CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- genetech pie register premiumWordPress Pie Register Premium plugin < 3.8.3.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- unknown z-downloadsWordPress Z-Downloads plugin <= 1.11.7 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- posimyth the plus addons for elementor page builder lite, the plus addons for elementor +1 moreWordPress The Plus Addons for Elementor plugin <= 5.6.14 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- joni halabi block controllerWordPress Block Controller plugin <= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- owen cutajar & hyder jaffari wordpress auction pluginWordPress WordPress Auction Plugin plugin <= 3.7 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- wpfactory awesome shortcodesWordPress Awesome Shortcodes plugin <= 1.7.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- visualmodo borderlessWordPress Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin <= 1.5.8 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- codexshaper advanced element bucket addons for elementorWordPress Advanced Element Bucket Addons for Elementor plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- noor alam magical addons for elementorWordPress Magical Addons For Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- zionbuilderWordPress WordPress Page Builder – Zion Builder plugin <= 3.6.16 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- paloma widgetWordPress Paloma Widget plugin <= 1.14 - CSRF to Stored XSS vulnerability7.1 High
- owen cutajar & hyder jaffari wordpress auction plugin, wp auctions wp-auctions +1 moreWordPress WordPress Auction Plugin plugin <= 3.7 - SQL Injection vulnerability9.3 Critical
- roninwp revyWordPress Revy plugin <= 1.18 - Unauthenticated Arbitrary File Upload vulnerability10.0 Critical
- repute info systems arformsWordPress ARForms plugin < 7.0.2 - Path Traversal vulnerability7.7 High
- cristián lávaque s2member, wp sharks s2member pro +1 moreWordPress s2Member plugin <= 241114 - Remote Code Execution (RCE) vulnerability9.0 Critical
- yonifre maspik – spam blacklistWordPress Maspik plugin <= 2.2.7 - CSRF to Settings Change vulnerability5.4 Medium
- bob namaste! lmsWordPress Namaste! LMS plugin <= 2.6.4.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- brandtoss wp mailsterWordPress WP Mailster plugin <= 1.8.16.0 - SQL Injection vulnerability8.5 High
- basix nex-formsWordPress NEX-Forms plugin <= 8.7.8 - SQL Injection vulnerability8.5 High
- dotonpaper pinpoint booking systemWordPress Pinpoint Booking System plugin <= 2.9.9.5.2 - SQL Injection vulnerability8.5 High
- acowebs product labels for woocommerceWordPress Acowebs Product Labels For Woocommerce plugin <= 1.5.8 - SQL Injection vulnerability7.6 High
- brandtoss wp mailster, wpmailster +1 moreWordPress WP Mailster plugin <= 1.8.16.0 - Sensitive Data Exposure vulnerability7.5 High
- posimyth wdesignkitWordPress WDesignKit plugin <= 1.0.40 - Arbitrary File Upload vulnerability6.6 Medium
- all bootstrap blocks bootstrap blocks, areoi all bootstrap blocks +1 moreWordPress All Bootstrap Blocks plugin <= 1.3.20 - Local File Inclusion vulnerability7.5 High
- brandtoss wp mailster, mailster +1 moreWordPress WP Mailster plugin <= 1.8.16.0 - Broken Access Control vulnerability7.5 High
- sick ag inspectorp61x, inspectorp62x, sick inspector61x firmware +1 more +3 moreSICK InspectorP61x and SICK InspectorP62x: missing authentication8.2 High
- sick ag inspectorp61x, inspectorp62x, sick inspector61x firmware +1 more +3 moreSICK InspectorP61x and SICK InspectorP62x have unauthenticated CROWN APIs7.3 High
- sick tim3xx, sick ag inspectorp61x, inspectorp62x +2 more +4 moreSICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks9.0 Critical
- sick ag inspectorp61x, inspectorp62x, sick inspector61x firmware +1 more +3 moreSICK InspectorP61x and SICK InspectorP62x are vulnerable for firmware modification8.8 High
- sick tim3xx, sick ag inspectorp61x, inspectorp62x +3 more +5 moreSICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution8.8 High
- sick ag inspectorp61x, inspectorp62x +1 moreSICK InspectorP61x and SICK InspectorP62x are vulnerable for a replay attack5.6 Medium
- iqonic kivicare, iqonicdesign kivicare – clinic & patient management system (ehr) +1 moreKiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- iqonic kivicare, iqonicdesign kivicare – clinic & patient management system (ehr) +1 moreKiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection6.5 Medium
- linux, linux kernel +1 moreinitramfs: avoid filename buffer overrun7.8 High
- linux, linux kernel +1 morenetfilter: ipset: add missing range check in bitmap_ip_uadt7.8 High
- reputeinfosystems armember – membership plugin, content restriction, member levels, user profile & user signupARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode Execution6.3 Medium
- iqonic kivicare, iqonicdesign kivicare – clinic & patient management system (ehr) +1 moreKiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection7.5 High
- picture-planet verowa connectVerowa Connect <= 3.0.1 - Unauthenticated SQL Injection7.5 High
- pencidesign soledadSoledad <= 8.5.9 - Unauthenticated Limited Local File Inclusion8.1 High
- kingyes pojo formsPojo Forms <= 1.4.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via form_preview_shortcode6.3 Medium
- devnethr smart popup blasterSmart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- ideaboxcreations powerpack addons for elementor (free widgets, extensions and templates)PowerPack Elementor Addons (Free Widgets, Extensions and Templates) <= 2.8.1 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- ashraf xltab – accordions and tabs for elementor page builderXLTab – Accordions and Tabs for Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- matthias-reuter sv100 companionSV100 Companion <= 2.0.02 - Missing Authorization to Unuathenticated Arbitrary Options Update9.8 Critical
- vjalby folder galleryFolder Gallery <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.1 Medium
- ultimatemember forumwp, forumwp – forum & discussion board +1 moreForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url Parameter6.1 Medium
- rstheme ultimate coming soon & maintenance, ultimate-coming-soon, ultimate coming soon \& maintenance +2 moreUltimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Unauthenticated Template Activation5.3 Medium
- martin nguyen next-cart store to woocommerce migrationNext-Cart Store to WooCommerce Migration <= 3.9.2 - Reflected Cross-Site Scripting6.1 Medium
- vcita online booking & scheduling calendar for wordpress by vcita, online booking \& scheduling calendar +1 moreOnline Booking & Scheduling Calendar for WordPress by vcita <= 4.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting5.4 Medium
- akirk friendsFriends <= 3.2.1 - Missing Authorization5.3 Medium
- Show moreLoading…