CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- pencidesign pennewsWordPress PenNews theme < 6.7.3 - Local File Inclusion vulnerability8.1 High
- fantasticplugins woocommerce recover abandoned cartWordPress WooCommerce Recover Abandoned Cart plugin <= 24.6.0 - Arbitrary Content Deletion vulnerability7.5 High
- designthemes reservation pluginWordPress Reservation Plugin plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- wp chill passsterWordPress Passster plugin <= 4.2.19 - Sensitive Data Exposure vulnerability7.5 High
- themegoods photographyWordPress Photography theme <= 7.7.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- stylemixthemes masterstudy lms proWordPress MasterStudy LMS Pro plugin < 4.7.16 - Arbitrary Content Deletion vulnerability7.5 High
- stylemixthemes masterstudy lms proWordPress MasterStudy LMS Pro plugin < 4.7.16 - Sensitive Data Exposure vulnerability7.5 High
- stylemixthemes masterstudyWordPress Masterstudy theme < 4.8.122 - Broken Access Control vulnerability7.5 High
- tielabs jannahWordPress Jannah theme <= 7.6.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- tielabs jannahWordPress Jannah theme <= 7.6.0 - PHP Object Injection vulnerability9.8 Critical
- tielabs jannahWordPress Jannah theme <= 7.6.0 - Local File Inclusion vulnerability8.1 High
- everpress mailsterWordPress Mailster plugin < 4.1.14 - Cross Site Scripting (XSS) vulnerability7.1 High
- 8theme xstoreWordPress XStore theme < 9.6.1 - Local File Inclusion vulnerability7.5 High
- 8theme xstoreWordPress XStore theme < 9.6 - Broken Access Control vulnerability6.3 Medium
- 8theme xstoreWordPress XStore theme < 9.6.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- 8theme xstore coreWordPress XStore Core plugin < 5.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- pencidesign soledadWordPress Soledad theme <= 8.6.9 - Privilege Escalation vulnerability9.8 Critical
- ancorathemes insetWordPress Inset theme <= 1.18.0 - Local File Inclusion Vulnerability8.1 High
- matrixaddons easy invoiceWordPress Easy Invoice plugin <= 2.0.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- cridiostudio listingproWordPress ListingPro theme <= 2.9.9 - Broken Access Control vulnerability6.5 Medium
- schiocco support boardWordPress Support Board plugin < 3.8.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- crm perks wp gravity forms salesforceWordPress WP Gravity Forms Salesforce plugin <= 1.5.1 - PHP Object Injection vulnerability9.8 Critical
- crm perks wp gravity forms hubspotWordPress WP Gravity Forms HubSpot plugin <= 1.2.6 - Deserialization of untrusted data vulnerability9.8 Critical
- crm perks wp gravity forms constant contact pluginWordPress WP Gravity Forms Constant Contact plugin plugin <= 1.1.2 - Deserialization of untrusted data vulnerability9.8 Critical
- crm perks wp gravity forms zoho crm and biginWordPress WP Gravity Forms Zoho CRM and Bigin plugin <= 1.2.9 - Deserialization of untrusted data vulnerability9.8 Critical
- crm perks wp gravity forms insightlyWordPress WP Gravity Forms Insightly plugin <= 1.1.6 - Deserialization of untrusted data vulnerability9.8 Critical
- crm perks wp gravity forms freshdesk pluginWordPress WP Gravity Forms FreshDesk plugin plugin <= 1.3.5 - Deserialization of untrusted data vulnerability9.8 Critical
- saleswonder llc webinarignitionWordPress WebinarIgnition plugin <= 4.06.04 - Broken Access Control vulnerability6.5 Medium
- matt wp voting contestWordPress WP Voting Contest plugin <= 5.8 - Broken Access Control vulnerability7.5 High
- add-ons.org pdf for elementor forms + drag and drop template builderWordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability8.8 High
- add-ons.org pdf invoice builder for woocommerceWordPress PDF Invoice Builder for WooCommerce plugin <= 6.5.0 - Deserialization of untrusted data vulnerability8.8 High
- add-ons.org pdf for wpformsWordPress PDF for WPForms plugin <= 6.5.0 - Deserialization of untrusted data vulnerability8.8 High
- add-ons.org pdf for contact form 7WordPress PDF for Contact Form 7 plugin <= 6.5.0 - Deserialization of untrusted data vulnerability8.8 High
- add-ons.org pdf for gravity forms + drag and drop template builderWordPress PDF for Gravity Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability7.5 High
- bplugins parallax section blockWordPress Parallax Section block plugin <= 1.0.9 - Broken Authentication vulnerability7.1 High
- agence web eoxia - montpellier task managerWordPress Task Manager plugin <= 3.0.2 - Local File Inclusion vulnerability7.5 High
- yaycommerce yaypricingWordPress YayPricing plugin <= 3.5.3 - Broken Access Control vulnerability7.5 High
- jbhovik ray enterprise translationWordPress Ray Enterprise Translation plugin <= 1.7.1 - Local File Inclusion vulnerability7.5 High
- processby anchor smooth scrollWordPress Anchor smooth scroll plugin <= 1.0.2 - Local File Inclusion vulnerability8.1 High
- don-themes riodeWordPress Riode | Multi-Purpose WooCommerce theme <= 1.6.23 - Local File Inclusion vulnerability8.1 High
- don-themes mollaWordPress Molla - Multipurpose Responsive Shopify theme <= 1.5.13 - Arbitrary Code Execution vulnerability6.5 Medium
- thememove minimogwpWordPress MinimogWP theme <= 3.9.6 - Local File Inclusion vulnerability8.1 High
- javothemes javo coreWordPress Javo Core plugin <= 3.0.0.266 - Arbitrary Code Execution vulnerability6.5 Medium
- axiomthemes giardinoWordPress Giardino theme <= 1.1.10 - Local File Inclusion vulnerability8.1 High
- axiomthemes katelynWordPress Katelyn theme <= 1.0.10 - Local File Inclusion vulnerability8.1 High
- axiomthemes pinevaleWordPress Pinevale theme <= 1.0.14 - Local File Inclusion vulnerability8.1 High
- axiomthemes renewalWordPress Renewal theme <= 1.2.2 - Local File Inclusion vulnerability8.1 High
- axiomthemes rosalindaWordPress Rosalinda theme <= 1.2.3 - Local File Inclusion vulnerability8.1 High
- mmetrodw tplayerWordPress tPlayer plugin <= 1.2.1.6 - SQL Injection vulnerability9.3 Critical
- axiomthemes kickerWordPress Kicker theme <= 2.2.0 - Local File Inclusion vulnerability8.1 High
- Show moreLoading…