CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- hogash kallyasWordPress KALLYAS theme < 4.25.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- arscode ninja popupsWordPress Ninja Popups plugin <= 4.7.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- hiroaki miyashita custom field templateWordPress Custom Field Template plugin <= 2.7.6 - Sensitive Data Exposure vulnerability4.3 Medium
- roxnor wp ultimate reviewWordPress Wp Ultimate Review plugin <= 2.3.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bestwebsoft contact form by bestwebsoftWordPress Contact Form by BestWebSoft plugin <= 4.3.6 - Broken Access Control vulnerability4.3 Medium
- liton arefin master addons for elementorWordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- expresstech systems quiz and survey masterWordPress Quiz And Survey Master plugin <= 10.3.2 - Broken Access Control vulnerability5.3 Medium
- gallerycreator simply galleryWordPress SimpLy Gallery plugin <= 3.3.2.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- sizam rehub frameworkWordPress REHub Framework plugin < 19.9.9.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cridiostudio listingpro lead formWordPress ListingPro Lead Form plugin <= 1.0.7 - Broken Access Control vulnerability5.3 Medium
- cridiostudio listingpro lead formWordPress ListingPro Lead Form plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cridiostudio listingproWordPress ListingPro theme <= 2.9.9 - Broken Access Control vulnerability5.3 Medium
- cridiostudio listingproWordPress ListingPro plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- averta master slider proWordPress Master Slider Pro plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- xpro elementor addonsWordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themeum tutor lms elementor addonsWordPress Tutor LMS Elementor Addons plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- dfdevelopment ronneby theme coreWordPress Ronneby Theme Core plugin <= 1.5.68 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- dfdevelopment ronneby theme coreWordPress Ronneby Theme Core plugin <= 1.5.68 - Local File Inclusion vulnerability7.5 High
- vibethemes wplms, wordpress learning management system +1 moreWordPress WPLMS plugin <= 1.9.9.5.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- steve truman page view countWordPress Page View Count plugin <= 2.9.0 - Settings Change vulnerability5.4 Medium
- riyadh ahmed make section & column clickable for elementorWordPress Make Section & Column Clickable For Elementor plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- saad iqbal new user approveWordPress New User Approve plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- hclsoftware travelerWordPress Traveler theme <= 3.2.6 - Broken Access Control vulnerability5.3 Medium
- xagio seo seoWordPress Xagio SEO plugin <= 7.1.0.37 - Broken Access Control vulnerability4.3 Medium
- tychesoftwares order delivery date for woocommerceWordPress Order Delivery Date for WooCommerce plugin <= 4.3.1 - Broken Access Control vulnerability5.4 Medium
- easy payment payment gateway for paypal on woocommerceWordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.0.53 - Broken Access Control vulnerability5.3 Medium
- paysera woocommerce payment gateway - payseraWordPress WooCommerce Payment Gateway – Paysera plugin <= 3.10.0 - Broken Access Control vulnerability4.3 Medium
- thimpress wp hotel bookingWordPress WP Hotel Booking plugin <= 2.2.7 - Sensitive Data Exposure vulnerability4.3 Medium
- thimpress wp hotel bookingWordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- thimpress wp hotel bookingWordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- themesinflow hercules coreWordPress Hercules Core plugin <= 7.4 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- yuvalo wp google analytics eventsWordPress WP Google Analytics Events plugin <= 2.8.2 - Sensitive Data Exposure vulnerability5.3 Medium
- wedevs wp erpWordPress WP ERP plugin <= 1.16.7 - Broken Access Control vulnerability5.3 Medium
- metagauss eventprimeWordPress EventPrime plugin <= 4.2.4.1 - Sensitive Data Exposure vulnerability4.3 Medium
- metagauss eventprimeWordPress EventPrime plugin <= 4.2.4.1 - Broken Access Control vulnerability4.3 Medium
- fuelthemes north - required pluginWordPress North - Required Plugin plugin <= 1.4.2 - Local File Inclusion vulnerability7.5 High
- themezaa litho addonsWordPress Litho Addons plugin <= 3.5 - Broken Access Control vulnerability5.4 Medium
- levelfourdevelopment wp easycartWordPress WP EasyCart plugin <= 5.8.11 - Sensitive Data Exposure vulnerability5.3 Medium
- code amp custom layouts – post + product grids made easyWordPress Custom Layouts – Post + Product grids made easy plugin <= 1.4.12 - Broken Access Control vulnerability4.3 Medium
- multiparcels shipping for woocommerceWordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.12 - Broken Access Control vulnerability4.3 Medium
- wp messiah ai copilotWordPress WP AI CoPilot plugin <= 1.2.7 - Sensitive Data Exposure vulnerability4.3 Medium
- rainafarai notification for telegramWordPress Notification for Telegram plugin <= 3.5.1 - Broken Access Control vulnerability4.3 Medium
- flashyapp wp flashy marketing automationWordPress WP Flashy Marketing Automation plugin <= 2.0.8 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- jk social photo fetcherWordPress Social Photo Fetcher plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- alex prokopenko / justcoded just tinymce custom stylesWordPress Just TinyMCE Custom Styles plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- eupago gateway for woocommerceWordPress Eupago Gateway For Woocommerce plugin <= 4.7.1 - Broken Access Control vulnerability5.3 Medium
- gravitec.net - web push notifications – web push notificationsWordPress Gravitec.net – Web Push Notifications plugin <= 2.9.17 - Broken Access Control vulnerability4.3 Medium
- ergonet cacheWordPress Ergonet Cache plugin <= 1.0.13 - Broken Access Control vulnerability4.3 Medium
- valerio monti auto alt textWordPress Auto Alt Text plugin <= 2.5.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- evan herman post clonerWordPress Post Cloner plugin <= 1.0.0 - Broken Access Control vulnerability5.3 Medium
- Show moreLoading…