CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreHTML injection in Asset List in Guardian/CMC before 25.5.05.3 Medium
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreStored Cross-Site Scripting (XSS) in Reports in Guardian/CMC before 25.5.07.1 High
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreHTML injection in in Time Machine functionality in Guardian/CMC before 25.5.02.3 Low
- wpmudev hummingbird performance – cache & page speed optimization for core web vitals | critical css | minify css | defer css javascript | cdnHummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File7.5 High
- realmag777 husky – products filter professional for woocommerceHUSKY – Products Filter Professional for WooCommerce <= 1.3.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_subscr'4.3 Medium
- listingthemes sweet energy efficiencySweet Energy Efficiency <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Graph Deletion4.3 Medium
- bdthemes prime slider – addons for elementorPrime Slider – Addons for Elementor <= 4.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery4.3 Medium
- govee h6056Gaining remote control over Govee devices9.3 Critical
- sonicwall sma1000, sma1000 appliance, sma6200 firmware +4 more +6 moreA local privilege escalation vulnerability due to insufficient authorization in the SonicWall...6.6 Medium
- kraft plugins demo importer plusDemo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation8.8 High
- daggerhart openid connect generic clientOpenID Connect Generic Client <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- smub photo gallery, sliders, proofing and themes – nextgen galleryPhoto Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'8.8 High
buildahTuxCare,buildah-testsTuxCare +1 moreUpdate of buildahNo score- checkmkInsufficient permission validation when showing agent information6.3 Medium
- m-files serverImproper access validation in M-Files Server5.3 Medium
- wedevs wp erpWordPress WP ERP plugin <= 1.16.6 - Sensitive Data Exposure vulnerability6.5 Medium
- bob hostelWordPress Hostel plugin <= 1.1.5.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- boldgrid sprout clientsWordPress Sprout Clients plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- ays pro easy formWordPress Easy Form plugin <= 2.7.8 - Broken Access Control vulnerability7.5 High
- userelements ultimate member widgets for elementorWordPress Ultimate Member Widgets for Elementor plugin <= 2.3 - Sensitive Data Exposure vulnerability7.5 High
- anton vanyukov offload, ai & optimize with cloudflare imagesWordPress Offload, AI & Optimize with Cloudflare Images plugin <= 1.9.5 - Broken Access Control vulnerability6.5 Medium
- foliovision fv antispamWordPress FV Antispam plugin <= 2.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- magnigenie restropressWordPress RestroPress plugin <= 3.2.3.5 - Broken Access Control vulnerability6.5 Medium
- property hive propertyhiveWordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerability7.5 High
- jetmonsters hotel booking liteWordPress Hotel Booking Lite plugin <= 5.2.3 - Remote Code Execution (RCE) vulnerability9.1 Critical
- cozmoslabs wp webhooksWordPress WP Webhooks plugin <= 3.3.8 - Arbitrary File Upload vulnerability9.0 Critical
- tomdever wpforo forumWordPress wpForo Forum plugin <= 2.4.10 - Broken Access Control vulnerability7.5 High
- instawp connectWordPress InstaWP Connect plugin <= 0.1.1.9 - Broken Access Control vulnerability6.5 Medium
- thimpress learnpressWordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerability7.5 High
- cridiostudio listingproWordPress ListingPro theme < 2.9.10 - Broken Access Control vulnerability7.1 High
- cridiostudio listingproWordPress ListingPro theme < 2.9.10 - Local File Inclusion vulnerability8.1 High
- cridiostudio listingproWordPress ListingPro theme < 2.9.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- mahmudul hasan arif wp social ninjaWordPress WP Social Ninja plugin <= 3.20.1 - Broken Access Control vulnerability6.5 Medium
- stylemixthemes motorsWordPress Motors theme <= 5.6.81 - Arbitrary File Upload vulnerability9.9 Critical
- hclsoftware travelerWordPress Traveler theme < 3.2.6 - Local File Inclusion vulnerability8.1 High
- hclsoftware travelerWordPress Traveler theme < 3.2.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- hclsoftware travelerWordPress Traveler theme < 3.2.6 - SQL Injection vulnerability8.5 High
- syed balkhi all in one seo packWordPress All In One SEO Pack plugin <= 4.8.6.1 - Sensitive Data Exposure vulnerability6.5 Medium
- getresponse email marketing for wordpress by getresponse officialWordPress Email marketing for WordPress by GetResponse Official plugin <= 1.5.3 - Broken Access Control vulnerability6.5 Medium
- getresponse email marketing for wordpress by getresponse officialWordPress Email marketing for WordPress by GetResponse Official plugin <= 1.5.3 - Sensitive Data Exposure vulnerability6.5 Medium
- masteriyo - lmsWordPress Masteriyo - LMS plugin <= 2.0.3 - Sensitive Data Exposure vulnerability6.5 Medium
- arraytics timeticsWordPress Timetics plugin <= 1.0.44 - Broken Access Control vulnerability7.5 High
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager plugin <= 2.5.4 - PHP Object Injection vulnerability8.8 High
- marco milesi anac xml bandi di garaWordPress ANAC XML Bandi di Gara plugin <= 7.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpweb follow my blog postWordPress Follow My Blog Post plugin <= 2.3.9 - Sensitive Data Exposure vulnerability7.5 High
- boldthemes codiqaWordPress Codiqa theme < 1.2.8 - PHP Object Injection vulnerability9.8 Critical
- redefiningtheweb wordpress contact form 7 pdf, google sheet & databaseWordPress WordPress Contact Form 7 PDF, Google Sheet & Database plugin <= 3.0.0 - Arbitrary File Upload vulnerability9.9 Critical
- wp chill filrWordPress Filr plugin <= 1.2.10 - Arbitrary File Deletion vulnerability7.7 High
- boldgrid client invoicing by sprout invoicesWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerability9.8 Critical
- colabrio stockie extraWordPress Stockie Extra plugin <= 1.2.11 - Content Injection vulnerability6.5 Medium
- Show moreLoading…