CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- designinvento directorypressWordPress DirectoryPress plugin <= 3.6.19 - Cross Site Scripting (XSS) vulnerability7.1 High
- allaccessible accessibility by allaccessibleWordPress Accessibility by AllAccessible plugin <= 1.3.4 - Privilege Escalation vulnerability8.8 High
- buildapp build app onlineWordPress Build App Online plugin <= 1.0.23 - Local File Inclusion vulnerability9.8 Critical
- emraan cheema cubewp formsWordPress CubeWP Forms plugin <= 1.1.10 - Broken Access Control vulnerability5.3 Medium
- eutrue naver analyticsWordPress NAVER Analytics plugin <= 0.9 - CSRF to Stored XSS vulnerability7.1 High
- securesubmit wp securesubmitWordPress WP SecureSubmit plugin <= 1.5.20 - Broken Access Control vulnerability4.3 Medium
- clickwhaleWordPress ClickWhale plugin <= 2.4.1 - SQL Injection vulnerability8.5 High
- wpvivid backup & migration backup and migration, wpvividplugins wpvivid backup and migration, wpvivid migration\, backup\, staging +2 moreWordPress WPvivid Backup plugin <= 0.9.106 - Broken Access Control vulnerability4.3 Medium
- brainstorm force astra widgetsWordPress Astra Widgets plugin <= 1.2.15 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- envato elementsWordPress Envato Elements plugin <= 2.0.14 - Server Side Request Forgery (SSRF) vulnerability4.1 Medium
- smackcoders wp ultimate exporterWordPress WP Ultimate Exporter plugin <= 2.9.1 - Remote Code Execution (RCE) vulnerability9.1 Critical
- syed balkhi contact form by wpforms, wpforms +1 moreWordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerability4.3 Medium
- mra13 compact wp audio playerWordPress Compact WP Audio Player plugin <= 1.9.14 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- amentotech private limited wpguppyWordPress WPGuppy plugin <= 1.1.0 - Privilege Escalation vulnerability8.8 High
- codemstory 워드프레스 결제 심플페이WordPress 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 plugin <= 5.2.0 - Local File Inclusion vulnerability7.5 High
- plainware locatoraid store locatorWordPress Locatoraid Store Locator Plugin <= 3.9.50 - PHP Object Injection vulnerability8.1 High
- elicus wpmozo addons lite for elementorWordPress WPMozo Addons Lite for Elementor plugin <= 1.1.0 - Local File Inclusion vulnerability7.5 High
- ssl wireless sms notification, sslplugins ssl wireless sms notification +1 moreWordPress SSL Wireless SMS Notification Plugin <= 3.5.0 - SQL Injection vulnerability9.3 Critical
- wpbits addons for elementor page builderWordPress WPBITS Addons For Elementor Page Builder plugin <= 1.5.1 - Cross-Site Scripting vulnerability6.5 Medium
- classic addons – wpbakery page builder, webcodingplace classic addons – wpbakery page builder +1 moreWordPress Classic Addons – WPBakery Page Builder plugin <= 3.0 - Local File Inclusion vulnerability7.5 High
- androidbubble wp docsWordPress WP Docs plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- appjetty wp jquery datatableWordPress WP jQuery DataTable Plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- adrian tobey groundhoggWordPress Groundhogg plugin <= 3.7.3.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- silverplugins217 multiple shipping and billing address for woocommerceWordPress Multiple Shipping And Billing Address For Woocommerce Plugin <= 1.2 - Unauthenticated SQL Injection vulnerability9.3 Critical
- plainware plaininventoryWordPress PlainInventory – Inventory Management Plugin Plugin <= 3.1.6 - PHP Object Injection vulnerability8.1 High
- nasir ahmed advanced form integrationWordPress AFI – The Easiest Integration Plugin <= 1.95.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- wpdevelop email remindersWordPress Email Reminders Plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- posimyth nexter blocksWordPress Nexter Blocks plugin <= 4.0.7 - Broken Access Control vulnerability6.4 Medium
- kitae park mang board wpWordPress Mang Board WP plugin <= 1.8.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- dn88 highlightWordPress Highlight plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- pektsekye notify odooWordPress Notify Odoo plugin <= 1.0.0 - CSRF to Stored XSS vulnerability7.1 High
- 5 star plugins pretty simple popup builderWordPress Pretty Simple Popup Builder Plugin <= 1.0.9 - Stored Cross Site Scripting (XSS) vulnerability5.9 Medium
- wpspin post/page copying toolWordPress Post/Page Copying Tool plugin <= 2.0.0 - Sensitive Data Exposure vulnerability7.5 High
- marcus (aka @msykes) wp fullcalendarWordPress WP FullCalendar plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- gutentorWordPress Gutentor plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- hive support supportWordPress Hive Support plugin <= 1.1.6 - Broken Access Control vulnerability4.3 Medium
- aipost ai wp writerWordPress AI WP Writer plugin <= 3.8.4.4 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- space codes ai for seoWordPress AI for SEO plugin <= 1.2.9 - Broken Access Control vulnerability4.3 Medium
- pixelyoursite – your smart pixel (tag) managerWordPress PixelYourSite plugin <= 10.0.1.2 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- zookatron mybooktable bookstoreWordPress MyBookTable Bookstore by Stormhill Media plugin <= 3.5.3 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- wp grids wandWordPress WP Wand plugin <= 1.2.5 - Broken Access Control vulnerability5.3 Medium
- brandtoss wp mailsterWordPress WP Mailster plugin <= 1.8.17.0 - Sensitive Data Exposure vulnerability5.3 Medium
- essential plugin hero banner ultimateWordPress Hero Banner Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerability6.5 Medium
- osama.esh wp visitor statistics (real time traffic)WordPress WP Visitor Statistics plugin <= 7.5 - Broken Access Control vulnerability4.3 Medium
- inc2734 smart custom fieldsWordPress Smart Custom FIelds plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ropeswinghld speakout! email petitionsWordPress SpeakOut! Email Petitions plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- marsian templatesnext toolkitWordPress TemplatesNext ToolKit plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpdeveloper typing textWordPress Typing Text plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- thimpress thim elementor kitWordPress Thim Elementor Kit plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpbits addons for elementor page builderWordPress WPBITS Addons For Elementor Page Builder plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- Show moreLoading…