CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- No product listedChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx...3.5 Low
- No product listedgitingest before 9996a06 mishandles symbolic links that point outside of the base directory.5.5 Medium
- pavel-odintsov fastnetmonAn issue was discovered in FastNetMon Community Edition through 1.2.7. Zero-length templates for...7.5 High
- pavel-odintsov fastnetmonAn issue was discovered in FastNetMon Community Edition through 1.2.7. The sFlow v5 plugin allows...7.5 High
- No product listedFile Manager in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 has a traversal issue...7.5 High
- No product listedDocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during...9.1 Critical
- ibm storage scaleIBM Storage Scale privilege escalation7.8 High
- ibm storage scaleIBM Storage Scale SQL injection7.5 High
- dynamiapps frontend admin, shabti frontend admin by dynamiapps +1 moreFrontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege Escalation8.1 High
- dynamiapps frontend admin, shabti frontend admin by dynamiapps +1 moreFrontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Stored Cross-Site Scripting7.2 High
- wpjobportal wp job portal, wp job portal – ai-powered recruitment system for company or job board website +1 moreWP Job Portal <= 2.2.2 - Missing Authorization to Unauthenticated Arbitrary Resume Download5.3 Medium
- wpjobportal wp job portal, wp job portal – ai-powered recruitment system for company or job board website +1 moreWP Job Portal <= 2.2.1 - Unauthenticated SQL Injection7.5 High
- wpjobportal wp job portal, wp job portal – ai-powered recruitment system for company or job board website +1 moreWP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection4.9 Medium
- wpjobportal wp job portal, wp job portal – ai-powered recruitment system for company or job board website +1 moreWP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via getFieldsForVisibleCombobox()4.9 Medium
- wpjobportal wp job portal, wp job portal – ai-powered recruitment system for company or job board website +1 moreWP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via wpjobportal_deactivate()4.9 Medium
- gravitymaster97 pdf generator for posts & pages – export any post type to pdfPost to Pdf <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpjobportal wp job portal, wp job portal – ai-powered recruitment system for company or job board website +1 moreWP Job Portal <= 2.2.2 - Missing Authorization to Limited Privilege Escalation4.8 Medium
- budiony bodi0`s easy cachebodi0’s Easy Cache <= 0.8 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- ganohr ganohrs toggle shortcodeGanohrs Toggle Shortcode <= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- xylus import eventbrite eventsImport Eventbrite Events <= 1.7.4 - Reflected Cross-Site Scripting6.1 Medium
- geodatasource country region dropdownGeoDataSource Country Region DropDown <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- babo2015 eveenoEveeno <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- rstheme2017 shortcodes for elementorShortcodes for Elementor <= 1.0.4 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- fluentforms contact form, techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builder +1 moreContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject7.2 High
- kylephillips simple locatorSimple Locator <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- aruphash crafthemes demo importCrafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_files7.2 High
- gopiplus wp photo text slider 50Wp photo text slider 50 <= 8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- ider login for wordpressIDer Login for WordPress <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpscore cricket live scoreCricket Live Score <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- uvstudio buk for wordpressBuk for WordPress <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- homeasap my idx home searchMy IDX Home Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- theandystratton the permalinkerThe Permalinker <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- koalendar – easy appointment scheduling & booking pluginKoalendar – Events & Appointments Booking Calendar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter6.4 Medium
- wssoffice21 states map usStates Map US <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- webdeveric get post content shortcodeGet Post Content Shortcode <= 0.4 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via post_content Shortcode4.3 Medium
- devnethr smart popup blasterSmart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- coderpress posts and products views for woocommercePosts and Products Views for WooCommerce <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- onetarek wp ad guru – banner ad, responsive popup, popup maker, ad rotator & moreWP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More <= 2.5.4 - Reflected Cross-Site Scripting6.1 Medium
- prontotools woocommerce cart count shortcodeWooCommerce Cart Count Shortcode <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- connatix video embedConnatix Video Embed <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- pleziPlezi <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- tarak patel post carousel & sliderPost Carousel & Slider <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- filestack wp uploadFilestack Official <= 2.1.0 - Reflected Cross-Site Scripting6.1 Medium
- yoannr35 kredeum nfts, the easiest way to sell your nfts directly on your wordpress siteKredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bukzaBukza <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- visualmodo elementsVisualmodo Elements <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- acewebx ims countdownIMS Countdown <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- tcoder tcbd popoverTCBD Popover <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- tickera – sell tickets & manage eventsTickera – WordPress Event Ticketing <= 3.5.4.8 - Unauthenticated Customer Data Exposure5.3 Medium
- papin companion portfolio – responsive portfolio pluginCompanion Portfolio – Responsive Portfolio Plugin <= 2.4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- Show moreLoading…