CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- vibethemes vibebpWordPress VibeBP plugin <= 1.9.9.4.1 - Unauthenticated Privilege Escalation vulnerability9.8 Critical
- vibethemes wplms, wordpress learning management system +1 moreWordPress WPLMS plugin < 1.9.9.5.3 - Unauthenticated SQL Injection vulnerability9.3 Critical
- vibethemes vibebpWordPress VibeBP plugin < 1.9.9.5.1 - SQL Injection vulnerability8.5 High
- vibethemes vibebpWordPress VibeBP plugin < 1.9.9.7.7 - Unauthenticated SQL Injection vulnerability9.3 Critical
- azzaroco wp superbackupWordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability10.0 Critical
- vibethemes wplms, wordpress learning management system +1 moreWordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerability10.0 Critical
- azzaroco wp superbackupWordPress WP SuperBackup plugin <= 2.3.3 - Subscriber+ PHP Object Injection vulnerability7.5 High
- mario peshev wp-crm systemWordPress CRM Plugin – WP-CRM System plugin <= 3.2.9.1 - Broken Access Control vulnerability6.5 Medium
- yulio aleman jimenez smart shopify productWordPress Smart Shopify Product plugin <= 1.0.2 - Arbitrary Content Deletion vulnerability6.5 Medium
- azzaroco wp superbackupWordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Backup File Download Vulnerability7.5 High
- gfazioli wp cleanfixWordPress WP CleanFix plugin <= 5.6.2 - Broken Access Control vulnerability5.3 Medium
- woo woocommerce subscriptionsWordPress Woo Subscriptions plugin < 5.8.0 - Broken Access Control vulnerability4.3 Medium
- mike leembruggen simple dashboardWordPress Simple Dashboard plugin <= 2.0 - Privilege Escalation vulnerability9.8 Critical
- ai magic magic, sunnykai ai magic +1 moreWordPress AI Magic – SEO Content Generator & Article Writer plugin <= 1.0.4 - Privilege Escalation vulnerability9.8 Critical
- 2100 technology official document management system2100 Technology Electronic Official Document Management System - Authentication Bypass9.8 Critical
- rems multi role login systemSourceCodester Multi Role Login System add-user.php cross site scripting5.3 Medium
- seventhqueen kleoWordPress Kleo theme < 5.4.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- deluxethemes userproWordPress UserPro plugin <= 5.1.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- progress whatsup goldWhatsUp Gold - SnmpExtendedActiveMonitor path traversal6.5 Medium
- progress whatsup goldWhatsUp Gold - LDAP configuration interface leading to allowing attacker to configure LDAP settings without authentication9.4 Critical
- progress whatsup goldWhatsUp Gold - Public API signing key rotation issue9.6 Critical
- elicus wpmozo addons lite for elementorWordPress WPMozo Addons Lite for Elementor plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- fahad mahmood gulri sliderWordPress Gulri Slider plugin <= 3.5.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- ledenbeheerWordPress Ledenbeheer plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- royal-elementor-addons royal elementor addonsWordPress Royal Elementor Addons plugin <= 1.7.1001 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- wpfactory wishlist for woocommerceWordPress Wishlist for WooCommerce: Multi Wishlists Per Customer plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- debuggers studio saaspricingWordPress SaasPricing plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kinhelios kintpv wooconnectWordPress Kintpv Wooconnect plugin <= 8.129 - Cross Site Scripting (XSS) vulnerability7.1 High
- vowelweb vw automobile lite, vw themes automobile lite +1 moreWordPress VW Automobile Lite theme <= 2.1 - Broken Access Control vulnerability5.4 Medium
- royal-elementor-addons royal elementor addonsWordPress Royal Elementor Addons plugin <= 1.7.1001 - Broken Access Control vulnerability4.3 Medium
- leap13 premium addons for elementorWordPress Premium Addons for Elementor plugin <= 4.10.56 - Broken Access Control vulnerability5.4 Medium
- marketing fire widget optionsWordPress Widget Options plugin <= 4.0.6.1 - Broken Access Control vulnerability4.3 Medium
- codename065 download managerWordPress Download Manager plugin <= 3.3.03 - Broken Access Control vulnerability4.3 Medium
- dbar productions member directory and contact formWordPress Member Directory and Contact Form plugin <= 1.7.0 - Broken Access Control vulnerability4.3 Medium
- coupon plugin couponWordPress Coupon plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- andy fragen embed pdf viewerWordPress Embed PDF Viewer plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- wpweb woocommerce pdf vouchersWordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- sevenspark contact form 7 – dynamic text extensionWordPress Contact Form 7 - Dynamic Text Extension plugin <= 5.0.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- codebard help deskWordPress CodeBard Help Desk plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- searchiqWordPress SearchIQ plugin <= 4.6 - Cross-Site Requst Forgery (CSRF) vulnerability4.3 Medium
- alex volkov wp nice loaderWordPress WP Nice Loader plugin <= 0.1.0.4 - CSRF to Stored XSS vulnerability7.1 High
- ssl wireless sms notification, sslplugins ssl wireless sms notification +1 moreWordPress SSL Wireless SMS Notification plugin <= 3.6.0 - Privilege Escalation vulnerability9.8 Critical
- deluxethemes userproWordPress UserPro plugin <= 5.1.9 - SQL Injection vulnerability8.5 High
- deluxethemes userproWordPress UserPro plugin <= 5.1.9 - Authenticated Arbitrary User Meta Update vulnerability8.8 High
- arraytics eventinWordPress Eventin plugin <= 4.0.7 - Contributor+ Limited Local File Inclusion vulnerability6.5 Medium
- deluxethemes userproWordPress UserPro plugin <= 5.1.9 - Local File Inclusion vulnerability8.3 High
- themify builder, themifyme themify builder +1 moreWordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability6.5 Medium
- dynamic web lab product category grid, slider for woocommerce, maidul dynamic product category grid, slider for woocommerce +1 moreWordPress Dynamic Product Category Grid, Slider for WooCommerce plugin <= 1.1.3 - Local File Inclusion vulnerability7.5 High
- codeastro online food ordering systemCodeAstro Online Food Ordering System All Users Page all_users.php access control6.9 Medium
- samsung android, samsung mobile devices +1 moreProtection Mechanism Failure in bootloader prior to SMR Oct-2024 Release 1 allows physical...5.2 Medium
- Show moreLoading…