CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- owen cutajar & hyder jaffari wordpress auction plugin, wpmarka wordpress auction +1 moreWordPress Auction <= 3.7 - Editor+ SQL Injection9.8 Critical
- tabs shortcode project shortcode, unknown tabs shortcode +1 moreTabs Shortcode <= 2.0.2 - Contributor+ XSS via Shortcode5.3 Medium
- 10web form maker, unknown form maker by 10web +1 moreForm Maker by 10Web < 1.15.31 - Admin+ Stored XSS2.7 Low
- unknown photo gallery, images, slider in rbs image gallery, robosoft robo gallery +1 morePhoto Gallery, Images, Slider in Rbs Image Gallery < 3.2.22 - Contributor+ Stored XSS2.7 Low
- axis camera station proSeth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible...6.3 Medium
- letscms binary mlm for woocommerceBinary MLM Woocommerce <= 2.0 - Reflected Cross-Site Scripting via 'page'6.1 Medium
- sweepwidget – contests, giveaways, sweepstakes & photo contestsSweepWidget Contests, Giveaways, Photo Contests, Competitions <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpqode fancypost – post blocks, grids & sliders for block editor and elementorFancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 6.0.0 - Missing Authorization to Authenticated (Subscriber+) Shortcode Export4.3 Medium
- candiflyCandifly <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- geotargetly geo contentGeo Content <= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- beardev joomsport – for sports: team & league, football, hockey & moreJoomSport <= 5.6.17 - Reflected Cross-Site Scripting via page7.1 High
- postsaint post saint: chatgpt, gpt4, dall-e, stable diffusion, pexels, dezgo ai text & image generatorPost Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- jleuze meteor slides, meteor slides project slides +1 moreMeteor Slides <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- socialrocket social rocket – social sharing plugin, wpsocialrocket social rocket +1 moreSocial Rocket <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- flickrocket digital content delivery (incl. drm) by flickrocket for woocommerceWooCommerce Digital Content Delivery (incl. DRM) – FlickRocket <= 4.75 - Reflected Cross-Site Scripting6.1 Medium
- letscms binary mlm for woocommerceBinary MLM Woocommerce <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- eflyjason host php infoHost PHP Info <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure8.6 High
- chatroll live chatChatroll Live Chat <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- lumiblog marketplace itemsMarketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marketplace' Shortcode6.4 Medium
- marekzak01 smartemailingSmartEmailing.cz <= 2.2.0 - Reflected Cross-Site Scripting6.1 Medium
- wpguruin error log viewer by wp guruError Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read7.5 High
- rajeshsingh520 store credit / gift cards for woocommerceStore credit / Gift cards for woocommerce <= 1.0.49.46 - Reflected Cross-Site Scripting6.1 Medium
- socialrocket social rocket – social sharing plugin, wpsocialrocket social rocket +1 moreSocial Rocket – Social Sharing Plugin <= 1.3.4 - Missing Authorization to Settings Update5.3 Medium
- appizy app embedApp Embed <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- a3rev compare products for woocommerceCompare Products for WooCommerce <= 3.2.1 - Reflected Cross-Site Scripting6.1 Medium
- letscms unilevel mlm planUnilevel MLM Plan <= 1.1.0 - Reflected Cross-Site Scripting via 'page'6.1 Medium
- commonninja common ninja: fully customizable & perfectly responsive free widgets for wordpress websitesCommon Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- rightmessage wpRightMessage WP <= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- theperfectwedding theperfectwedding.nl widgetThePerfectWedding.nl Widget <= 2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting8.8 High
- paygreen payment gatewayPayGreen Payment Gateway <= 1.0.26 - Reflected Cross-Site Scripting6.1 Medium
- themesawesome school management system – sakolawpSchool Management System – SakolaWP <= 1.0.8 - Unauthenticated Privilege Escalation9.8 Critical
- upress enable accessibilityEnable Accessibility <= 1.4.1 - Reflected Cross-Site Scripting6.1 Medium
- proloybhaduri lazyload background imagesLazyLoad Background Images <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update4.3 Medium
- infility globalInfility Global <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Plugin Options Update6.5 Medium
- maximize simple video management systemSimple Video Management System <= 1.0.4 - Reflected Cross-Site Scripting6.1 Medium
- unknown wordlift – ai powered seo – schema, wordlift – ai powered seo – schema +1 moreWordLift – AI powered SEO – Schema <= 3.54.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update5.3 Medium
- muzaara optimize your campaigns – google shopping – google ads – google adwordsOptimize Your Campaigns – Google Shopping – Google Ads – Google Adwords <= 3.1 - Information Exposure5.3 Medium
- igexsolutions wpschoolpress, jdsofttech school management system – wpschoolpress +1 moreSchool Management System – WPSchoolPress <= 2.2.14 - Authenticated (Student/Parent+) SQL Injection6.5 Medium
- aiwp elementor addons ai addons – 70 widgets, premium templates, ultimate elementsElementor AI Addons – 70 Widgets, Premium Templates, Ultimate Elements <= 2.2.1 - Authenticated (Contributor+) Private Templates Content Disclosure4.3 Medium
- payuplugin payu commercepro pluginPayU CommercePro Plugin <= 3.8.3 - Unauthenticated Privilege Escalation9.8 Critical
- sperse automate hub free by sperse.ioAutomate Hub Free by Sperse.IO <= 1.7.0 - Reflected Cross-Site Scripting6.1 Medium
- brownoxford member accessMember Access <= 1.1.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure5.3 Medium
- arrowplugins popup – mailchimp, getresponse and activecampaign intergrationsPopup – MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Missing Authorization to Unauthenticated DB Table Truncation5.3 Medium
- grandy gdy modular contentGDY Modular Content <= 0.9.92 - Reflected Cross-Site Scripting6.1 Medium
- uptodown apk download widgetUptodown APK Download Widget <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- outtheboxthemes same but different – related posts by taxonomySame but Different – Related Posts by Taxonomy <= 1.0.16 - Reflected Cross-Site Scripting6.1 Medium
- faysal61 chat support for viber – chat bubble and chat button for gutenberg, elementor and shortcodeChat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- otwthemes toggles shortcode and widgetToggles Shortcode and Widget <= 1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- seobeginner seo lat auto postSEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)9.8 Critical
- divineapi divine astroHoroscope And Tarot <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- Show moreLoading…