CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- nicheaddons primary addon for elementorWordPress Primary Addon for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- full services customer, full. full customer +1 moreWordPress FULL – Cliente plugin <= 3.1.25 - Local File Inclusion vulnerability6.5 Medium
- persianscript persian woocommerce smsWordPress افزونه پیامک ووکامرس Persian WooCommerce SMS plugin <= 7.0.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- i.lychkov mark new postsWordPress Mark New Posts plugin <= 7.5.1 - Broken Access Control vulnerability5.4 Medium
- aslam khan gouran gou manage my account menuWordPress Gou Manage My Account Menu plugin <= 1.0.1.8 - Broken Access Control vulnerability5.3 Medium
- postboxWordPress PostBox plugin <= 1.0.4 - Sensitive Data Exposure vulnerability6.5 Medium
- currencyrate.today cryptocurrency price widgetWordPress Cryptocurrency Price Widget plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- aipost aicommentsWordPress AIcomments plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- aitool aikct engine chatbot, chatgpt, gemini, gpt-4o best ai chatbotWordPress AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- jtexpress j&t express malaysiaWordPress J&T Express Malaysia plugin <= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- hive support supportWordPress Hive Support plugin <= 1.1.2 - SQL Injection vulnerability8.5 High
- ido kobelkowsky simple paymentWordPress Simple Payment plugin <= 2.3.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- vikas ratudi vpsuformWordPress VForm plugin <= 3.0.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- formfacadeWordPress FormFacade plugin <= 1.3.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- basar ventures autowpWordPress AutoWP plugin <= 2.0.8 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- revi revi.ioWordPress Revi.io plugin <= 5.7.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- sminozzi car dealerWordPress Car Dealer plugin <= 4.46 - Broken Access Control vulnerability4.3 Medium
- extremeidea vbsso-liteWordPress vBSSO-lite plugin <= 1.4.3 - Account Takeover vulnerability9.8 Critical
- codexpert, inc coschool lmsWordPress CoSchool LMS plugin <= 1.4.3 - Account Takeover vulnerability9.8 Critical
- fluxbuilder listapp mobile managerWordPress ListApp Mobile Manager plugin <= 1.7.7 - Account Takeover vulnerability9.8 Critical
- appgenix infotech firebase otp authenticationWordPress Firebase OTP Authentication plugin <= 1.0.1 - Account Takeover vulnerability9.8 Critical
- ce21 suite, ce21com ce21 suite +1 moreWordPress CE21 Suite plugin <= 2.2.0 - Privilege Escalation vulnerability9.8 Critical
- appsplateWordPress Appsplate plugin <= 2.1.3 - SQL Injection vulnerability9.3 Critical
- justin fletcher role includerWordPress Role Includer plugin <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- awesomesupport awesome supportWordPress Awesome Support plugin <= 6.3.1 - Broken Access Control vulnerability6.5 Medium
- ldd web design directory liteWordPress LDD Directory Lite plugin <= 3.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- best wp developer advanced blog post blockWordPress Advanced Blog Post Block plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- smaily for wpWordPress Smaily for WP plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themeum wp mega menuWordPress WP Mega Menu plugin <= 1.4.2 - PHP Object Injection vulnerability7.2 High
- plugin devs news ticker for elementorWordPress News Ticker for Elementor plugin <= 2.1.3 - Broken Access Control vulnerability4.3 Medium
- alireza aliniya nias courseWordPress Nias course plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- devfelixmoira poll builderWordPress Poll Builder plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wibergs web csv to htmlWordPress CSV to html plugin <= 3.08 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- octrace wordpress helpdesk & support ticket system plugin – octrace supportWordPress Octrace Support plugin <= 1.2.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- pickplugins mail pickerWordPress Mail Picker plugin <= 1.0.14 - PHP Object Injection vulnerability9.8 Critical
- radiustheme radius blocksWordPress Radius Blocks plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- arni cinco wpcargo track & traceWordPress WPCargo Track & Trace plugin <= 8.0.2 - Settings Change vulnerability5.4 Medium
- gpriday siteorigin widgets bundle, siteorigin widgets bundle +1 moreWordPress SiteOrigin Widgets Bundle plugin <= 1.64.0 - Broken Access Control vulnerability4.3 Medium
- creativemindssolutions cm answersWordPress CM Answers plugin <= 3.2.6 - Broken Access Control vulnerability4.3 Medium
- imagerecycle pdf & image compression, pdf \& image compression +1 moreWordPress ImageRecycle pdf & image compression plugin <= 3.1.16 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- dmitry v. (ceo of "ukr solution") barcode scanner with inventory & order managerWordPress Barcode Scanner and Inventory manager plugin <= 1.6.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- cmorillas1 shortcodes blocks creator ultimateWordPress Shortcodes Blocks Creator Ultimate plugin <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- sidngr import export for woocommerceWordPress Import Export For WooCommerce plugin <= 1.6.2 - Arbitrary File Upload vulnerability9.9 Critical
- hk digital agency llc tax service electronic hdmWordPress TAX SERVICE Electronic HDM plugin <= 1.2.2 - SQL Injection vulnerability10.0 Critical
- delucks seoWordPress DELUCKS SEO plugin <= 2.7.0 - Arbitrary File Download vulnerability6.5 Medium
- anzar ahmed ni crm leadWordPress Ni CRM Lead plugin <= 1.3.0 - SQL Injection vulnerability8.5 High
- seerox easy blocks proWordPress Easy Blocks pro plugin <= 1.0.21 - Broken Access Control vulnerability7.1 High
- dotonpaper pinpoint booking systemWordPress Pinpoint Booking System Plugin <= 2.9.9.5.7 - Broken Access Control vulnerability6.3 Medium
- prodigy commerce commerce, prodigycommerce prodigy commerce +1 moreWordPress Prodigy Commerce plugin <= 3.0.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- eewee admin custom, michael dumontet eewee admin custom +1 moreWordPress Eewee Admin Custom plugin <= 1.8.2.4 - CSRF to Privilege Escalation vulnerability8.8 High
- Show moreLoading…