Wordfence Intelligence Weekly WordPress Vulnerability Report (April 28, 2025 to May 4, 2025)

In case you missed it, Wordfence just published itsannual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond. Last week, there were 84 vulnerabilities disclosed in 68 WordPress Plugin...

CVE-2025-37824

creationtimestamp| type| source ---|---|--- 2025-05-08 08:31:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3loniqrxhtt2n 2025-05-08 11:44:58+00:00| seen| https://t.me/cvedetector/24800...

CVE-2025-37834

In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: don't try to reclaim hwpoison folio Syzkaller reports a bug as follows: Injecting memory failure for pfn 0x18b00e at process virtual address 0x20ffd000 Memory failure: 0x18b00e: dirty swapcache page still referenced by...

UBUNTU-CVE-2025-37814

In the Linux kernel, the following vulnerability has been resolved: tty: Require CAPSYSADMIN for all usages of TIOCLSELMOUSEREPORT This requirement was overeagerly loosened in commit 2f83e38a095f "tty: Permit some TIOCLSETSEL modes without CAPSYSADMIN", but as it turns out, 1 the logic I...

UBUNTU-CVE-2025-37834

In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: don't try to reclaim hwpoison folio Syzkaller reports a bug as follows: Injecting memory failure for pfn 0x18b00e at process virtual address 0x20ffd000 Memory failure: 0x18b00e: dirty swapcache page still referenced by...

CVE-2025-37826

creationtimestamp| type| source ---|---|--- 2025-05-08 07:11:51+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lonebwerh6c2 2025-05-08 07:23:09+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15484 2025-05-08...

CVE-2025-37827

CVE-2025-37827 affects the Linux kernel’s Btrfs zoned mechanism when a RAID1 block-group has a write-pointer mismatch between disks. Root cause: a NULL pointer dereference in __btrfs_add_free_space_zoned() triggered by converting the metadata profile from DUP to RAID1 on two disks, leading to an ...

CVE-2025-3419

creationtimestamp| type| source ---|---|--- 2025-05-08 06:23:08+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15476 2025-05-08 08:30:14+00:00| seen| Telegram/AeGByFiQGAtCKbtKhIFFySTjzGU9I6nn4wPbRxRvXqDYexs 2025-05-08 09:14:16+00:00| seen| https://t.me/cvedetector/24788 2025-06-06...

CVE-2024-56523

creationtimestamp| type| source ---|---|--- 2025-05-08 03:23:21+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3lomxjktb622g 2025-05-12 15:55:48+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114495674653335932 2025-05-12 18:37:21+00:00| seen|...

CVE-2024-56524

creationtimestamp| type| source ---|---|--- 2025-05-08 03:23:21+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3lomxjktb622g 2025-05-12 15:55:48+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114495674653335932 2025-05-12 18:37:21+00:00| seen|...

CVE-2025-37813

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix invalid pointer dereference in Etron workaround This check is performed before preparetransfer and preparering, so enqueue can already point at the final link TRB of a segment. And indeed it will, some 0.4% of time...

CVE-2025-46826

creationtimestamp| type| source ---|---|--- 2025-05-07 22:23:16+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15456 2025-05-08 00:27:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lomnontey72p 2025-05-08 00:52:38+00:00| seen| https://t.me/cvedetector/24765...

CVE-2025-20198

creationtimestamp| type| source ---|---|--- 2025-05-07 21:31:50+00:00| seen| https://t.me/cvedetector/24750 2025-05-08 21:00:53+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3loosmhtbxk2i...

CVE-2025-47203

creationtimestamp| type| source ---|---|--- 2025-05-07 21:31:34+00:00| seen| https://t.me/cvedetector/24736 2025-05-07 22:27:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lomgxv5hzr2h 2025-05-09 14:17:40+00:00| seen| https://seclists.org/oss-sec/2025/q2/116 2025-05-09...

CVE-2025-20194

creationtimestamp| type| source ---|---|--- 2025-05-07 21:26:26+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lomdjrnhqao2...

CVE-2025-29746

creationtimestamp| type| source ---|---|--- 2025-05-07 19:22:16+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15382 2025-05-07 22:27:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lomgxucpn52j 2025-05-07 23:12:22+00:00| seen|...

CVE-2025-46827

creationtimestamp| type| source ---|---|--- 2025-05-07 16:23:25+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15347 2025-05-07 16:47:51+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114467567755058452 2025-05-07 18:27:02+00:00| seen|...

CVE-2025-46551

creationtimestamp| type| source ---|---|--- 2025-05-07 16:05:29+00:00| published-proof-of-concept| https://github.com/jruby/jruby-openssl/security/advisories/GHSA-72qj-48g4-5xgx 2025-05-07 17:01:29+00:00| seen| https://bsky.app/profile/jrubyproject.bsky.social/post/3lolurlze3p2s 2025-05-07...

CVE-2024-47619

creationtimestamp| type| source ---|---|--- 2025-05-07 15:22:27+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15314 2025-05-07 15:50:46+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114467343284596625 2025-05-07 18:26:58+00:00| seen|...

WordPress Cost Calculator for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Michael in WordPress Plugin Cost Calculator for Elementor versions = 1.3.3...