CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- susantabeura viglink spotlight by shortcodeVigLink SpotLight By ShortCode <= 1.0.a - Authenticated (Contributor+) Stored Cross-Site Scripting via 'float' Shortcode Attribute6.4 Medium
- ice00 newstatpressNewStatPress <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- frapesce rabbit holeRabbit Hole <= 1.1 - Cross-Site Request Forgery to Settings Reset4.3 Medium
- alexdtn simple al sliderSimple AL Slider <= 1.2.10 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']6.1 Medium
- ladislavsoukupgmailcom ls google map routerLS Google Map Router <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- zealopensource accept stripe payments using contact form 7Accept Stripe Payments Using Contact Form 7 <= 3.1 - Reflected Cross-Site Scripting via failure_message6.1 Medium
- sgcoskey simple post listingSimple post listing <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- justdave upcoming for calendlyUpcoming for Calendly <= 1.2.4 - Cross-Site Request Forgery to Settings Update4.3 Medium
- blazethemes blaze demo importerBlaze Demo Importer 1.0.0 - 1.0.13 - Missing Authorization to Authenticated (Subscriber+) Database Reset and File Deletion8.1 High
- wpdive better addons for elementorBetter Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widget6.4 Medium
- codnloc purchase and expense managerPurchase and Expense Manager <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion4.3 Medium
- falselight fx currency converterFX Currency Converter <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- klemmkeil divelogs widgetDivelogs Widget <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- imran3229 zenost shortcodesZenost Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- markutos987 filter plus – product filter & wordpress filterProduct Filtering by Categories, Tags, Price Range for WooCommerce <= 1.1.6 - Missing Authorization to Unauthenticated Plugin Settings Modification5.3 Medium
- pandikamal03 category dropdown listCategory Dropdown List <= 1.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']6.1 Medium
- tekafran animated pixel marquee creatorAnimated Pixel Marquee Creator <= 1.0.0 - Cross-Site Request Forgery via 'marquee' Parameter4.3 Medium
- lazycoders lazytasks – project & task management with collaboration, kanban and gantt chartLazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart <= 1.2.29 - Missing Authorization to Uanuthenticated Privilege Escalation9.8 Critical
- thewellnessway tww protein calculatorTWW Protein Calculator <= 1.0.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Header' Setting4.4 Medium
- ysh wp flotWP Flot <= 0.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- thobian 评论小秘书评论小秘书 <= 1.3.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']6.1 Medium
- sonlamtn200 paypal payment shortcodePaypal Payment Shortcode <= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttom_image' Shortcode Attribute6.4 Medium
- subhransu-sekhar data visualizerData Visualizer <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- jeremybmerrill debatemasterDebateMaster <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Color Options via 'debate' Shortcode4.4 Medium
- buntegiraffe hide email addressHide Email Address <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- davidkeen gpxpressGPXpress <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- bobvanoorschot bukazu search widgetBUKAZU Search widget <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode' Shortcode Attribute6.4 Medium
- wpusermanager wp user manager – user profile builder & membershipWP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter6.8 Medium
- darendev simple theme changerSimple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX Actions4.3 Medium
- premmerce wishlist for woocommercePremmerce Wishlist for WooCommerce <= 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wishlist Deletion5.3 Medium
- truefy embedTruefy Embed <= 1.1.0 - Cross-Site Request Forgery to 'truefy_embed_options_update' Settings Update4.3 Medium
- boldthemes bold timeline liteBold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in 'bold_timeline_group' Shortcode6.4 Medium
- eurisko reviews sortedReviews Sorted <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'space' Shortcode Attribute6.4 Medium
- doubledome resource library for logged in usersResource Library for Logged In Users <= 1.5 - Cross-Site Request Forgery to Multiple Administrative Actions4.3 Medium
- developerke kirim.email woocommerce integrationKirim.Email WooCommerce Integration <= 1.2.9 - Cross-Site Request Forgery to Settings Update4.3 Medium
- qrevo easy map creatorEasy Map Creator <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- imaqpress imaq coreIMAQ Core <= 1.2.1 - Cross-Site Request Forgery to URL Structure Update4.3 Medium
- premmerce brands for woocommercePremmerce Brands for WooCommerce <= 1.2.13 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings Update4.3 Medium
- ludwigyou wpmastertoolkit (wpmtk) – all in one pluginWPMasterToolKit (WPMTK) <= 2.13.0 - Authenticated (Contributor+) Code Injection5.3 Medium
- themebon app landing template blocks for wpbakery (visual composer) page builderApp Landing Template Blocks for WPBakery Page Builder <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- rodgerholl visitor logic liteVisitor Logic Lite <= 1.0.3 - Unauthenticated PHP Object Injection via 'lpblocks' Cookie8.1 High
- octagonsimon coding blocksCoding Blocks <= 1.1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- lesion wpgancioWPGancio <= 1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- apprhyme url media uploaderURL Media Uploader <= 1.0.1 - Missing Authorization to Authenticated (Contributor+) Safe File Upload4.3 Medium
- infility globalInfility Global <= 2.14.42 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- tharkun69 player leaderboardPlayer Leaderboard 1.0.0 - 1.0.2 - Authenticated (Contributor+) Local File Inclusion8.8 High
- sh1zen multi uploader for gravity formsMulti Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File Deletion9.8 Critical
- foxtheme foxtool all-in-one: contact chat button, custom login, media optimize imagesFoxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.2 - Cross-Site Request Forgery to Google OAuth Connection4.3 Medium
- wasiul99 like dislike votingLike DisLike Voting <= 1.0.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']6.1 Medium
- jonahsc simplyconvertSimplyConvert <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'simplyconvert_hash' Option4.4 Medium
- Show moreLoading…