CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- scriptsbundle adforestAdForest - Classified Ads WordPress Theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment Deletion4.3 Medium
- stylemixthemes cost calculator builder proCost Calculator Builder PRO <= 3.2.15 - Unauthenticated SQL Injection via data7.5 High
- madrasthemes mas elementorMAS Elementor <= 1.1.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG6.4 Medium
- scriptsbundle adforestAdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account Takeover9.8 Critical
- vivo minigamecenterMinigameCenter module information leakage vulnerability6.3 Medium
- vivo healthHealth information leakage vulnerability6.3 Medium
- wpdeveloper essential blocks, wpdevteam gutenberg essential blocks – page builder for gutenberg blocks & patterns +1 moreEssential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- iptanus wordpress file upload, nickboss iptanus file upload +1 moreWordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution9.8 Critical
- frappe lmsVIWIS LMS File Upload cross site scripting6.9 Medium
- vmware aria automation, cloud foundation (vmware aria automation) +1 moreVMSA-2025-0001: VMware Aria automation update addresses a server side request forgery vulnerability (CVE-2025-22215)4.3 Medium
- thehappymonster happy addons for elementorHappy Addons for Elementor <= 3.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpxpro xpro addons for elementor, xpro addons — 140+ widgets for elementor +1 more140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post Duplication4.3 Medium
- bdthemes element pack, element pack – widgets, templates & addons for elementor +1 moreElement Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- iptanus wordpress file upload, nickboss iptanus file upload +1 moreWordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion9.8 Critical
- unknown property hive, wp-property-hive propertyhive +1 morePropertyHive < 2.1.1 - Reflected XSS6.1 Medium
- gregross auto iframeAuto iFrame < 2.0 - Contributor+ XSS via Shortcode5.4 Medium
- infinitewp client, revmakx infinitewp client +1 moreInfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading5.3 Medium
- realmag777 mdtf – meta data and taxonomies filter, pluginus wordpress meta data and taxonomies filter +1 moreMDTF – Meta Data and Taxonomies Filter <= 1.3.3.5 - Authenticated (Contributor+) SQL Injection6.5 Medium
- webinarpress, wpwebinarsystem webinarpress – webinar system for wordpress +1 moreWordPress Webinar Plugin – WebinarPress <= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation8.8 High
- themesflat addons for elementorThemesflat Addons For Elementor <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- webinarpress, wpwebinarsystem webinarpress – webinar system for wordpress +1 moreWordPress Webinar Plugin – WebinarPress <= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Webinar Updates8.8 High
- planex communications inc. mzk-dp300nCross-site scripting vulnerability exists in MZK-DP300N firmware versions 1.05 and earlier. If an...4.8 Medium
- huawei harmonyosStartup control vulnerability in the ability module Impact: Successful exploitation of this...6.2 Medium
- huawei harmonyosVulnerability of input parameters not being verified during glTF model loading in the 3D engine...6.8 Medium
- huawei harmonyosVulnerability of input parameters not being verified during glTF model loading in the 3D engine...5.5 Medium
- huawei harmonyosVulnerability of input parameters not being verified during glTF model loading in the 3D engine...5.5 Medium
- huawei harmonyosVulnerability of input parameters not being verified during glTF model loading in the 3D engine...6.8 Medium
- hassantafreshi easy form builder by whitestudio — drag & drop form builderEasy Form Builder <= 3.8.8 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- wpextended the ultimate wordpress toolkit – wp extended, ultimate wordpress toolkit +1 moreThe Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution8.8 High
- brainstormforce sureforms, sureforms – contact form, payment form & other custom form builder +1 moreSureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure5.3 Medium
- wpextended the ultimate wordpress toolkit – wp extended, wp extended +1 moreThe Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting7.4 High
- teonos slotti ajanvarausSlotti Ajanvaraus <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- huawei harmonyosVulnerability of input parameters not being verified during glTF model loading in the 3D engine...5.5 Medium
- huawei harmonyosInteger overflow vulnerability during glTF model loading in the 3D engine module Impact:...7.3 High
- huawei emui, harmonyos +1 moreBuffer overflow vulnerability in the component driver module Impact: Successful exploitation of...6.3 Medium
- huawei emui, harmonyos +1 morePrivilege escalation vulnerability in the Account module Impact: Successful exploitation of this...6.6 Medium
- huawei emui, harmonyos +1 moreVulnerability of improper access control in the home screen widget module Impact: Successful...6.7 Medium
- huawei emui, harmonyos +1 moreVulnerability of improper permission control in the window management module Impact: Successful...7.8 High
- huawei harmonyosVulnerability of variables not being initialized in the notification module Impact: Successful...4.0 Medium
- huawei harmonyosInstruction authentication bypass vulnerability in the Findnetwork module Impact: Successful...4.3 Medium
- txone networks portable inspector, portable inspector pro edition +1 moreTXOne Networks Portable Inspector Management Program Improper Input Validation Vulnerability6.9 Medium
- huawei harmonyosCross-process screen stack vulnerability in the UIExtension module Impact: Successful...7.5 High
- huawei harmonyosCross-process screen stack vulnerability in the UIExtension module Impact: Successful...6.2 Medium
- huawei harmonyosRace condition vulnerability in the distributed notification module Impact: Successful...4.1 Medium
- huawei emui, harmonyos +1 moreVulnerability of native APIs not being implemented in the NFC service module Impact: Successful...5.5 Medium
- huawei emui, harmonyos +1 moreRace condition vulnerability in the Bastet module Impact: Successful exploitation of this...4.1 Medium
- huawei emui, harmonyos +1 morePermission control vulnerability in the Connectivity module Impact: Successful exploitation of...6.2 Medium
- huawei harmonyosAccess control vulnerability in the identity authentication module Impact: Successful...7.5 High
- huawei emui, harmonyos +1 moreVulnerability of improper memory address protection in the HUKS module Impact: Successful...6.0 Medium
- huawei harmonyosVulnerability of input parameters not being verified in the widget framework module Impact:...5.7 Medium
- Show moreLoading…