CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- bakkbone australia floristpressWordPress FloristPress plugin <= 7.3.0 - Nonce Leakage to Broken Access Control vulnerability5.4 Medium
- wpxpo postxWordPress PostX plugin <= 4.1.15 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- thehp aio contactWordPress AIO Contact plugin <= 2.8.1 - Unauthenticated Site-Wide Cross Site Scripting (XSS) vulnerability7.1 High
- roninwp fat services bookingWordPress FAT Services Booking plugin <= 5.6 - Subscriber+ Site-Wide Cross Site Scripting (XSS) vulnerability7.1 High
- abcbiz addons and templates for elementorWordPress ABCBiz Addons and Templates for Elementor plugin <= 2.0.2 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpxpro xpro addons for elementor, xpro elementor addons +1 moreWordPress Xpro Addons For Elementor plugin <= 1.4.6.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kofi mokome message filter for contact form 7WordPress Message Filter for Contact Form 7 plugin <= 1.6.3 - Broken Access Control vulnerability6.3 Medium
- boldgrid client invoicing by sprout invoicesWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.0 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- roninwp revyWordPress Revy plugin <= 1.18 - Unauthenticated SQL Injection vulnerability9.3 Critical
- genetech pie register premium, genetechsolutions pie register +1 moreWordPress Pie Register Premium plugin < 3.8.3.3 - Arbitrary File Upload vulnerability10.0 Critical
- ogun labs lenxel core for lenxel(lnx) lms, lenxel core +1 moreWordPress Lenxel Core plugin <= 1.2.8 - Local File Inclusion vulnerability7.5 High
- seventhqueen sweet dateWordPress Sweet Date theme <= 3.7.3 - Privilege Escalation vulnerability9.8 Critical
gtk-layer-shell-syscrates.iogtk-layer-shell-sys GTK3 bindings - no longer maintainedNo scoregtk-layer-shellcrates.iogtk-layer-shell GTK3 bindings - no longer maintainedNo score- servo idna, rust-url +1 moreidna accepts Punycode labels that do not produce any non-ASCII when decoded5.1 Medium
- superpwa super progressive web appsWordPress Super Progressive Web Apps plugin <= 2.2.21 - Broken Access Control vulnerability4.3 Medium
- dotstore minimum and maximum quantity for woocommerceWordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerability4.3 Medium
- prodigy commerce commerce, prodigycommerce prodigy commerce +1 moreWordPress Prodigy Commerce plugin <= 3.1.2 - Broken Access Control vulnerability6.5 Medium
- quomodosoft elementsready, elementsready addons for elementor +1 moreWordPress ElementsReady Addons for Elementor plugin <= 6.4.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- weboccult technologies pvt ltd wot elementor widgetsWordPress Wot Elementor Widgets plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- masud hasan unlock addons for elementorWordPress Unlock Addons for Elementor plugin <= 2.2.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- rrdevs rraddons for elementorWordPress RRAddons for Elementor plugin <= 1.1.0 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- blazethemes news kit elementor addonsWordPress News Kit Elementor Addons plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- karl kiesinger country blockerWordPress Country Blocker plugin <= 3.2 - CSRF to Stored XSS vulnerability7.1 High
- aviplugins.com login widget with shortcodeWordPress Login Widget With Shortcode plugin <= 6.1.2 - Open Redirection vulnerability4.7 Medium
- codegearthemes designerWordPress Designer plugin <= 1.4.1 - Local File Inclusion vulnerability7.5 High
- contact form - repute infosystems arforms form builderWordPress ARForms plugin <= 1.7.1 - HTML Injection vulnerability5.3 Medium
- shopfiles ebook storeWordPress Ebook Store plugin <= 5.775 - Broken Authentication vulnerability7.5 High
- karim salman kraken.io image optimizerWordPress Kraken.io Image Optimizer plugin <= 2.6.7 - Broken Access Control vulnerability4.3 Medium
- jobboardwp – job board listings and submissions, ultimatemember jobboardwp, jobboardwp – job board listings and submissions +2 moreWordPress JobBoardWP – Job Board Listings and Submissions plugin <= 1.2.2 - IDOR Leading To Job Removal Vulnerability5.2 Medium
- zendesk support for wordpressWordPress Zendesk Support for WordPress plugin <= 1.8.4 - Broken Access Control vulnerability4.3 Medium
- chris baldelomar shortcodesWordPress Shortcodes by Angie Makes plugin <= 3.46 - Broken Access Control vulnerability4.3 Medium
- codepeople cp multi view event calendarWordPress Calendar Event Multi View plugin <= 1.4.13 - Broken Access Control vulnerability3.8 Low
- tickeraWordPress Tickera – WordPress Event Ticketing plugin <= 3.5.1.0 - CSRF Leading To Post Status Change Vulnerability5.4 Medium
- clever widgets enhanced text widgetWordPress Enhanced Text Widget plugin <= 1.5.8 - Broken Access Control vulnerability4.3 Medium
- brainstorm force spectraWordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Broken Access Control + CSRF on Import_WPforms vulnerability3.1 Low
- brainstorm force spectraWordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Broken Access Control + CSRF on Activate_Plugin vulnerability4.3 Medium
- wpfactory cost of goods for woocommerceWordPress Cost of Goods for WooCommerce plugin <= 2.8.6 - Broken Access Control vulnerability5.4 Medium
- mg12 wp-recentcommentsWordPress WP-RecentComments plugin <= 2.2.7 - Broken Access Control vulnerability5.4 Medium
- shaon easy google analytics for wordpress, ibenic simple giveaways +1 moreWordPress Easy Google Analytics for WordPress plugin <= 1.6.0 - Broken Access Control vulnerability5.3 Medium
- ibenic simple giveawaysWordPress Simple Giveaways plugin <= 2.48.0 - Broken Access Control vulnerability5.3 Medium
- fullworks quick event managerWordPress Quick Event Manager plugin <= 9.7.4 - Broken Access Control vulnerability5.3 Medium
- codepeople wp time slots booking formWordPress WP Time Slots Booking Form plugin <= 1.1.82 - Broken Access Control vulnerability4.7 Medium
- noah hearle, design extreme reviews and rating – google my businessWordPress Reviews and Rating – Google My Business plugin <= 4.14 - Broken Access Control vulnerability5.4 Medium
- miniorange wordpress social login and register (discord, google, twitter, linkedin)WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 - Broken Access Control vulnerability3.5 Low
- wpdevart booking calendar, appointment booking system, booking calendar +1 moreWordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability5.0 Medium
- paypal brasil para woocommerceWordPress PayPal Brasil para WooCommerce plugin <= 1.4.2 - Broken Access Control vulnerability4.3 Medium
- fullworks quick contact formWordPress Quick Contact Form plugin <= 8.0.3.1 - Broken Access Control vulnerability6.5 Medium
- codepeople booking calendar contact formWordPress Booking Calendar Contact Form plugin <= 1.2.34 - Broken Access Control vulnerability4.3 Medium
- fantastic plugins content protector freeWordPress Fantastic Content Protector Free plugin <= 2.6 - Broken Access Control vulnerability5.3 Medium
- Show moreLoading…