CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- totolink x5000r, x5000r firmware +1 moreTOTOLINK X5000R cstecgi.cgi snprintf os command injection5.3 Medium
- unknown wps visitor counterWPS Visitor Counter Plugin <= 1.4.8 - Reflected XSS via $_SERVER['REQUEST_URI']5.8 Medium
- saadiqbal points management system for gamification, ranks, badges, and loyalty rewards program – mycredmyCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval5.3 Medium
- ghozylab easy notify litePopup Builder <= 1.1.37 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Reset5.4 Medium
- davidanderson redux frameworkRedux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter6.4 Medium
- recorp export wordpress pages to static html & pdf — static site exportExport WP Page to Static HTML & PDF <= 4.3.4 - Unauthenticated Cookie Exposure via Log File9.8 Critical
- melodicmedia popover windowsPopover Windows <= 1.2 - Cross-Site Request Forgery to Arbitrary Popover Configuration Update4.3 Medium
- ajitdas devs crm – manage tasks, attendance and teams all togetherDevs CRM – Manage tasks, attendance and teams all together <= 1.1.8 - Unauthenticated Information Expsoure5.3 Medium
- mahethekiller header footer script adder – insert code in header, body & footerHeader Footer Script Adder – Insert Code in Header, Body & Footer <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- dugudlabs eyewear prescription formEyewear prescription form <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Category Deletion5.3 Medium
- f1logic wp to linkedin auto publishWP to LinkedIn Auto Publish <= 1.9.8 - Reflected Cross-Site Scripting via PostMessage6.1 Medium
- jayarsiech jay login & registerJAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie9.8 Critical
- webfactory login lockdown & protectionLogin Lockdown & Protection <= 2.14 - IP Block Bypass5.3 Medium
- creativthemes mavix educationMavix Education <= 1.0 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin Activation4.3 Medium
- rang501 shortcode ajaxShortcode Loader <= 1.0 - Unauthenticated Arbitrary Shortcode Execution via 'code' Parameter5.4 Medium
- yalogica mediacommander – bring folders to media, posts, and pagesMediaCommander – Bring Folders to Media, Posts, and Pages <= 2.3.1 - Missing Authorization to Authenticated (Author+) Media Folder Deletion6.5 Medium
- yithemes yith woocommerce quick viewYITH WooCommerce Quick View <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_quick_view Shortcode6.4 Medium
- sparklewpthemes kingcabsKingcabs <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parameter6.4 Medium
- corsonr easy theme optionsEasy Theme Options <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Import5.3 Medium
- ajitdas devs crm – manage tasks, attendance and teams all togetherDevs CRM – Manage tasks, attendance and teams all together <= 1.1.8 - Missing Authorization to Unauthenticated Lead Tag Update5.3 Medium
- f1logic social media auto publishSocial Media Auto Publish <= 3.6.5 - Reflected Cross-Site Scripting via PostMessage6.1 Medium
- rtcamp rtmedia for wordpress, buddypress and bbpressrtMedia for WordPress, BuddyPress and bbPress 4.7.0 - 4.7.3 - Missing Authorization to Unauthenticated Information Disclosure via handle_rest_pre_dispatch Function3.7 Low
- solutionsbysteve solutions ad managerSolutions Ad Manager <= 1.0.0 - Unauthenticated Open Redirect via 'sam-redirect-to' Parameter4.7 Medium
- payamito افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerceافزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce <= 1.3.5 - Unauthenticated Time-Based Blind SQL Injection7.5 High
- gallerycreator mixed media gallery blocksGallery Blocks with Lightbox <= 3.3.0 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Modification4.3 Medium
- blakelong custom framesCustom Frames <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Parameter6.4 Medium
- unitecms doubly – cross domain copy paste for wordpressDoubly <= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Import8.8 High
- nenad-obradovic extensive vc addons for wpbakery page builderExtensive VC Addons for WPBakery page builder <= 1.9.1 - Unauthenticated Local File Inclusion via 'shortcode_name' Parameter8.1 High
- owais4377 lucky draw contestsLucky Draw Contests <= 4.2 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- wp3d model import viewerWP3D Model Import Viewer <= 1.0.7 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- extend themes colibri page builderColibri Page Builder <= 1.0.335 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- userbackUserback <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Plugin's Configuration Exposure4.3 Medium
- pcantoni annuncifunebriAnnunciFunebri Impresa <= 4.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Deletion4.3 Medium
- franciscopalacios postem ipsumPostem Ipsum <= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation in postem_ipsum_generate_users8.8 High
- a3rev a3 lazy loada3 Lazy Load <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- themeregion quick testimonialsQuick Testimonials <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- dugudlabs eyewear prescription formEyewear prescription form <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Product Creation5.3 Medium
- melodicmedia popover windowsPopover Windows <= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX Actions4.3 Medium
- emplibot – ai content writer with keyword research, infographics, and linking | seo optimized | fully automatedEmplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated <= 1.0.9 - Authenticated (Admin+) Server-Side Request Forgery4.4 Medium
- ays-pro image slider by ays- responsive slider and carouselImage Slider by Ays- Responsive Slider and Carousel <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion4.3 Medium
- uxl design import/export – styles, templates, template parts and patternsDesign Import/Export <= 2.2 - Authenticated (Administrator+) SQL Injection via XML File Import4.9 Medium
- wpdirectorykit wp directory kitWP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection7.5 High
- htplugins ht slider for elementorHT Slider for Elementor <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- webdevstudios custom post type uiCustom Post Type UI <= 1.18.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'label' Import Parameter4.4 Medium
- edge22 generateblocksGenerateBlocks <= 2.1.2 - Authenticated (Contributor+) Information Exposure via Metadata4.3 Medium
- villatheme happy – helpdesk support ticket systemHAPPY – Helpdesk Support Ticket System <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Reply4.3 Medium
- aaron13100 404 solution404 Solution <= 3.1.0 - Authenticated (Admin+) SQL Injection via 'filterText' Parameter4.9 Medium
- emarket-design employee spotlight – team member showcase & meet the team pluginEmployee Spotlight – Team Member Showcase & Meet the Team Plugin <= 5.1.3 - Missing Authorization to Authenticated (Subscriber+) Tracking Opt-In/Opt-Out Modification4.3 Medium
- openplc v3 v3OpenPLC_V3 Cross-Site Request Forgery7.0 High
- angeljudesuarez covid tracking systemitsourcecode COVID Tracking System page sql injection6.9 Medium
- Show moreLoading…