CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- wpexperts wp multi store locator, wpexperts.io wp multistore locator +1 moreWordPress WP Multi Store Locator Plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- pdfcrowd dev team save as pdfWordPress Save as PDF Plugin by Pdfcrowd Plugin <= 4.4.0 - PHP Object Injection vulnerability9.8 Critical
- enituretechnology small package quotes – worldwide express editionWordPress Small Package Quotes Plugin <= 5.2.17 - SQL Injection vulnerability9.3 Critical
- enituretechnology small package quotes – unishippers editionWordPress Small Package Quotes Plugin <= 2.4.8 - SQL Injection vulnerability9.3 Critical
- learndash lms, stellarwp learndash lms +1 moreWordPress LearnDash LMS Plugin <= 4.20.0.1 - Broken Access Control vulnerability5.3 Medium
- notfound admin and site enhancements (ase) proWordPress Admin and Site Enhancements (ASE) Pro Plugin <= 7.6.1.1 - Broken Access Control vulnerability4.3 Medium
- bestwebsoft google captchaWordPress reCaptcha by BestWebSoft Plugin <= 1.78 - Captcha Bypass vulnerability5.3 Medium
- codepeople music storeWordPress Music Store – WordPress eCommerce Plugin <= 1.1.19 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- boldgrid client invoicing by sprout invoicesWordPress Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress plugin <=20.8.1 - Broken Access Control vulnerability6.4 Medium
- dmitry v. (ceo of "ukr solution") print barcode labels for your woocommerce products/ordersWordPress Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin <= 3.4.10 - Broken Access Control vulnerability4.3 Medium
- davidfcarr rsvpmarkerWordPress RSVPMaker plugin <= 11.4.5 - Broken Access Control vulnerability5.3 Medium
- wisdmlabs edwiser bridgeWordPress Edwiser Bridge plugin <= 3.0.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- picuWordPress picu – Online Photo Proofing Gallery plugin <= 2.4.0 - Broken Access Control vulnerability5.3 Medium
- seedprod coming soon page, under construction & maintenance mode by seedprodWordPress Website Builder by SeedProd plugin <= 6.18.9 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- slaffik buddypress groups extrasWordPress BuddyPress Groups Extras plugin <= 3.6.10 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- stellarwp the events calendarWordPress The Events Calendar plugin <= 6.7.0 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- benjamin piwowarski paperciteWordPress PAPERCITE plugin <= 0.5.18 - Broken Access Control vulnerability5.4 Medium
- ivan chernyakov lawpress – law firm website managementWordPress LawPress plugin <= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- ulrich sossou the loopsWordPress The Loops plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- clifton griffin cgd arrange termsWordPress CGD Arrange Terms plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- nurul amin wp smart tooltipWordPress WP Smart Tooltip plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- saul morales pacheco donate visaWordPress Donate visa plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- jonathan lau cubepmWordPress CubePM plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- david f. carr rsvpmaker volunteer rolesWordPress RSVPMaker Volunteer Roles plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- blokhaus minterpressWordPress Minterpress plugin <= 1.0.5 - Arbitrary Content Deletion vulnerability6.5 Medium
- kyle phillips simple locatorWordPress Simple Locator Plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- favethemes houzezWordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability4.3 Medium
- bandido morkva ua shippingWordPress Morkva UA Shipping plugin <= 1.0.18 - Local File Inclusion vulnerability8.1 High
- eniture technology ltl freight quotes – worldwide express editionWordPress LTL Freight Quotes Plugin <= 5.0.20 - SQL Injection vulnerability9.3 Critical
- ihor kit shipping for nova poshtaWordPress Shipping for Nova Poshta plugin <= 1.19.6 - SQL Injection vulnerability9.3 Critical
- thimpress fundpressWordPress FundPress plugin <= 2.0.6 - PHP Object Injection vulnerability9.8 Critical
- bdthemes ultimate store kit elementor addonsWordPress Ultimate Store Kit Elementor Addons plugin <= 2.3.0 - Broken Access Control vulnerability4.3 Medium
- metaslider responsive slider by metasliderWordPress MetaSlider plugin <= 3.92.0 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- wp busters passwordless wp – login with your glance or fingerprintWordPress Passwordless WP – Login with your glance or fingerprint Plugin <= 1.1.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- clodeo shipdeoWordPress Shipdeo plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- red hat advanced cluster security 3Rhacs: cross-site scripting in portal8.9 High
- eura7 cmsmanagerReflected XSS in Eura7 CMSmanager5.3 Medium
uniapiPyPIuniapi version 1.0.7 contained an information harvesting script.No score- xerox workplace suiteToken stored in session storage6.5 Medium
- cesanta frozenA NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an...5.3 Medium
- cesanta frozenAn Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions...5.3 Medium
- inw krbyyyzoINW Krbyyyzo Daily Huddle Site gbo.aspx resource consumption6.7 Medium
- apache solrApache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files5.5 Medium
- apache solrApache Solr: Configset upload on Windows allows arbitrary path write-access5.4 Medium
- artlosk share buttons, unknown social share buttons for wordpress +1 moreSocial Share Buttons for WordPress <= 2.7 - Unauthenticated Image Upload & Path Traversal6.5 Medium
- crelly slider project slider, unknown crelly slider +1 moreCrelly Slider < 1.4.7 - Admin+ Stored XSS3.8 Low
- unknown wp triggers liteWP Triggers Lite <= 2.5.3 - Admin+ SQL Injection4.8 Medium
- unknown wp triggers liteWP Triggers Lite <= 2.5.3 - Reflected XSS7.1 High
- phycticio dyn business panelDyn Business Panel <= 1.0.0 - Stored XSS via CSRF7.1 High
- phycticio dyn business panelDyn Business Panel <= 1.0.0 - Reflected XSS7.1 High
- Show moreLoading…