CVEs published in December 2021
2,574 vulnerabilities, 311 critical, 14 exploited.
- wp cloud plugins out-of-the-boxreflected XSS in search functionality of WP Cloud Plugins - Out-of-the-Box4.7 Medium
- wp cloud plugins use-your-driveReflected XSS in search functionality of WP Cloud Plugins - Use-Your-Drive4.7 Medium
- fatcatapps pixel cat, pixel cat – conversion pixel manager +1 morePixel Cat Lite < 2.6.3 - Admin+ Stored Cross-Site Scripting4.8 Medium
- plugins360 all-in-one video galleryAll-In-One-Gallery < 2.5.0 - Admin+ Local File Inclusion7.2 High
- profilepress user registration\, login form\, user profile \& membership, unknown user registration, login form, user profile & membership – profilepress (formerly wp user avatar) +1 moreProfilePress < 3.2.3 - Reflected Cross-Site Scripting6.1 Medium
- profilepress user registration\, login form\, user profile \& membership, unknown user registration, login form, user profile & membership – profilepress (formerly wp user avatar) +1 moreProfilePress < 3.2.3 - Reflected Cross-Site Scripting6.1 Medium
- thimpress learnpress, learnpress – wordpress lms plugin +1 moreLearnPress < 4.1.4 - Admin+ SQL Injection9.8 Critical
- unknown modern events calendar liteModern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection9.8 Critical
- likebtn like button rating, unknown like button rating ♥ likebtn +1 moreLike Button Rating < 2.6.38 - Unauthorised Vote Export to Email & IP Addresses Disclosure8.0 High
- cm-wp auto featured image, themeisle auto featured image (auto post thumbnail) +1 moreAuto Featured Image < 3.9.3 - Reflected Cross-Site Scripting6.1 Medium
- unknown modern events calendar liteModern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting6.1 Medium
- fatcatapps pixel cat, pixel cat – conversion pixel manager +1 morePixel Cat Lite < 2.6.2 - CSRF to Stored Cross-Site Scripting9.0 Critical
- calderaforms caldera forms, unknown caldera forms – more than contact forms +1 moreCaldera forms < 1.9.5 - Admin+ Stored Cross-Site Scripting4.8 Medium
- get custom field values project custom field values, scott reilly get custom field values +1 moreGet Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access6.5 Medium
- get custom field values project custom field values, scott reilly get custom field values +1 moreGet Custom Field Values < 4.0.1 - Contributor+ Stored Cross-Site Scripting5.4 Medium
- billminozzi stop bad bots, unknown wp block and stop bad bots crawlers and spiders and anti spam protection plugin stopbadbots +1 moreStopBadBots < 6.67 - Unauthenticated SQL Injection9.8 Critical
- quotes collection project collection, unknown quotes collection +1 moreQuotes Collection <= 2.5.2 - Admin+ SQL Injection7.2 High
- unknown user meta shortcodes, user meta shortcodes project meta shortcodes +1 moreUser Meta Shortcodes <= 0.5 - Contributor+ Unauthorized Arbitrary User Metadata Access4.3 Medium
- nocean totop linkToTop Link <= 1.7.1 - Unauthenticated PHP Object Injection9.8 Critical
- display post metadata project post metadata, unknown display post metadata +1 moreDisplay Post Metadata < 1.5.0 - Contributor+ Stored Cross-Site Scripting5.4 Medium
- frenify mediamatic, plugincraft mediamatic – media library folders +1 moreMediamatic < 2.8.1 - Subscriber+ SQL Injection8.8 High
- improved include page project include page, unknown improved include page +1 moreImproved Include Page <= 1.2 - Contributor+ Arbitrary Posts/Pages Access6.5 Medium
- storeapps temporary login without passwordTemporary Login Without Password < 1.7.1 - Subscriber+ Plugin's Settings Update4.3 Medium
- page\/post content shortcode project content shortcode, unknown page/post content shortcode +1 morePage/Post Content Shortcode <= 1.0 - Contributor+ Arbitrary Posts/Pages Access4.3 Medium
- unknown wp limits, wp limits project limits +1 moreWP Limits <= 1.0 - Plugin's Settings Update via CSRF4.3 Medium
- ultimate nofollow project nofollow, unknown ultimate nofollow +1 moreUltimate NoFollow <= 1.4.8 - Contributor+ Stored Cross-Site Scripting5.4 Medium
- phoeniixx filter portfolio galleryFilter Portfolio Gallery <= 1.5 - Arbitrary Gallery Deletion via CSRF6.5 Medium
- wpeden shiny buttons, unknown shiny buttons – css3 button generator for wordpress +1 moreShiny Buttons <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting6.1 Medium
- contact form advanced database project form advanced database, unknown contact form advanced database +1 moreContact Form Advanced Database <= 1.0.8 - Unauthorised AJAX Calls4.3 Medium
- unknown wp admin logo changer, wp admin logo changer project admin logo changer +1 moreWP Admin Logo Changer <= 1.0 - Plugin's Settings Update via CSRF6.5 Medium
- flex local fonts project local fonts, unknown flex local fonts +1 moreFlex Local Fonts <= 1.0.0 - Admin+ Stored Cross-Site-Scripting4.8 Medium
- single post exporter project post exporter, unknown single post exporter +1 moreSingle Post Exporter <= 1.1.1 - Plugin's Settings Update via CSRF4.3 Medium
- inspirational quote rotator project quote rotator, unknown inspirational quote rotator +1 moreInspirational Quote Rotator <= 1.0.0 - Admin+ Stored Cross-Site Scripting4.8 Medium
- activity-log.com wp system log, wp system log project system log +1 moreWP System Log < 1.0.21 - Unauthenticated Stored Cross-Site Scripting6.1 Medium
- cleverplugins seo boosterSEO Booster < 3.8 - Admin+ SQL Injection7.2 High
- basix nex-formsNEX-Forms < 8.4.3 - Stored Cross-Site Scripting via CSRF4.8 Medium
- advancedcustomfields advanced custom fields, delicious brains advanced custom fields and advanced custom fields pro +1 moreAdvanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5...6.5 Medium
- advancedcustomfields advanced custom fields, delicious brains advanced custom fields and advanced custom fields pro +1 moreAdvanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5...6.5 Medium
- advancedcustomfields advanced custom fields, delicious brains advanced custom fields and advanced custom fields pro +1 moreAdvanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5...7.5 High
- reprisesoftware reprise license managerAn issue was discovered in Reprise RLM 14.2. By using an admin account, an attacker can write a...7.2 High
- reprisesoftware reprise license managerAn issue was discovered in Reprise RLM 14.2. When editing the license file, it is possible for an...7.2 High
- auerswald commander 6000r ip firmware, commander 6000rx ip firmware, commander basic.2\(19\"\) ip firmware +7 more +9 moreAuerswald COMpact 5500R devices before 8.2B allow Arbitrary File Disclosure. A sub-admin can read...4.9 Medium
- auerswald commander 6000r ip firmware, commander 6000rx ip firmware, commander basic.2\(19\"\) ip firmware +7 more +9 moreAuerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring.8.8 High
- auerswald comfortel 1400 ip firmware, comfortel 2600 ip firmware, comfortel 3600 ip firmware +2 moreAuerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the ...7.5 High
- cybelesoft thinfinity virtualuiIn Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for...5.3 Medium
- toktok toxcoreThe TCP Server module in toxcore before 0.2.8 doesn't free the TCP priority queue under certain...7.5 High
- toktok toxcore, fedoraproject fedora +1 moreA stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11...9.8 Critical
- toktok toxcoreThe Onion module in toxcore before 0.2.2 doesn't restrict which packets can be onion-routed,...3.1 Low
lcmsOSS-FuzzGlobal-buffer-overflow in InStringSymbolNo scoreapache-httpdOSS-FuzzHeap-buffer-overflow in ap_is_chunkedNo score- Show moreLoading…