CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- thememove edumallWordPress EduMall theme <= 4.4.7 - Local File Inclusion vulnerability7.5 High
- lambertgroup lbg zoominoutsliderWordPress LBG Zoominoutslider plugin <= 5.4.4 - SQL Injection vulnerability8.5 High
- themefic hydra bookingWordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerability8.5 High
- lambertgroup countdown with image or video backgroundWordPress CountDown With Image or Video Background plugin <= 1.5 - SQL Injection vulnerability8.5 High
- lambertgroup xpromoterWordPress xPromoter plugin <= 1.3.4 - SQL Injection vulnerability8.5 High
- stefano lissa newsletterWordPress Newsletter plugin <= 9.0.9 - SQL Injection vulnerability7.6 High
- lmpixels kergeWordPress Kerge theme <= 4.1.3 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- barn2 plugins document library liteWordPress Document Library Lite plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- barn2 plugins document library liteWordPress Document Library Lite plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- osama.esh wp visitor statistics (real time traffic)WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bob watu quizWordPress Watu Quiz plugin <= 3.4.5 - Broken Access Control vulnerability6.5 Medium
- favethemes homey coreWordPress Homey Core plugin <= 2.4.3 - Broken Access Control vulnerability5.3 Medium
- aioseo plugin team broken link checkerWordPress Broken Link Checker plugin <= 1.2.6 - SQL Injection vulnerability7.6 High
- wpzoom addons for elementorWordPress WPZOOM Addons for Elementor plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- syed balkhi all in one seo packWordPress All In One SEO Pack plugin <= 4.9.1 - SQL Injection vulnerability8.5 High
- sendpulse email marketing newsletterWordPress SendPulse Email Marketing Newsletter plugin <= 2.2.1 - Sensitive Data Exposure vulnerability4.3 Medium
- templateinvaders ti woocommerce wishlistWordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerability5.3 Medium
- gal dubinski stars testimonialsWordPress Stars Testimonials plugin <= 3.3.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- merkulove lottierWordPress Lottier plugin <= 1.1.1 - Broken Access Control vulnerability5.4 Medium
- merkulove lottier for elementorWordPress Lottier for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability5.4 Medium
- merkulove lottier for wpbakeryWordPress Lottier for WPBakery plugin <= 1.1.7 - Broken Access Control vulnerability5.4 Medium
- merkulove laserWordPress Laser plugin <= 1.1.1 - Broken Access Control vulnerability5.4 Medium
- merkulove masker for elementorWordPress Masker for Elementor plugin <= 1.1.4 - Broken Access Control vulnerability5.4 Medium
- merkulove spoter for elementorWordPress Spoter for Elementor plugin <= 1.04 - Broken Access Control vulnerability5.4 Medium
- merkulove grider for elementorWordPress Grider for Elementor plugin <= 1.0.8 - Broken Access Control vulnerability5.4 Medium
- merkulove coder for elementorWordPress Coder for Elementor plugin <= 1.0.13 - Broken Access Control vulnerability5.4 Medium
- ninjateam filebird proWordPress FileBird Pro plugin <= 6.5.1 - Broken Access Control vulnerability5.4 Medium
- wp legal pages cookie notice for gdpr, ccpa & eprivacy consentWordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.7 - Broken Access Control vulnerability5.3 Medium
- fapi business s.r.o. memberWordPress FAPI Member plugin <= 2.2.30 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- yaadsarig yaad sarig payment gateway for wcWordPress Yaad Sarig Payment Gateway For WC plugin <= 2.2.11 - Broken Access Control vulnerability5.3 Medium
- etruel wp views counterWordPress WP Views Counter plugin <= 2.1.2 - Broken Access Control vulnerability5.3 Medium
- wppochipp pochippWordPress Pochipp plugin <= 1.18.0 - Broken Access Control vulnerability5.3 Medium
- brevo sendinblue for woocommerceWordPress Sendinblue for WooCommerce plugin <= 4.0.49 - Broken Access Control vulnerability5.3 Medium
- g5theme essential real estateWordPress Essential Real Estate plugin <= 5.3.2 - Broken Access Control vulnerability5.3 Medium
- wowpress.host fix media libraryWordPress Fix Media Library plugin <= 2.0 - Sensitive Data Exposure vulnerability5.3 Medium
- nitesh ultimate auctionWordPress Ultimate Auction plugin <= 4.3.3 - Sensitive Data Exposure vulnerability5.3 Medium
- zeen101 leaky paywallWordPress Leaky Paywall plugin <= 4.22.6 - Broken Access Control vulnerability5.3 Medium
- design stylish price listWordPress Stylish Price List plugin <= 7.2.2 - Broken Access Control vulnerability5.3 Medium
- siteground securityWordPress SiteGround Security plugin <= 1.5.8 - Broken Access Control vulnerability5.3 Medium
- catfoldersWordPress CatFolders plugin <= 2.5.3 - Broken Access Control vulnerability5.3 Medium
- wp compress for mainwpWordPress WP Compress for MainWP plugin <= 6.50.17 - Broken Access Control vulnerability5.3 Medium
- onpay.io for woocommerceWordPress OnPay.io for WooCommerce plugin <= 1.0.47 - Broken Access Control vulnerability5.3 Medium
- syed balkhi feeds for youtubeWordPress Feeds for YouTube plugin <= 2.4.0 - Broken Access Control vulnerability5.3 Medium
- theme-fusion avadaWordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability5.3 Medium
- colabrio norebro extraWordPress Norebro Extra plugin <= 1.6.8 - Content Injection vulnerability5.3 Medium
- auctollo google xml sitemapsWordPress Google XML Sitemaps plugin <= 4.1.22 - Broken Access Control vulnerability5.3 Medium
- wc lovers wcfm marketplaceWordPress WCFM Marketplace plugin <= 3.7.1 - Broken Access Control vulnerability4.9 Medium
- strategy11 team business directoryWordPress Business Directory plugin <= 6.4.19 - Broken Access Control vulnerability4.9 Medium
- wordpress.org health check & troubleshootingWordPress Health Check & Troubleshooting plugin <= 1.7.1 - Path Traversal vulnerability4.9 Medium
- azzaroco ultimate learning proWordPress Ultimate Learning Pro plugin <= 3.9.3 - Arbitrary Content Deletion vulnerability4.9 Medium
- Show moreLoading…