CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- a3rev compare products for woocommerceCompare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object Injection8.1 High
- swarminteractive viewmedica 9ViewMedica 9 <= 1.4.17 - Cross-Site Request Forgery to Reflected Cross-Site Scripting6.1 Medium
- infility globalInfility Global <= 2.9.8 - Reflected Cross-Site Scripting via set_type Parameter6.1 Medium
- swarminteractive viewmedica 9ViewMedica Embed <= 1.4.15 - Cross-Site Request Forgery to SQL Injection5.4 Medium
- ramon-fincken simple add pages or postsSimple add pages or posts <= 2.0.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting6.1 Medium
- sazzadh image magnifyImage Magnify <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wc1cWC1C <= 0.23.0 - Reflected Cross-Site Scripting6.1 Medium
- arrowplugins popup – mailchimp, getresponse and activecampaign intergrationsPopup – MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Unauthenticated SQL Injection7.5 High
- bizappventures bizapp for woocommerceBizapp for WooCommerce <= 2.0.8 - Reflected Cross-Site Scripting6.1 Medium
- hoststreamsell woocommerce hss extension for streaming videoWooCommerce HSS Extension for Streaming Video <= 3.31 - Reflected Cross-Site Scripting via videolink Parameter6.1 Medium
- seomantis seo keywordsSEO Keywords <= 1.1.3 - Reflected Cross-Site Scripting via google_error Parameter6.1 Medium
- deios financial stocks & crypto market data pluginFinancial Stocks & Crypto Market Data Plugin <= 1.10.3 - Reflected Cross-Site Scripting6.1 Medium
- eherman24 custom product tabs for woocommerceCustom Product Tabs for WooCommerce <= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injection7.2 High
- intergotelecom wp – bulk sms – by sms.toWP – Bulk SMS – by SMS.to <= 1.0.12 - Reflected Cross-Site Scripting6.1 Medium
- daniel1088 pixnet pluginPIXNET Plugin <= 2.9.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- andersyogo yogo bookingYOGO Booking <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- clevelandwebdeveloper spacerSpacer <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Limited Information Disclosure3.1 Low
- bandido ukrposhtaWoo Ukrposhta <= 1.17.11 - Reflected Cross-Site Scripting via order, post, and idd Parameters6.1 Medium
- calculatorscanadaca cc canadian mortgage calculatorCC Canadian Mortgage Calculator <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- binsaifullah duplicate post, page and any custom postDuplicate Post, Page and Any Custom Post <= 3.5.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication4.3 Medium
- 1clickdesigns clickdesignsClickDesigns <= 1.8.0 - Missing Authorization to API Key Modification or Removal5.3 Medium
- bqworks slider pro liteSlider Pro Lite <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- sellsySellsy <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- arsdeveloper ars affiliate page pluginARS Affiliate Page Plugin <= 2.0.2 - Reflected Cross-Site Scripting6.1 Medium
- endortrails sell mediaSell Media <= 2.5.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- chative live chat and chatbotChative Live chat and Chatbot <= 1.1 - Cross-Site Request Forgery via add_chative_widget_action Function5.4 Medium
- delabon live sales notification for woocommerce – woomotivWoomotiv <= 3.6.1 - Unauthenticated SQL Injection7.5 High
- pantherius wordpress survey & poll – quiz, survey and poll plugin for wordpressWordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- tobias conrad wow styler for cf7 – visual styler for contact form 7 formsDesign for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler <= 1.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting6.5 Medium
- transportersio transporters.ioTransporters.io <= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- formaloo form maker & customer analytics for wordpress & woocommerceFormaloo Form Maker & Customer Analytics for WordPress & WooCommerce <= 2.1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- themescoder tc ecommerce – create android & ios apps for woocommerceThemes Coder – Create Android & iOS Apps For Your Woocommerce Site <= 1.3.4 - Insecure Direct Object Reference to Password Change/Account Takeover/Privilege Escalation9.8 Critical
- solwininfotech timeline designerTimeline Designer <= 1.4 - Authenticated (Admin+) SQL Injection4.9 Medium
- india-web-developer wp youtube galleryWP Youtube Gallery <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter6.4 Medium
- dell update package framework, update package (dup) framework +1 moreDell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege...8.2 High
checkstyleOSS-FuzzSecurity exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.exprNo scoreoatppOSS-FuzzHeap-buffer-overflow in oatpp::json::Utils::escapeUtf8CharNo score- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.65.1 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.66.5 Medium
- mozilla firefox, thunderbird +1 moreMemory corruption when using JavaScript Text Segmentation7.7 High
- mozilla firefox, thunderbird +1 moreCompartment mismatch when parsing JavaScript JSON module4.0 Medium
- mozilla firefox, thunderbird +1 moreAlt-Svc ALPN validation failure when redirected4.0 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free when breaking lines in text5.3 Medium
- mozilla firefox, thunderbird +1 moreWebChannel APIs susceptible to confused deputy attack5.4 Medium
- No product listedA vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the...9.8 Critical
- No product listedInvoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an...8.8 High
- No product listedA vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which...9.8 Critical
- No product listedA vulnerability exits in driver snxppamd.sys in SUNIX Parallel Driver x64 - 10.1.0.0, which...7.8 High
- No product listedA vulnerability exits in driver snxpsamd.sys in SUNIX Serial Driver x64 - 10.1.0.0, which allows...7.8 High
- No product listedAn issue in the snxpcamd.sys component of SUNIX Multi I/O Card v10.1.0.0 allows attackers to...8.8 High
- Show moreLoading…