CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- eric franklin video embed optimizerWordPress Video Embed Optimizer plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp cms ninja norse rune oracle pluginWordPress Norse Rune Oracle plugin <= 1.4.2 - CSRF to Stored XSS vulnerability7.1 High
- njshofe smoothness slider shortcodeWordPress Smoothness Slider Shortcode plugin <= v1.2.2 - CSRF to Stored XSS vulnerability7.1 High
- cdowp news publisher autopilotWordPress News Publisher Autopilot plugin <= 2.1.4 - CSRF to Stored XSS vulnerability7.1 High
- mario mansour and geoff peters tubepress.netWordPress TubePress.NET Plugin <= 4.0.1 - CSRF to Stored XSS vulnerability7.1 High
- marcus c. j. hartmann mcjh button shortcodeWordPress mcjh button shortcode plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jason funk title experiments freeWordPress Title Experiments Free plugin <= 9.0.4 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- saoshyant.1994 saoshyant page builderWordPress Saoshyant Page Builder plugin <= 3.8 - Broken Access Control vulnerability5.3 Medium
- faaiq pretty urlWordPress Pretty Urls Plugin <= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- brian legacy eplayerWordPress Legacy ePlayer plugin <= 0.9.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- instabotWordPress Instabot plugin <= 1.10 - CSRF to Stored XSS vulnerability7.1 High
- cleanshooter ics buttonWordPress ICS Button plugin <= 0.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- copist icons enricherWordPress Icons Enricher plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- damion armentrout able playerWordPress Able Player plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- arefly wp header notificationWordPress WP Header Notification plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- aazztech wp cookieWordPress WP Cookie plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- auto it biltorvet dealer tools, biltorvet a/s dealer tools +1 moreWordPress Biltorvet Dealer Tools plugin <= 1.0.22 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- scott nelle uptime robotWordPress Uptime Robot plugin <= 0.1.3 - CSRF to Stored XSS vulnerability7.1 High
- bytephp arcade readyWordPress Arcade Ready plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themebon ultimate image hover effectsWordPress Ultimate Image Hover Effects plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pluginspoint timeline proWordPress Timeline Pro plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bozdoz quote tweetWordPress Quote Tweet plugin <= 0.7 - CSRF to Stored XSS vulnerability7.1 High
- mmrs151 prayer times anywhereWordPress Prayer Times Anywhere plugin <= 2.0.1 - CSRF to Stored XSS vulnerability7.1 High
- 8blocks 1003 mortgage applicationWordPress 1003 Mortgage Application plugin <= 1.87 - Broken Access Control vulnerability7.5 High
- 8blocks 1003 mortgage applicationWordPress 1003 Mortgage Application plugin <= 1.87 - Broken Access Control vulnerability4.3 Medium
- burria laika pedigree treeWordPress Laika Pedigree Tree plugin <= 1.4 - CSRF to Stored XSS vulnerability7.1 High
linux-awsUbuntu,linux-raspiUbuntu +1 morelinux-aws, linux-raspi vulnerabilitiesNo score- macportsRemote Code Execution in MacPorts6.9 Medium
- code-projects online book shopcode-projects Online Book Shop booklist.php sql injection5.3 Medium
- code-projects online book shopcode-projects Online Book Shop booklist.php cross site scripting5.3 Medium
- acetech home clean services management systemSourceCodester Home Clean Services Management System process.php sql injection5.1 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting6.1 Medium
- wpjobportal wp job portal, wp job portal – ai-powered recruitment system for company or job board website +1 moreWP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.5- Authenticated (Subscriber+) Insecure Direct Object Reference4.3 Medium
- ibm security qradar edrIBM Security QRadar EDR denial of service4.9 Medium
- libreoffice, debian linux +1 moreURL fetching can be used to exfiltrate arbitrary INI file values and environment variables6.7 Medium
- ibm security qradar edrIBM Security QRadar EDR information disclosure5.3 Medium
- ibm concert, concert software +1 moreIBM Concert Software information disclosure5.3 Medium
- ibm concert, concert software +1 moreIBM Concert Software information disclosure5.9 Medium
- ibm concert, concert software +1 moreIBM Concert Software log manipulation5.4 Medium
- ibm concert, concert software +1 moreIBM Concert Software information disclosure5.3 Medium
- libreoffice, debian linux +1 morePath traversal leading to arbitrary .ttf file write2.4 Low
- mdmag quill forms, quill forms | conversational multi step forms, surveys & quizzes +1 moreQuill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress <= 3.10.0 - Authenticated (Contributor+) Stored Cross-S…6.4 Medium
- wp chill rsvp and event managementRSVP and Event Management <= 2.7.13 - Missing Authorization5.3 Medium
- best wp developer bwd elementor addonsBWD Elementor Addons <= 4.3.18 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates4.3 Medium
- artbees jupiter x coreJupiter X Core <= 4.8.5 - Missing Authorization to Authenticated Library Sync4.3 Medium
- artbees jupiter x coreJupiter X Core <= 4.8.5 - Missing Authorization to Unauthenticated Popup Template Export5.3 Medium
- themeglow jobboard job listingWordPress JobBoard Job listing plugin <= 1.2.6 - Arbitrary File Upload vulnerability10.0 Critical
- amentotech private limited wpguppyWordPress WPGuppy plugin <= 1.1.0 - PHP Object Injection vulnerability9.8 Critical
- magepeople inc. bus ticket booking with seat reservationWordPress WpBusTicketly plugin <= 5.4.3 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- smsa express shippingWordPress SMSA Shipping plugin <= 2.3 - Arbitrary File Deletion vulnerability8.6 High
- Show moreLoading…