CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- integrationdevpaytm paytm payment donation, paytm payment donation +1 moreWordPress Paytm – Donation Plugin plugin <= 2.3.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- algol.plus advanced dynamic pricing for woocommerceWordPress Advanced Dynamic Pricing for WooCommerce Plugin <= 4.9.0 -Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- portone 우커머스 결제WordPress PORTONE 우커머스 결제 Plugin <= 3.2.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- milan petrovic gd mail queueWordPress GD Mail Queue Plugin <= 4.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- dmitry v. (ceo of "ukr solution") barcode generator for woocommerceWordPress Barcode Generator for WooCommerce plugin <= 2.0.2 - Sensitive Data Exposure vulnerability6.5 Medium
- themeglow cleanup – directory listing & classifieds wordpress pluginWordPress Cleanup – Directory Listing & Classifieds plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- awesometogi awesome event bookingWordPress Awesome Event Booking plugin <= 2.7.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- oneteamsoftware radio buttons and swatches for woocommerceWordPress Radio Buttons and Swatches for WooCommerce plugin <= 1.1.20 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- mahbubur rahman post metaWordPress Post Meta plugin <= 1.0.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- skt themes donation, sonalsinha21 skt donation +1 moreWordPress SKT Donation plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- dinamiko dportfolioWordPress DPortfolio plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- gavin affiliate tools việt namWordPress Affiliate Tools Việt Nam plugin <= 0.3.17 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- fabio savina wp opensearchWordPress WP OpenSearch plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- grafeon notifikácie.skWordPress Notifikácie.sk plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- jablonczay scroll stylerWordPress Scroll Styler plugin <= 1.1 - CSRF to Stored XSS vulnerability7.1 High
- alessandro piconi internal link builderWordPress Internal Link Builder plugin <= 1.0 - CSRF to Stored XSS vulnerability7.1 High
- codegearthemes designerWordPress Designer plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- brainvireinfo dynamic url seoWordPress Dynamic URL SEO plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- james andrews full circleWordPress Full Circle plugin <= 0.5.7.8 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- ninos flashcounterWordPress FlashCounter plugin <= 1.1.8 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- bhaskar dhote post carousel sliderWordPress Post Carousel Slider plugin <= 2.0.1 - CSRF to Stored XSS vulnerability7.1 High
- operationsissuu issuu panelWordPress Issuu Panel plugin <= 2.1.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- codebard help deskWordPress CodeBard Help Desk plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- magepeopleteam booking and rental managerWordPress WpRently | WordPress plugin plugin <= 2.2.1 - Broken Access Control vulnerability5.8 Medium
- faaiq pretty urlWordPress Pretty Url Plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- mohammad hossein aghanabi hide login+WordPress Hide Login+ plugin <= 3.5.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- bryan shanaver @ fiftyandfifty.org cloudflare(r) cache purgeWordPress CloudFlare(R) Cache Purge plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- mgplugin emi calculatorWordPress EMI Calculator plugin <= 1.1 - Settings Change vulnerability6.5 Medium
- brandexponents oshine modulesWordPress Oshine Modules plugin < 3.3.6 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- samsk wp datatableWP DataTable <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter6.4 Medium
- sonaar mp3 audio player – music player, podcast player & radio by sonaarMP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Podcast RSS Feed6.4 Medium
- zia-imtiaz login page styler – custom wordpress login page customizer & securityCustom Login Page Styler <= 7.1.1 - Missing Authorization to Authenticated (Subsciber+) Log Deletion and Session Termination4.3 Medium
- webfactory order export for woocommerceOrder Export for WooCommerce <= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory5.9 Medium
- tepelstreel a5 custom login pageA5 Custom Login Page <= 2.8.1 - Reflected XSS6.1 Medium
- etemplates ect home page productsECT Home Page Products <= 1.9 - Reflected XSS6.1 Medium
- dtelepathy slidedeck 1 lite content sliderSlideDeck 1 Lite Content Slider <= 1.4.8 - Reflected XSS6.1 Medium
- samwilson tabulateTabulate <= 2.10.3 - Reflected XSS6.1 Medium
- marvinlabs user messagesUser Messages <= 1.2.4 - Reflected XSS6.1 Medium
- parisholley fantastic elasticsearchFantastic Elasticsearch <= 4.1.0 - Reflected XSS6.1 Medium
- pragmasoftwares google map professional, unknown wordpress google map professional (map in your language) +1 moreGoogle Map Professional <= 1.0 - Reflected XSS6.1 Medium
- unknown privacy policy geniusPolicy Genius <= 2.0.4 - Reflected XSS6.1 Medium
- caspie fast tubeFast Tube <= 2.3.1 - Reflected XSS6.1 Medium
- phd38 wp mediataggerWP MediaTagger <= 4.1.1 - Reflected XSS6.1 Medium
- phd38 wp mediataggerWP MediaTagger <= 4.1.1 - Contributor+ Stored XSS5.4 Medium
- ashamil opsi israel domestic shipmentsWoo UPS Pickup <= 2.6.3 - Reflected XSS6.1 Medium
- unknown zalomení, honzaskypala zalomeni +1 moreZalomení <= 1.5 - Admin+ Stored XSS4.8 Medium
- shahjahan jewel ninja tablesNinja Tables < 5.0.17 - Admin+ Stored XSS5.4 Medium
- canvasflow, unknown canvasflow for wordpress +1 moreCanvasFlow <= 1.5.5 - Reflected XSS6.1 Medium
- cloud foundry uaaCVE-2025-22216 UAA Missing Zone Validation5.4 Medium
- anzia ni sales commission for woocommerceNi Sales Commission For WooCommerce <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Commission Update4.3 Medium
- Show moreLoading…