CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- dipesh patel web to sugarcrm leadWeb to SugarCRM Lead <= 1.0.0 - Cross-Site Request Forgery to Custom Field Deletion4.3 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- wp chill image photo gallery final tiles gridImage Photo Gallery Final Tiles Grid <= 3.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'Custom Scripts' Setting6.4 Medium
- wpvividplugins wpvivid — backup, migration & stagingMigration, Backup, Staging – WPvivid Backup & Migration <= 0.9.120 - Authenticated (Admin+) Arbitrary Directory Creation2.7 Low
- elextensions elex wordpress helpdesk & customer ticketing systemELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting7.2 High
- acowebs product table for woocommerceProduct Table for WooCommerce <= 5.0.8 - Reflected Cross-Site Scripting6.1 Medium
- campcodes complete online beauty parlor management systemCampcodes Complete Online Beauty Parlor Management System view-appointment.php sql injection6.9 Medium
- yealink rpsYealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL...7.4 High
- hasthemes wc builder – woocommerce page builder for wpbakeryWC Builder <= 1.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'heading_color' Shortcode Attribute4.4 Medium
- tainacanTainacan <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Metadata Section Creation5.3 Medium
- wpxpo post grid gutenberg blocks for news, magazines, blog websites – postxPost Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure7.5 High
- livecomposer live composer – free wordpress website builderLive Composer – Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) PHP Object Injection via dslc_module_posts_output Shortcode7.5 High
- htplugins wishsuite – wishlist for woocommerceWishSuite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute6.4 Medium
- wpshuffle frontend post submission manager lite – frontend posting wordpress pluginFrontend Post Submission Manager Lite <= 1.2.5 - Missing Authorization to Unauthenticated Arbitrary Post Modification5.3 Medium
- rustaurius five star restaurant reservations – wordpress booking pluginFive Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.5 - Unauthenticated Stored Cross-Site Scripting6.1 Medium
flywayOSS-FuzzSecurity exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternalNo score- mojofywp wp affiliate disclosureWordPress WP Affiliate Disclosure plugin <= 1.2.6 - Broken Access Control + CSRF vulnerability4.3 Medium
ox-rubyOSS-FuzzDynamic-stack-buffer-overflow in _ox_err_set_with_locationNo score- happyfiles proWordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerability7.7 High
- happyfiles proWordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerability5.4 Medium
- mapro collins magazine edgeWordPress Magazine Edge theme <= 1.13 - Authenticated Arbitrary Plugin Activation4.3 Medium
- campcodes complete online beauty parlor management systemCampcodes Complete Online Beauty Parlor Management System search-invoices.php sql injection6.9 Medium
- versa networks sase client for windows, versa-networks sase client +1 moreVersa SASE Client for Windows < 7.9.5 Arbitrary Folder Deletion Leading to Local Privilege Escalation8.5 High
- cowrieCowrie < 2.9.0 Unrestricted wget/curl Emulation Enables SSRF-Based DDoS Amplification6.9 Medium
- No product listedWP JobHunt <= 7.7 - Missing Authorization to Authenticated (Candidate+) Stored Cross-Site Scripting via 'status'7.6 High
- No product listedWP JobHunt <= 7.7 - Authenticated (Candidate+) Insecure Direct Object Reference4.3 Medium
- damian-gora fibosearch – ajax search for woocommerceFiboSearch – Ajax Search for WooCommerce <= 1.32.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via thegem_te_search Shortcode5.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure5.3 Medium
- cmssuperheroes flex store usersFlex Store Users <= 1.1.0 - Unauthenticated Privilege Escalation9.8 Critical
- unknown pure wc variation swatchesPure WC Variation Swatches <= 1.1.7 - Unauthenticated Settings Update5.3 Medium
- tikolan wp hallo weltWP Hallo Welt <= 1.4. - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- wpmaniax wp db boosterWP DB Booster <= 1.0.1 - Cross-Site Request Forgery to Database Cleanup4.3 Medium
- snowray file uploader for woocommerceFile Uploader for WooCommerce <= 1.0.3 - Unauthenticated Arbitrary File Upload via add-image-data9.8 Critical
- kaizencoders attachments handlerAttachments Handler <= 1.1.7 - Reflected Cross-Site Scripting6.1 Medium
- niao70 f70 lead document downloadF70 Lead Document Download <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Media File Download5.3 Medium
- travishoki overstock affiliate linksOverstock Affiliate Links <= 1.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']6.1 Medium
- nestornoe amazon affiliate lite pluginAmazon affiliate lite Plugin <= 1.0.0 - Cross-Site Request Forgery to Plugin Settings Update5.4 Medium
- mansoormunib responsive and swipe slider!Responsive and Swipe slider <= 1.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode5.5 Medium
- lbell pretty google calendarPretty Google Calendar <= 2.0.0 - Missing Authorization to Unauthenticated Google API Key Exposure5.3 Medium
- nestornoe amazon affiliate lite pluginAmazon affiliate lite Plugin <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- edckwt quran gatewayQuran Gateway <= 1.5 - Cross-Site Request Forgery to Settings Update4.3 Medium
- perforce delphix continuous compliancePII Leak Due to Change in EOR Handling5.3 Medium
- tp-link tapo c200, tp link systems inc. tapo c100 v5, tapo c425 v1.2 +1 more +3 moreUnauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C4258.7 High
- tp-link systems inc. tapo c200 v3, tp-link tapo c200 firmware +1 moreImproper Content-Length Validation in HTTPS Requests on Tapo C2007.1 High
- tp-link systems inc. tapo c200 v3, tp-link tapo c200 firmware, tp-link systems inc. tapo c520ws v2.6 +2 moreRemote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WS8.7 High
- phpNULL Pointer Dereference in PDO quoting8.2 High
- phpHeap buffer overflow in array_merge()6.5 Medium
- phpInformation Leak of Memory in getimagesize6.3 Medium
- n8nn8n Vulnerable to Remote Code Execution via Expression Injection10.0 Critical
@tutao/tutanota-utilsnpmTuta Mail has DOM attribute and CSS injection in its Contact Viewer feature2.1 Low- Show moreLoading…