CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- osama.esh wp visitor statistics (real time traffic)WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 7.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themeisle ai chatbot for wordpress – hyve liteWordPress Hyve Lite plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- webraketen internal links managerWordPress Internal Links Manager plugin <= 2.5.2 - Broken Access Control vulnerability4.3 Medium
- ayecode ketchup shortcodesWordPress Ketchup Shortcodes Plugin <= 0.1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- serpednet serped.netWordPress SERPed.net Plugin <= 4.4 - SQL Injection vulnerability8.5 High
- joe auction nudge – your ebay on your siteWordPress Auction Nudge – Your eBay on Your Site plugin <= 7.2.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- codepeople form builder cpWordPress Form Builder CP Plugin <= 1.2.41 - SQL Injection vulnerability8.5 High
- themeisle ppom for woocommerceWordPress PPOM for WooCommerce plugin <= 33.0.8 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- shahjada wpdm – premium packagesWordPress Premium Packages – Sell Digital Products Securely plugin <= 5.9.6 - SQL Injection vulnerability7.6 High
- bowo admin and site enhancements (ase)WordPress Admin and Site Enhancements (ASE) Plugin <= 7.6.2 - Broken Access Control vulnerability4.3 Medium
- mra13 simple download monitorWordPress Simple Download Monitor plugin <= 3.9.25 - SQL Injection vulnerability7.6 High
- webtoffee wishlist for woocommerceWordPress Wishlist for WooCommerce plugin <=2.1.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- webtoffee woocommerce pdf invoices, packing slips, delivery notes and shipping labels, woocommerce pdf invoices\, packing slips\, delivery notes and shipping labels +1 moreWordPress WooCommerce PDF Invoices plugin <= 4.7.1 - Stored Cross Site Scripting (XSS) vulnerability5.9 Medium
- themefic tourficWordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability9.1 Critical
- datafeedr woocommerce cloak affiliate linksWordPress WooCommerce Cloak Affiliate Links plugin <= 1.0.35 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- marco almeida | webdados taxonomy/term and role based discounts for woocommerceWordPress Taxonomy/Term and Role based Discounts for WooCommerce plugin <= 5.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability4.3 Medium
- really simple plugins simple sslWordPress Really Simple Security plugin <= 9.1.4 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- pddring create with codeWordPress Create with Code plugin <= 1.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- revmakx wp duplicateWordPress WP Duplicate plugin <= 1.1.6 - Broken Access Control vulnerability5.4 Medium
- linnea huxford blur textWordPress Blur Text Plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- svetoslav marinov orbisius simple noticeWordPress Orbisius Simple Notice plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- foliovision fv thoughtful commentsWordPress FV Thoughtful Comments plugin <= 0.3.5 - Broken Access Control vulnerability4.3 Medium
- pickplugins job board managerWordPress Job Board Manager plugin <= 2.1.59 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- christian leuenberg restrict anonymous accessWordPress Restrict Anonymous Access Plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- element invader elementinvader addons for elementor, elementinvader addons for elementor +1 moreWordPress ElementInvader Addons for Elementor Plugin <= 1.3.1 - Broken Access Control vulnerability4.3 Medium
- laymance technologies llc machform shortcodeWordPress MachForm Shortcode plugin <= 1.4.1 - CSRF to Stored XSS vulnerability7.1 High
- silverplugins217 build private store for woocommerceWordPress Build Private Store For Woocommerce plugin <= 1.0 - Broken Access Control vulnerability5.3 Medium
- smackcoders wp ultimate exporterWordPress Export All Posts, Products, Orders, Refunds & Users Plugin <= 2.9 - Arbitrary File Read vulnerability4.9 Medium
- wc product table woocommerce product table lite, wcproducttable woocommerce product table +1 moreWordPress WooCommerce Product Table Lite plugin <= 3.8.7 - Broken Access Control vulnerability5.3 Medium
- vikas ratudi vpsuformWordPress VForm plugin <= 3.0.5 - Broken Access Control vulnerability5.4 Medium
- aribhour linet erp-woocommerce integrationWordPress Linet ERP-Woocommerce Integration plugin <= 3.5.7 - CSRF to Broken Access Control vulnerability6.5 Medium
- optimal access kbucketWordPress KBucket plugin <= 4.1.6 - CSRF to Stored Cross-Site Scripting vulnerability7.1 High
- bplugins all embed – elementor addonsWordPress All Embed – Elementor Addons plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- epsiloncool wp fast total searchWordPress WP Fast Total Search plugin <= 1.78.258 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- patreon wordpressWordPress Patreon WordPress plugin <= 1.9.1 - Broken Access Control vulnerability6.5 Medium
- rstheme ultimate coming soon & maintenance, ultimate coming soon \& maintenance +1 moreWordPress Ultimate Coming Soon & Maintenance plugin <= 1.0.9 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- softaculous pagelayerWordPress Pagelayer plugin <= 1.9.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- david de boer paytiumWordPress Paytium plugin <= 4.4.11 - Full Path Disclosure (FPD) vulnerability5.3 Medium
- matthias wagner - falkemedia caching compatible cookie opt-in and javascriptWordPress Caching Compatible Cookie Opt-In plugin <= 0.0.10 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- vito peleg atarimWordPress Atarim plugin <= 4.0.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- js morisset jsm show post metadataWordPress JSM Show Post Metadata plugin <= 4.6.0 - Broken Access Control vulnerability4.3 Medium
- kyle phillips nested pagesWordPress Nested pages plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- bastien ho event postWordPress Event post plugin <= 5.9.7 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- icegramWordPress Icegram Engage plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- element invader elementinvader addons for elementor, elementinvader addons for elementor +1 moreWordPress ElementInvader Addons for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ninja team gdpr ccpa compliance support, ninjateam gdpr ccpa compliance \& cookie consent banner +1 moreWordPress GDPR CCPA Compliance & Cookie Consent Banner plugin <= 2.7.1 - Broken Access Control vulnerability4.3 Medium
- epsiloncool wp fast total searchWordPress WP Fast Total Search plugin <= 1.78.258 - Broken Access Control vulnerability5.4 Medium
- rstheme ultimate coming soon & maintenance, ultimate coming soon \& maintenance +1 moreWordPress Ultimate Coming Soon & Maintenance plugin <= 1.0.9 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- aa web servant 12 step meeting listWordPress 12 Step Meeting List plugin <= 3.16.5 - Sensitive Data Exposure vulnerability5.3 Medium
- awcode reviewstapWordPress ReviewsTap plugin <= 1.1.2 - CSRF to Stored Cross-Site Scripting vulnerability7.1 High
- Show moreLoading…