CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- liton arefin wp adminifyWordPress WP Adminify plugin <= 4.0.6.1 - Broken Access Control vulnerability5.4 Medium
- liton arefin wp adminifyWordPress WP Adminify plugin <= 4.0.6.1 - Broken Access Control vulnerability4.3 Medium
- mitchell bennis simple file listWordPress Simple File List plugin <= 6.1.18 - Broken Access Control vulnerability5.4 Medium
- crm perks integration for contact form 7 hubspotWordPress Integration for Contact Form 7 HubSpot plugin <= 1.4.2 - SQL Injection vulnerability7.6 High
- wp socio telegram widget and join linkWordPress WP Telegram Widget and Join Link plugin <= 2.2.12 - Broken Access Control vulnerability5.3 Medium
- totalsoft ts pollWordPress TS Poll plugin <= 2.5.5 - Broken Access Control vulnerability4.3 Medium
- bob watu quizWordPress Watu Quiz plugin <= 3.4.5 - Broken Access Control vulnerability4.3 Medium
- boxy studio cookedWordPress Cooked plugin <= 1.11.3 - Broken Access Control vulnerability5.3 Medium
- ben balter wp document revisionsWordPress WP Document Revisions plugin <= 3.7.2 - Broken Access Control vulnerability2.7 Low
- constantin boiangiu vimeothequeWordPress Vimeotheque plugin <= 2.3.5.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- tikweb management fast user switchingWordPress Fast User Switching plugin <= 1.4.10 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- funnelforms freeWordPress Funnelforms Free plugin <= 3.8 - Broken Access Control vulnerability5.3 Medium
- yithemes yith slider for page buildersWordPress YITH Slider for page builders plugin <= 1.0.11 - Broken Access Control vulnerability5.4 Medium
- pluginsware advanced classifieds & directory proWordPress Advanced Classifieds & Directory Pro plugin <= 3.2.9 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- foliovision fv simpler seoWordPress FV Simpler SEO plugin <= 1.9.6 - Broken Access Control vulnerability5.3 Medium
- addonifyWordPress Addonify plugin <= 2.0.4 - Broken Access Control vulnerability5.3 Medium
- virusdieWordPress Virusdie plugin <= 1.1.6 - Broken Access Control vulnerability4.3 Medium
- virusdieWordPress Virusdie plugin <= 1.1.6 - Sensitive Data Exposure vulnerability4.3 Medium
- wappointment team wappointmentWordPress Wappointment plugin <= 2.7.6 - Broken Access Control vulnerability5.3 Medium
- voidcoders wpbakery visual composer whmcs elementsWordPress WPBakery Visual Composer WHMCS Elements plugin <= 1.0.4.3 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- alessandro piconi simple keyword to linkWordPress Simple Keyword to Link plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- spider themes bbp coreWordPress BBP Core plugin <= 1.4.1 - Broken Access Control vulnerability5.3 Medium
- salesmanago & leadooWordPress SALESmanago plugin <= 3.9.0 - Broken Access Control vulnerability5.3 Medium
- captivateaudio captivate syncWordPress Captivate Sync plugin <= 3.2.2 - SQL Injection vulnerability7.6 High
- codepeople wp time slots booking formWordPress WP Time Slots Booking Form plugin <= 1.2.39 - Broken Access Control vulnerability6.5 Medium
- claspo popup builders – popups, spin the wheel & email captureWordPress Claspo – Popups, Spin the Wheel & Email Capture plugin <= 1.0.7 - Broken Access Control vulnerability5.3 Medium
- wphocus my auctions allegroWordPress My auctions allegro plugin <= 3.6.33 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- wphocus my auctions allegroWordPress My auctions allegro plugin <= 3.6.35 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- jaybee twitch playerWordPress Twitch Player plugin <= 2.1.3 - Broken Access Control vulnerability5.3 Medium
- nawawi jamili docket cacheWordPress Docket Cache plugin <= 24.07.03 - Local File Inclusion vulnerability8.1 High
- icegram express proWordPress Icegram Express Pro plugin < 5.9.14 - PHP Object Injection vulnerability7.2 High
- wp swings membership for woocommerceWordPress Membership For WooCommerce plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- brownbagmarketing greenhouse job boardWordPress Greenhouse Job Board plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- the plugin factory google adsense for responsive design – gardWordPress Google AdSense for Responsive Design – GARD plugin <= 2.23 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- ecommerce platforms gift huntWordPress Gift Hunt plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- webheadcoder wh tweaksWordPress WH Tweaks plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- basticom frameworkWordPress Basticom Framework plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- amp-mode review disclaimerWordPress Review Disclaimer plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- touchoftech draft notifyWordPress Draft Notify plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- tmtraderunner trade runnerWordPress Trade Runner plugin <= 3.14 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- 6storage rentalsWordPress 6Storage Rentals plugin <= 2.22.0 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- titopandub evergreen post tweeterWordPress Evergreen Post Tweeter plugin <= 1.8.9 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability7.1 High
- 10up eight day week print workflowWordPress Eight Day Week Print Workflow plugin <= 1.2.5 - Sensitive Data Exposure vulnerability4.3 Medium
- linuxusb: mtu3: fix kernel panic at qmu transfer done irq handler4.1 Medium
- linuxbtrfs: don't free qgroup space unless specified6.8 Medium
- linuxbinder: fix UAF of alloc->vma in race with munmap()7.8 High
- linuxf2fs: Fix system crash due to lack of free space in LFS7.8 High
- linuxdrm/amd: Fix an out of bounds error in BIOS parserNo score
- linuxnet: dsa: avoid suspicious RCU usage for synced VLAN-aware MAC addresses7.5 High
- linuxmedia: platform: mtk-mdp3: Add missing check and free for ida_allocNo score
- Show moreLoading…