CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- jtwerdy genesis style shortcodesWordPress Genesis Style Shortcodes Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bishawjit das wp custom countdownWordPress wp custom countdown Plugin <= 2.8 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpecommerce sell digital downloadsWordPress Sell Digital Downloads plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- lucia intelisano live flight radarWordPress Live Flight Radar Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- joomag wp joomagWordPress WP Joomag plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- silabs.com ember znet sdkEmber ZNet buffer overflow in 'packet handoff' plugin3.7 Low
- opendds ddsData Distribution Service (DDS) Chain of Trust (CoT) violation vulnerability in Open DDS8.2 High
- opendds ddsData Distribution Service (DDS) Chain of Trust (CoT) violation vulnerability in Cyclone DDS8.2 High
- eprosima ddsData Distribution Service (DDS) Chain of Trust (CoT) violation in Fast DDS8.2 High
- ibm app connect enterprise certified containerIBM App Connect Enterprise Certified Container denial of service5.5 Medium
- ibm openpages, openpages with watson +1 moreIBM OpenPages information disclosure5.4 Medium
linux-azureUbuntulinux-azure vulnerabilitiesNo score- wpsoul greenshift – animation and page builder blocks, greenshiftwp greenshift - animation and page builder blocks +1 moreGreenshift – animation and page builder blocks <= 9.0.0 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross-Site Scripting6.4 Medium
- linkidlinkID <= 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposure8.6 High
- 3dvieweronline 3d viewer online3DVieweronline <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- concertedaction action networkAction Network <= 1.4.4 - Reflected Cross-Site Scripting6.1 Medium
- bitlydeveloper bitly's wordpress pluginBitly's WordPress Plugin <= 2.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update4.3 Medium
- addonmaster post grid master, mdshuvo post grid master — post grids & ajax filters +1 morePost Grid Master <= 3.4.12 - Missing Authorization to Unauthenticated Local PHP File Inclusion9.8 Critical
- searchieSearchie <= 1.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- masjidal muslim prayer time-salah/iqamahMuslim Prayer Time-Salah/Iqamah <= 1.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- reichertbrothers simplyrets real estate idxSimplyRETS Real Estate IDX <= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- sonalsinha21 skt page builderSKT Page Builder <= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- manycontacts whatsapp 🚀 click to chatWhatsApp click to chat <= 3.0.4 - Reflected Cross-Site Scripting6.1 Medium
- posturinn pósturinn\'s shipping with woocommercePósturinn\'s Shipping with WooCommerce <= 1.3.1 - Reflected Cross-Site Scripting6.1 Medium
- yumpu e-paper publishingYumpu E-Paper publishing <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- skyword xmlrpc publishingSkyword API Plugin <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- cluevo lms, e-learning platformCLUEVO LMS, E-Learning Platform <= 1.13.2 - Reflected Cross-Site Scripting6.1 Medium
- phoeniixx woocommerce check pincode/zipcode for shippingWoocommerce check pincode/zipcode for shipping <= 2.0.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting6.1 Medium
- mpc responsive flipbook plugin wordpressResponsive FlipBook Plugin Wordpress <= 2.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- opacewebdesign opace ai scribe: seo content creator & humaizer for openai & anthropicAI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Cross-Site Request Forgery to Settings Update4.3 Medium
- stylemix pearl – header builderWordpress Header Builder Plugin <= 1.3.8 - Cross-Site Request Forgery to Header Deletion4.3 Medium
- wptravel wp travel – ultimate travel booking system, tour management engineWP Travel – Ultimate Travel Booking System, Tour Management Engine <= 10.0.0 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- surakrai mimo woocommerce order trackingMIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Limited Settings Update4.3 Medium
- databasebackup wp database backup – unlimited database & files backup by backup for wpWP Database Backup – Unlimited Database & Files Backup by Backup for WP <= 7.3 - Unauthenticated Database Back-Up Exposure7.5 High
- ssema sema apiSEMA API <= 5.27 - Reflected Cross-Site Scripting via catid Parameter6.1 Medium
- samdani gs insever portfolioGS Insever Portfolio <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) CSS Injection4.3 Medium
- amitrotem deliver via shipos for woocommerceDeliver via Shipos for WooCommerce <= 2.1.7 - Reflected Cross-Site Scripting via dvsfw_bulk_label_url Parameter6.1 Medium
- linearoy linearLinear <= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- blueberryacc files download delayFiles Download Delay <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- newsletter2goNewsletter2Go <= 4.0.14 - Missing Authorization to Authenticated (Subscriber+) Style Reset4.3 Medium
- web-mv resadsResAds <= 2.0.6 - Reflected Cross-Site Scripting via Multiple Parameters6.1 Medium
- tenda ac6, ac6 firmware +1 moreTenda AC6 GetParentControlInfo stack-based overflow8.7 High
- campcodes deped equipment inventory systemCampCodes DepEd Equipment Inventory System add_employee.php cross site scripting5.3 Medium
- anisha admission management systemcode-projects Admission Management System Login index.php sql injection6.9 Medium
- sonicwall sonicosSSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling...9.1 Critical
- code-projects content management systemcode-projects Content Management System Publish News Page publishnews.php unrestricted upload5.1 Medium
- leiyuxi cy-fastleiyuxi cy-fast listData sql injection5.3 Medium
- unitecms unlimited elements for elementorUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.135 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets6.4 Medium
- leiyuxi cy-fastleiyuxi cy-fast listData sql injection5.3 Medium
- iocharger firmware for ac modelsUsing the <redacted> action or <redacted>.sh script, arbitrary files and directories can be deleted using directory traversal.7.2 High
- Show moreLoading…