleopard Behance Portfolio Manager)
- [CVE-2025-15374](https://cve.now/CVE-2025-15374.md): EyouCMS Ask Module Ask.php cross site scripting (CVSS 5.1, EyouCMS)
- [CVE-2025-15373](https://cve.now/CVE-2025-15373.md): EyouCMS function.php saveRemote server-side request forgery (CVSS 5.3, EyouCMS)
- [CVE-2025-15223](https://cve.now/CVE-2025-15223.md): Philipinho Simple-PHP-Blog login.php cross site scripting (CVSS 5.3, Philipinho Simple-PHP-Blog)
- [CVE-2025-15372](https://cve.now/CVE-2025-15372.md): youlaitech vue3-element-admin Notice index.vue cross site scripting (CVSS 4.8, youlaitech vue3-element-admin)
- [CVE-2025-68131](https://cve.now/CVE-2025-68131.md): CBORDecoder reuse can leak shareable values across decode calls (CVSS 5.5, agronholm cbor2 · cbor2)
- [CVE-2025-15371](https://cve.now/CVE-2025-15371.md): Tenda i24 Shadow File hard-coded credentials (CVSS 8.5, Tenda i24 · Tenda 4G03 Pro +5)
- [CVE-2025-11964](https://cve.now/CVE-2025-11964.md): OOBW in utf\_16le\_to\_utf\_8\_truncated() in libpcap (CVSS 1.9, The Tcpdump Group libpcap)
- [CVE-2025-11961](https://cve.now/CVE-2025-11961.md): OOBR and OOBW in pcap\_ether\_aton() in libpcap (CVSS 1.9, The Tcpdump Group libpcap)
- [CVE-2025-61037](https://cve.now/CVE-2025-61037.md): A local privilege escalation vulnerability exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). (CVSS 7.0)
- [CVE-2025-64699](https://cve.now/CVE-2025-64699.md): An incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.