CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- alexey trofimov captchelfie – captcha by selfieWordPress Captchelfie – Captcha by Selfie plugin <= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- dave konopka updownupdownWordPress UpDownUpDown plugin <= 1.1 - CSRF to Stored XSS vulnerability7.1 High
- kathleen malone find your repsWordPress Find Your Reps plugin <= 1.2 - CSRF to Stored XSS vulnerability7.1 High
- elke hinze, plumeria web design web testimonialsWordPress Web Testimonials plugin <= 1.2 - CSRF to Stored XSS vulnerability7.1 High
- syed amir hussain custom postWordPress Custom Post plugin <= 1.0 - CSRF to Stored XSS vulnerability7.1 High
- mosterd3d dd rolesWordPress DD Roles plugin <= 4.1 - Privilege Escalation vulnerability8.8 High
- regios myanime widgetWordPress MyAnime Widget plugin <= 1.0 - CSRF to Privilege Escalation vulnerability8.8 High
- digfish geotagged mediaWordPress Geotagged Media plugin <= 0.3.0 - CSRF to Stored XSS vulnerability7.1 High
- oren hahiashvili add custom google tag managerWordPress add custom google tag manager plugin <= 1.0.3 - CSRF to Stored Cross-Site Scripting vulnerability7.1 High
- stargazer wp-blackcheckWordPress WP-BlackCheck plugin <= 2.7.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- jan štětina wordpress logging serviceWordPress WordPress Logging Service plugin <= 1.5.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- yonatan reinberg of social ink custom post type lockdownWordPress Custom Post Type Lockdown plugin <= 1.11 - CSRF to Privilege Escalation vulnerability8.8 High
- adrian moreno wp lyricsWordPress WP Lyrics plugin <= 0.4.1 - CSRF to Stored XSS vulnerability7.1 High
- sanjay prasad loginplusWordPress Loginplus plugin <= 1.2 - Broken Access Control vulnerability5.3 Medium
- jd7777 bible embedWordPress Bible Embed plugin <= 0.0.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- edesac extra options – faviconsWordPress Extra Options – Favicons plugin <= 1.1.0 - CSRF to Stored XSS vulnerability7.1 High
- pascal casier board electionWordPress Board Election plugin <= 1.0.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- sprucejoy cookie consent & autoblock for gdpr/ccpaWordPress Cookie Consent & Autoblock for GDPR/CCPA plugin <= 1.0.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- editionguard for woocommerce – ebook sales with drmWordPress EditionGuard for WooCommerce plugin <= 3.4.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- david marcucci password protect plugin for wordpressWordPress Password Protect Plugin for WordPress plugin <= 0.8.1.0 - CSRF to Stored XSS vulnerability7.1 High
- marvinlabs wp pt-viewerWordPress WP PT-Viewer plugin <= 2.0.2 - Reflected XSS vulnerability7.1 High
- albdesign simple project managerWordPress Simple Project Manager plugin <= 1.2.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- albertolabs.com easy eu cookie lawWordPress Easy EU Cookie law plugin <= 1.3.3.1 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- andy chapman ect add to cart buttonWordPress ECT Add to Cart Button plugin <= 1.4 - CSRF to Stored XSS vulnerability7.1 High
- nasir scroll top advancedWordPress Scroll Top Advanced plugin <= 2.5 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- bnovotny marquee style rss news tickerWordPress Marquee Style RSS News Ticker plugin <= 3.2.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- myriad solutionz stars smtp mailerWordPress Stars SMTP Mailer plugin <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- binesh dobhal go socialWordPress go Social plugin <= 1.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- scott swezey easy tyntWordPress Easy Tynt plugin <= 0.2.5.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- master software solutions wp vtiger synchronizationWordPress WP VTiger Synchronization plugin <= 1.1.1 - CSRF to Stored XSS vulnerability7.1 High
- oren yomtov mass custom fields managerWordPress Mass Custom Fields Manager plugin <= 1.5 - CSRF to Cross Site Scripting (XSS) vulnerability7.1 High
- capa wp-scribd-listWordPress Wp-Scribd-List plugin <= 1.2 - CSRF to XSS vulnerability7.1 High
- matias s shockingly big ie6 warningWordPress Shockingly Big IE6 Warning plugin <= 1.6.3 - CSRF to Stored XSS vulnerability7.1 High
- oddthinking emailshroudWordPress EmailShroud plugin <= 2.2.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- isnowfy my-related-postsWordPress my-related-posts plugin <= 1.1 - CSRF to Stored XSS vulnerability7.1 High
- altima-interactive altima lookbook free for woocommerceWordPress Altima Lookbook Free for WooCommerce plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- hoyce universal analytics injectorWordPress Universal Analytics Injector plugin <= 1.0.3 - CSRF to Stored XSS vulnerability7.1 High
- mukesh dak md custom content after or before of postWordPress MD Custom content after or before of post plugin <= 1.0 - CSRF to Stored XSS vulnerability7.1 High
- alti5 alt reportWordPress AlT Report plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- x villamuera visit site link enhancedWordPress Visit Site Link enhanced plugin <= 1.0 - CSRF to Stored XSS vulnerability7.1 High
- vimal ghorecha rss news scrollerWordPress RSS News Scroller plugin <= 2.0.0 - CSRF to Stored XSS vulnerability7.1 High
- smackcoders sendgrid for wordpressWordPress SendGrid for WordPress plugin <= 1.4 - Broken Access Control vulnerability4.3 Medium
- openobserveOpenObserve Improper Authorization Allows Admin User to Remove Root User8.7 High
- zulip, zulip server +1 more/api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server6.9 Medium
- t2bot matrix-media-repoServer-Side Request Forgery (SSRF) on redirects and federation in Matrix Media Repo5.0 Medium
- t2bot matrix-media-repoUntrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in Matrix Media Repo6.8 Medium
- t2bot matrix-media-repoDenial of service through memory exhaustion in Matrix Media Repo5.3 Medium
- t2bot matrix-media-repoDenial of service/high operating costs through unauthenticated downloads in Matrix Media Repo5.3 Medium
- t2bot matrix-media-repoUnauthenticated writes to the media repository allow planting of problematic content in Matrix Media Repo5.3 Medium
- matrix-org gomatrixserverlibServer-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlib4.3 Medium
- Show moreLoading…