CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- wpwax directoristWordPress Directorist plugin <= 8.6.6 - Open Redirection vulnerability4.7 Medium
- wp-experts.in protect wp adminWordPress Protect WP Admin plugin <= 4.1 - Broken Access Control vulnerability4.3 Medium
- emarket-design request a quoteWordPress Request a Quote plugin <= 2.5.3 - Broken Access Control vulnerability4.3 Medium
- edmon.parker read more & accordionWordPress Read More & Accordion plugin <= 3.5.5.1 - Broken Access Control vulnerability4.3 Medium
- netopsae accessibility by audioeyeWordPress Accessibility by AudioEye plugin <= 1.0.49 - Broken Access Control vulnerability4.3 Medium
- ryanpcmcquen import external attachmentsWordPress Import external attachments plugin <= 1.5.12 - Broken Access Control vulnerability4.3 Medium
- codexpert, inc restrict elementor widgets, columns and sectionsWordPress Restrict Elementor Widgets, Columns and Sections plugin <= 1.12 - Broken Access Control vulnerability4.3 Medium
- e-plugins directory proWordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability4.3 Medium
- merv barrett easy property listingsWordPress Easy Property Listings plugin <= 3.5.22 - Broken Access Control vulnerability4.3 Medium
- imtiaz rayhan wp coupons and dealsWordPress WP Coupons and Deals plugin <= 3.2.4 - Broken Access Control vulnerability4.3 Medium
- freshchatWordPress Freshchat plugin <= 2.3.4 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- yoav farhi rtl testerWordPress RTL Tester plugin <= 1.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- nicolaskulka wps bidouilleWordPress WPS Bidouille plugin <= 1.33.1 - Broken Access Control vulnerability4.3 Medium
- aerin quick interest sliderWordPress Quick Interest Slider plugin <= 3.1.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- astoundify listifyWordPress Listify theme <= 3.2.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- themenectar salient coreWordPress Salient Core plugin <= 3.0.8 - Broken Access Control vulnerability4.3 Medium
- loopus wp attractive donations system - easy stripe & paypal donationsWordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- creativemindssolutions cm on demand search and replaceWordPress CM On Demand Search And Replace plugin <= 1.5.5 - Broken Access Control vulnerability4.3 Medium
- sonalsinha21 skt page builderWordPress SKT Page Builder plugin <= 4.9 - Broken Access Control vulnerability4.3 Medium
- wc lovers wcfm – frontend manager for woocommerceWordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.7.24 - Broken Access Control vulnerability2.7 Low
- shinetheme traveler option treeWordPress Traveler Option Tree plugin <= 2.8 - Sensitive Data Exposure vulnerability2.7 Low
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation5.3 Medium
- radykal fancy product designerFancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter5.9 Medium
- seiko epson corporation web configStack-based buffer overflow vulnerability exists in SEIKO EPSON Web Config. Specially crafted...8.6 High
- hcl software devops deploy, hcltechsw hcl devops deploy +1 moreHCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information5.9 Medium
- dokan pro, wedevs dokan pro +1 moredokan pro <= 4.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure5.3 Medium
- themeisle auto featured image (auto post thumbnail)Auto Featured Image <= 4.2.1 - Missing Authorization to Authenticated (Contributor+) Post Thumbnail Modification4.3 Medium
- advantech susiAn Improper Access Control vulnerability in Advantech SUSI driver (susi.sys) allows attackers to...8.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.11 +1 moreKeycloak: keycloak idor in realm client creating/deleting6.0 Medium
- inaba denki sangyo co., ltd. choco tei watcher mini (ib-mct001), inaba ib-mct001 firmware +1 moreCHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper check for unusual or...6.9 Medium
- inaba denki sangyo co., ltd. choco tei watcher mini (ib-mct001), inaba ib-mct001 firmware +1 moreCHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper restriction of rendered UI...5.1 Medium
- inaba denki sangyo co., ltd. choco tei watcher mini (ib-mct001), inaba ib-mct001 firmware +1 moreCHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper check for unusual or...8.7 High
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure5.3 Medium
- ningyuanda tc155, shenzhenningyuandatechnology tc155 firmware +1 moreNingyuanda TC155 ONVIF PTZ Control device_service access control5.3 Medium
- ningyuanda tc155, shenzhenningyuandatechnology tc155 firmware +1 moreNingyuanda TC155 ONVIF Device Management Service device_service access control5.3 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero8.1 High
- qnap qts, quts hero +1 moreQTS, QuTS hero6.6 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero8.1 High
- qnap qts, quts hero +1 moreQTS, QuTS hero5.2 Medium
- ningyuanda tc155, shenzhenningyuandatechnology tc155 firmware +1 moreNingyuanda TC155 RTSP Service denial of service5.3 Medium
- ningyuanda tc155, shenzhenningyuandatechnology tc155 firmware +1 moreNingyuanda TC155 RTSP Live Video Stream Endpoint improper authentication5.3 Medium
- parse-community parse-serverParse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables5.3 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM has SQL Injection in Event Editor via `EN_tyid` Parameter caused by an Incomplete Fix7.2 High
- churchcrm, churchcrm crm +1 moreChurchCRM has plaintext password return in response6.9 Medium
- altcha-org altcha-libALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay6.5 Medium
- thinkinai deepchatMermaid XSS vulnerability leads to Remote Code Execution9.7 Critical
- alasca yaookInitialization of a Resource with an Insecure Default in YAOOK6.5 Medium
- freepbx tts, sangoma freepbx +1 moreAuthenticated SQL Injection in FreePBX tts (Text To Speech) module8.6 High
- flarum framework, sangoma freepbx +1 moreAuthenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation5.7 Medium
- c4illin convertxConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code Execution8.8 High
- Show moreLoading…