CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- frazahmed productdynoWordPress ProductDyno plugin <= 1.0.24 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- liton arefin image hover effects for elementorWordPress Image Hover Effects for Elementor plugin <= 1.0.2.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- theinnovs elementscss addons for elementorWordPress ElementsCSS Addons for Elementor plugin <= 1.0.8.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- andon ivanov oz canonicalWordPress OZ Canonical plugin <= 0.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- nchankov autocompleterWordPress Autocompleter plugin <= 1.3.5.2 - CSRF to Stored XSS vulnerability7.1 High
- 5centscdnWordPress 5centsCDN plugin <= 25.4.15 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- elevioWordPress Elevio plugin <= 4.4.1 - CSRF to Stored XSS vulnerability7.1 High
- olaf lederer eo4wpWordPress EO4WP plugin <= 1.0.8.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- piotnetdotcom piotnet addons for elementorWordPress Piotnet Addons For Elementor plugin <= 2.4.31 - Cross-Site Scripting vulnerability6.5 Medium
- amos lee（一刀） wizhi multi filters by wenpriseWordPress Wizhi Multi Filters by Wenprise plugin <= 1.8.6 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- athemeart store commerceWordPress Store Commerce theme <= 1.2.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- dennis koot wpsolWordPress wpSOL plugin <= 1.2.0 - CSRF to Stored XSS vulnerability7.1 High
- jens törnell wp simple sitemapWordPress WP Simple Sitemap plugin <= 0.2 - CSRF to Stored XSS vulnerability7.1 High
- bannersky bsk forms blacklistWordPress BSK Forms Blacklist plugin <= 3.9 - CSRF to SQL Injection vulnerability8.2 High
- rto gmbh dynamictagsWordPress DynamicTags plugin <= 1.4.0 - SQL Injection vulnerability8.5 High
- owen cutajar & hyder jaffari wordpress auction pluginWordPress WordPress Auction Plugin plugin <= 3.7 - SQL Injection vulnerability7.6 High
- elextensions elex woocommerce advanced bulk edit products, prices & attributesWordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Plugin <= 1.4.9 - SQL Injection vulnerability7.6 High
- penguinarts contact form 7 database – cfdb7WordPress Contact Form 7 Database – CFDB7 plugin <= 1.0.0 - SQL Injection vulnerability7.6 High
- balcom-vetillo design, inc. bvd easy gallery managerWordPress BVD Easy Gallery Manager plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- asokaaso2 kikx simple post author filter, kikx simple post author filter +1 moreWordPress Kikx Simple Post Author Filter plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- simple plugins target notificationsWordPress Target Notifications plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- pjfc syncfieldsWordPress SyncFields plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- marcon simone wp advertising managementWordPress Wp advertising management plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- daniel bakovic wpachievements freeWordPress WPAchievements Free Plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- service shogun ach invoice appWordPress Ach Invoice App plugin <= 1.0.1 - Local File Inclusion vulnerability7.5 High
- themepoints service boxService Box <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- mulika mipl multistore sync for woocommerce. sync products, stock and orders.MIPL WC Multisite Sync <= 1.1.5 - Unauthenticated Arbitrary File Download7.5 High
- iptanus wordpress file upload, nickboss iptanus file upload +1 moreWordPress File Upload <= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal4.3 Medium
- openatom openharmonyCommunication_dsoftbus has an UAF vulnerability4.4 Medium
- openatom openharmonyLiteos_a has an out-of-bounds write vulnerability8.8 High
- openatom openharmonyLiteos_a has an out-of-bounds read vulnerability5.5 Medium
- progress sitefinity: Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation...6.8 Medium
- progress sitefinityImproper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation ...8.4 High
- progress sitefinityInformation Exposure Through an Error Message vulnerability in Progress Software Corporation...7.7 High
- vickydalmia coupon pluginCoupon Plugin <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- irontemplates croma musicCroma Music <= 3.6 - Authenticated (Subscriber+) Arbitrary Options Update in ironMusic_ajax8.8 High
- wpdevart booking calendar pro wpdevart, booking calendar, appointment booking system +1 moreBooking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'6.1 Medium
- akshay-menariya export import menusExport Import Menus <= 1.9.1 - Missing Authorization to Unauthenticated Menu Export5.3 Medium
- laborator aurum - wordpress & woocommerce shopping themeAurum - WordPress & WooCommerce Shopping Theme <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Demo Content Import4.3 Medium
- lumiblog marketplace itemsMarketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- appjetty wp jquery datatableWP jQuery DataTable <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- virgial bootstrap blocks for wp editor v2Bootstrap Blocks for WP Editor v2 <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- covertcommunication solar wizard liteSolar Wizard Lite <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- master-addons master addons, litonice13 master addons for elementor – widgets, extensions, theme builder, popup builder & template kits +1 moreMaster Addons -- Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip Module6.4 Medium
- estatik mortgage calculatorEstatik Mortgage Calculator <= 2.0.11 - Reflected Cross-Site Scripting6.1 Medium
- shaonsina sina extension for elementorSina Extension for Elementor <= 3.5.91 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Sina Image Differ6.4 Medium
- cozyvision sms alert order notifications, cozyvision1 sms alert – sms & otp for woocommerce, order notifications & abandoned cart recovery +1 moreSMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- wpchill passster, passster – password protect pages and content +1 morePassster – Password Protect Pages and Content <= 4.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure5.3 Medium
- unknown category posts widgetCategory Posts Widget < 4.9.18 - Admin+ Stored XSS4.8 Medium
- owen cutajar & hyder jaffari wordpress auction plugin, wpmarka wordpress auction +1 moreWordPress Auction <= 3.7 - Editor+ Stored XSS4.8 Medium
- Show moreLoading…