CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- magnigenie restropressWordPress RestroPress plugin <= 3.2.8.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- averta shortcodes and extra features for phlox themeWordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Broken Access Control vulnerability4.3 Medium
- automattic crowdsignal formsWordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability3.8 Low
- youzifyWordPress Youzify plugin <= 1.3.7 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- jetmonsters stratumWordPress Stratum plugin <= 1.6.1 - Broken Access Control vulnerability4.3 Medium
- stephen harris event organiserWordPress Event Organiser plugin <= 3.12.8 - Broken Access Control vulnerability4.3 Medium
- themebeez toolkitWordPress Themebeez Toolkit plugin <= 1.3.5 - Broken Access Control vulnerability5.3 Medium
- kamleshyadav medicalequipmentWordPress Medicalequipment theme <= 1.0.9 - Broken Access Control vulnerability5.3 Medium
- inboxify sign up formWordPress Inboxify Sign Up Form plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- otwthemes popping sidebars and widgets lightWordPress Popping Sidebars and Widgets Light plugin <= 1.27 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- atte moisio am eventsWordPress AM Events plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- heateor support social loginWordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- advancedcoding wpdiscuzWordPress wpDiscuz plugin <= 7.6.43 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- webcodingplace responsive posts carousel proWordPress Responsive Posts Carousel Pro plugin <= 15.1 - Local File Inclusion vulnerability7.5 High
- gal dubinski my sticky elementsWordPress My Sticky Elements plugin <= 2.3.3 - Broken Access Control vulnerability4.3 Medium
- xforwoocommerce product loops for woocommerceWordPress Product Loops for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability5.3 Medium
- xforwoocommerce share, print and pdf products for woocommerceWordPress Share, Print and PDF Products for WooCommerce plugin <= 3.1.2 - Broken Access Control vulnerability5.3 Medium
- xenioushk bwl knowledge base managerWordPress BWL Knowledge Base Manager plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- xenioushk bwl pro voting managerWordPress BWL Pro Voting Manager plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- xenioushk bwl pro voting managerWordPress BWL Pro Voting Manager plugin <= 1.4.9 - SQL Injection vulnerability8.5 High
- renzo johnson contact-form-7-mailchimp-extensionWordPress Contact Form 7 Extension For Mailchimp plugin <= 0.9.68 - Sensitive Data Exposure vulnerability4.3 Medium
- o2oe e-invoice app malaysiaWordPress E-Invoice App Malaysia plugin <= 1.3.0 - Sensitive Data Exposure vulnerability5.3 Medium
- edge-themes cineramaWordPress Cinerama theme <= 2.9 - Local File Inclusion vulnerability7.5 High
- thembay aoraWordPress Aora theme <= 1.3.15 - Local File Inclusion vulnerability7.5 High
- thembay pucaWordPress Puca theme <= 2.6.39 - Local File Inclusion vulnerability7.5 High
- thembay greenmartWordPress Greenmart theme <= 4.2.11 - Local File Inclusion vulnerability7.5 High
- designthemes lms addonWordPress DesignThemes LMS Addon plugin <= 2.6 - Broken Access Control vulnerability5.3 Medium
- designthemes homefix elementor portfolioWordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability5.3 Medium
- designthemes wedesigntech portfolioWordPress WeDesignTech Portfolio plugin <= 1.0.2 - Broken Access Control vulnerability5.3 Medium
- simplecalendar google calendar eventsWordPress Google Calendar Events plugin <= 3.5.9 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- designthemes coreWordPress DesignThemes Core plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- designthemes portfolio addonWordPress DesignThemes Portfolio Addon plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- eagle-themes eagle bookingWordPress Eagle Booking plugin <= 1.3.4.3 - Settings Change vulnerability5.4 Medium
- eagle-themes eagle bookingWordPress Eagle Booking plugin <= 1.3.4.3 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- miniorange wordpress social login and registerWordPress WordPress Social Login and Register plugin <= 7.7.0 - Local File Inclusion vulnerability6.6 Medium
- phpemsPHPEMS Purchase Request race condition6.3 Medium
- carmelo simple stock systemcode-projects Simple Stock System login.php sql injection6.9 Medium
- phpemsPHPEMS Coupon race condition2.3 Low
- delta electronics dvp-12se11t, deltaww dvp-12se11t firmware +1 moreDVP-12SE11T - Out-of-bound memory write Vulnerability9.1 Critical
- delta electronics dvp-12se11t, deltaww dvp-12se11t firmware +1 moreDVP-12SE11T - Denial of Service Vulnerability7.5 High
- cloudpanel community editionCloudPanel Community Edition HTTP Header users redirect5.1 Medium
- delta electronics dvp-12se11t, deltaww dvp-12se11t firmware +1 moreDVP-12SE11T - Authentication Bypass via Partial Password Disclosure8.1 High
- delta electronics dvp-12se11t, deltaww dvp-12se11t firmware +1 moreDVP-12SE11T - Password Protection Bypass9.1 Critical
- tenda m3, m3 firmware +1 moreTenda M3 setInternetLanInfo formSetRemoteInternetLanInfo heap-based overflow8.7 High
- tenda m3, m3 firmware +1 moreTenda M3 setAdInfoDetail formSetAdInfoDetails heap-based overflow8.7 High
- netvision information isoinsightNetVision Information｜ISOinsight - Reflected Cross-site Scripting5.1 Medium
- tenda m3, m3 firmware +1 moreTenda M3 setAdPushInfo formSetAdPushInfo stack-based overflow8.7 High
- tenda m3, m3 firmware +1 moreTenda M3 setVlanInfo formSetRemoteVlanInfo stack-based overflow8.7 High
- tenda m3, m3 firmware +1 moreTenda M3 setVlanPolicyData formSetVlanPolicy heap-based overflow8.7 High
- tenda ch22, ch22 firmware +1 moreTenda CH22 DhcpListClient fromDhcpListClient denial of service6.9 Medium
- Show moreLoading…