# CVEs published 2026-01-17

39 CVEs were published on January 17, 2026: 2 critical, 1 high. Days are UTC.

- [CVE-2026-1105](https://cve.now/CVE-2026-1105.md): EasyCMS UserAction.class.php sql injection (CVSS 6.9, EasyCMS)
- [CVE-2026-1066](https://cve.now/CVE-2026-1066.md): kalcaddle kodbox Compression zip command injection (CVSS 5.3, kalcaddle kodbox)
- [CVE-2026-1064](https://cve.now/CVE-2026-1064.md): bastillion-io Bastillion System Management SystemKtrl.java command injection (CVSS 5.1, bastillion-io Bastillion)
- [CVE-2026-1063](https://cve.now/CVE-2026-1063.md): bastillion-io Bastillion Public Key Management System AuthKeysKtrl.java command injection (CVSS 5.1, bastillion-io Bastillion)
- [CVE-2026-1062](https://cve.now/CVE-2026-1062.md): xiweicheng TMS HtmlUtil.java summary server-side request forgery (CVSS 5.3, xiweicheng TMS)
- [CVE-2026-1061](https://cve.now/CVE-2026-1061.md): xiweicheng TMS FileController.java upload unrestricted upload (CVSS 5.3, xiweicheng TMS)
- [CVE-2026-1059](https://cve.now/CVE-2026-1059.md): FeMiner wms chkuser.php sql injection (CVSS 6.9, FeMiner wms)
- [CVE-2026-1050](https://cve.now/CVE-2026-1050.md): risesoft-y9 Digital-Infrastructure REST Authenticate Endpoint Y9PlatformUtil.java sql injection (CVSS 6.9, risesoft-y9 Digital-Infrastructure · net.risesoft:risenet-y…)
- [CVE-2026-1049](https://cve.now/CVE-2026-1049.md): LigeroSmart index.pl cross site scripting (CVSS 5.1, LigeroSmart)
- [CVE-2026-1048](https://cve.now/CVE-2026-1048.md): LigeroSmart index.pl cross site scripting (CVSS 5.1, LigeroSmart)
- [CVE-2025-15532](https://cve.now/CVE-2025-15532.md): Open5GS Timer resource consumption (CVSS 6.9, Open5GS)
- [CVE-2025-15531](https://cve.now/CVE-2025-15531.md): Open5GS context.c sgwc\_bearer\_add assertion (CVSS 6.9, Open5GS)
- [CVE-2025-15530](https://cve.now/CVE-2025-15530.md): Open5GS s11-handler.c assertion (CVSS 6.9, Open5GS)
- [CVE-2025-8615](https://cve.now/CVE-2025-8615.md): CubeWP \<= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp\_shortcode\_taxonomy Shortcode (CVSS 6.4, cubewp1211 CubeWP Framework)
- [CVE-2025-14078](https://cve.now/CVE-2025-14078.md): PAYGENT for WooCommerce \<= 2.4.6 - Missing Authorization to Unauthenticated Payment Callback Manipulation (CVSS 5.3, shoheitanaka PAYGENT for WooCommerce)
- [CVE-2026-0725](https://cve.now/CVE-2026-0725.md): Integrate Dynamics 365 CRM \<= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Field Mapping Configuration (CVSS 4.4, cyberlord92 Integrate Dynamics 365 CRM)
- [CVE-2025-10484](https://cve.now/CVE-2025-10484.md): Registration & Login with Mobile Phone Number for WooCommerce \<= 1.3.1 - Authentication Bypass (CVSS 9.8, FmeAddons Registration & Login with Mobile Phone Number for…)
- [CVE-2025-14478](https://cve.now/CVE-2025-14478.md): Demo Importer Plus \<= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload (CVSS 7.5, kraftplugins Demo Importer Plus)
- [CVE-2025-12129](https://cve.now/CVE-2025-12129.md): CubeWP – All-in-One Dynamic Content Framework \<= 1.1.27 - Unauthenticated Information Exposure (CVSS 5.3, cubewp1211 CubeWP Framework)
- [CVE-2026-0808](https://cve.now/CVE-2026-0808.md): Spin Wheel \<= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize\_index' Parameter (CVSS 5.3, bdthemes Spin Wheel – Interactive spinning wheel that offer…)
- [CVE-2026-0691](https://cve.now/CVE-2026-0691.md): CM E-Mail Blacklist \<= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black\_email' Parameter (CVSS 4.4, creativemindssolutions CM E-Mail Blacklist – Simple email f…)
- [CVE-2025-12984](https://cve.now/CVE-2025-12984.md): Advanced Ads – Ad Manager & AdSense \<= 2.0.15 - Authenticated (Admin+) SQL Injection (CVSS 4.9, monetizemore Advanced Ads – Ad Manager & AdSense)
- [CVE-2026-0833](https://cve.now/CVE-2026-0833.md): Team Section Block \<= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Link (CVSS 6.4, bplugins Team Section Block – Showcase Team Members with La…)
- [CVE-2025-12825](https://cve.now/CVE-2025-12825.md): User Registration Using Contact Form 7 \<= 2.5 - Authenticated (Subscriber+) Information Exposure (CVSS 5.3, zealopensource User Registration Using Contact Form)
- [CVE-2025-12168](https://cve.now/CVE-2025-12168.md): Phrase TMS Integration for WordPress \<= 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Log Deletion (CVSS 4.3, memsource Phrase TMS Integration for WordPress)
- [CVE-2025-14029](https://cve.now/CVE-2025-14029.md): Community Events \<= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter (CVSS 5.3, jackdewey Community Events)
- [CVE-2025-14463](https://cve.now/CVE-2025-14463.md): Payment Button for PayPal \<= 1.2.3.41 - Missing Authorization to Unauthenticated Arbitrary Order Creation (CVSS 5.3, naa986 Payment Button for PayPal)
- [CVE-2025-13725](https://cve.now/CVE-2025-13725.md): Gutenberg Thim Blocks \<= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter (CVSS 6.5, thimpress Thim Blocks)
- [CVE-2026-0682](https://cve.now/CVE-2026-0682.md): Church Admin \<= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio\_url' Parameter (CVSS 2.2, andy\_moyle Church Admin)
- [CVE-2026-0820](https://cve.now/CVE-2026-0820.md): RepairBuddy \<= 4.1116 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Signature Upload to Orders (CVSS 4.3, sweetdaisy86 RepairBuddy – Repair Shop CRM & Booking Plugin…)
- [CVE-2025-12002](https://cve.now/CVE-2025-12002.md): Feeds for YouTube Pro \<= 2.6.0 - Unauthenticated Arbitrary File Read via Path Traversal (CVSS 5.9, Awesome Motive YouTube Feed Pro)
- [CVE-2025-12718](https://cve.now/CVE-2025-12718.md): Quick Contact Form \<= 8.2.6 - Unauthenticated Open Mail Relay (CVSS 5.8, saadiqbal Quick Contact Form)
- [CVE-2025-14632](https://cve.now/CVE-2025-14632.md): Filr – Secure document library \<= 1.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Upload (CVSS 4.4, wpchill Filr – Secure document library)
- [CVE-2025-15403](https://cve.now/CVE-2025-15403.md): RegistrationMagic \<= 6.0.7.1 - Unauthenticated Privilege Escalation via admin\_order (CVSS 9.8, metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2025-14450](https://cve.now/CVE-2025-14450.md): Wallet System for WooCommerce \<= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation (CVSS 6.5, wpswings Wallet System for WooCommerce – Digital Wallet, Bu…)
- [CVE-2025-14075](https://cve.now/CVE-2025-14075.md): WP Hotel Booking \<= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter (CVSS 5.3, thimpress WP Hotel Booking)
- [CVE-2026-0519](https://cve.now/CVE-2026-0519.md): Information Disclosure in Secure Access Between 12.70 and 14.20 (CVSS 4.6, Absolute Security Secure Access)
- [CVE-2026-0518](https://cve.now/CVE-2026-0518.md): XSS in Secure Access Consoles prior to 14.20 (CVSS 4.8, Absolute Security Secure Access)
- [CVE-2026-0517](https://cve.now/CVE-2026-0517.md): Denial of Service in Secure Access Servers Prior to 14.20. (CVSS 6.0, Absolute Security Secure Access)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.