CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- hookandhook wp courses lms – online courses builder, elearning courses, courses solution, education coursesWP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Update7.5 High
- samdani gs portfolio – a plugin for making filterable portfolio grid, portfolio slider and moreWordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- themehunk vayu blocks – website builder for the block editorVayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation9.8 Critical
- fatcatapps analytics cat – google analytics made easyAnalytics Cat – Google Analytics Made Easy <= 1.1.2 - Reflected Cross-Site Scripting6.1 Medium
- aliakro snippet shortcodesSnippet Shortcodes <= 4.1.6 - Authenticated (Subscriber+) Shortcode Deletion4.3 Medium
- photonicgnostic library bookshelvesLibrary Bookshelves <= 5.8 - Reflected Cross-Site Scripting6.1 Medium
- wpwax product carousel slider & grid ultimate for woocommerceProduct Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.10 - Authenticated (Contributor+) Local File Inclusion via 'theme'8.8 High
- smartagenda – prise de rendez-vous en ligneSmart Agenda – Prise de rendez-vous en ligne <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bplugins awesome faq – modern accordion, tabs,responsive & super fast faq builder.FAQ And Answers – Create Frequently Asked Questions Area on WP Sites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- arena.im, arenaim arena.im – live blogging for real-time events +1 moreArena.IM – Live Blogging for real-time events <= 0.4.1 - Cross-Site Request Forgery to Settings Update4.3 Medium
- shanebp bp email assign templatesBP Email Assign Templates <= 1.5 - Reflected Cross-Site Scripting6.1 Medium
- autowriter ai post generator | autowriterAI Post Generator | AutoWriter <= 3.5 - Missing Authorization to Authenticated (Contributor+) Post/Page Deletion4.3 Medium
- suiteplugins video & photo gallery for ultimate memberVideo & Photo Gallery for Ultimate Member <= 1.1.1 - Reflected Cross-Site Scripting6.1 Medium
- quantumcloud qc seo help for llms.txt, ai analytics, ai content writer, subtitle to articleAI Content Writer, RSS Feed to Post, Autoblogging SEO Help <= 6.1.3 - Reflected Cross-Site Scripting6.1 Medium
- planaday apiPlanaday API <= 11.4 - Reflected Cross-Site Scripting6.1 Medium
- karl kiesinger country blockerCountry Blocker <= 3.2 - Reflected Cross-Site Scripting6.1 Medium
- cognito apps forms, cognitoapps cognito forms +1 moreCognito Forms <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter6.4 Medium
- arena.im, arenaim arena.im – live blogging for real-time events +1 moreArena.IM – Live Blogging for real-time events <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via arena_embed_amp Shortcode6.4 Medium
- arena.im, arenaim arena.im – live blogging for real-time events +1 moreArena.IM – Live Blogging for real-time events <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- sharabindu yoo bar – floating notification & promo bar for websiteTop and footer bars for announcements, notifications, advertisements, promotions – YooBar <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- halfdata opt-in downloadsOpt-In Downloads <= 4.07 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- hage add infos to the events calendarAdd infos to the events calendar <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- g5theme grid plus – unlimited grid layoutGrid Plus – Unlimited grid layout <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via grid_plus_load_by_category7.3 High
- owthub library management systemLibrary Management System <= 3.2.0 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- kaushik07 perfect font awesome integrationPerfect Font Awesome Integration <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- onlyoffice docspaceONLYOFFICE DocSpace <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- insiderealestate kvcore idxkvCORE IDX <= 2.3.35 - Reflected Cross-Site Scripting6.1 Medium
- shivtiwari wp service payment form with authorize.netWP Service Payment Form With Authorize.net <= 2.6.3 - Reflected Cross-Site Scripting6.1 Medium
- hanif-khan newsletter subscriptionsNewsletter Subscriptions <= 2.1 - Reflected Cross-Site Scripting6.1 Medium
- websitetoolbox website toolbox forumWebsite Toolbox Community <= 2.0.1 - Reflected Cross-Site Scripting via websitetoolbox_username6.1 Medium
- dipankarpal212 ultimate endpoints with rest apiUltimate Endpoints With Rest Api <= 2.2.2 - Reflected Cross-Site Scripting6.1 Medium
- cyberlord92 oauth single sign on – sso (oauth client)OAuth Single Sign On – SSO (OAuth Client) <= 6.26.3 - Authentication Bypass8.1 High
- cyberlord92 powerbi embed reportsPowerBI Embed Reports <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- dejureorg dejure.org vernetzungsfunktiondejure.org Vernetzungsfunktion <= 1.97.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- deco.agency de:brandingde:branding <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- get3code password for wpPassword for WP <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- tarecord sign in with googleSign In With Google <= 1.8.0 - Authentication Bypass in authenticate_user9.8 Critical
- zoan wp-revive adserverWP-Revive Adserver <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- surbma | salesautopilot shortcodeSurbma | SalesAutopilot Shortcode <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- shafayat-alam gutenberg blocks and page layouts – attire blocksGutenberg Blocks and Page Layouts – Attire Blocks <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- maheshmaharjan catch popupCatch Popup <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- vberkel schema app structured dataSchema App Structured Data <= 2.2.4 - Reflected Cross-Site Scripting6.1 Medium
- caagsoftware hq rental softwareHQ Rental Software <= 1.5.29 - Cross-Site Request Forgery to Arbitrary Options Update8.8 High
- hostfact bestelformulier integratieHostFact bestelformulier integratie <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- mahendrapatidarmp custom skins contact form 7Custom Skins Contact Form 7 <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update and Skin Creation4.3 Medium
- elvinhaci sql chart builderSQL Chart Builder <= 2.3.6 - Authenticated (Contributor+) SQL Injection6.5 Medium
- gopiplus horizontal scroll image slideshowHorizontal scroll image slideshow <= 10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- gallagher command centre serverInsertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm...8.5 High
- gallagher controller 6000 and controller 7000Use of Multiple Resources with Duplicate Identifier (CWE-694) in the Controller 6000 and...4.6 Medium
- mayurik advocate office management system, sourcecodester kortex lite advocate office management system +1 moreSourceCodester Kortex Lite Advocate Office Management System client_data.php cross site scripting5.3 Medium
- Show moreLoading…