CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- kcseopro adwords conversion tracking codeWordPress AdWords Conversion Tracking Code plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- livemesh addons for beaver builderWordPress Livemesh Addons for Beaver Builder plugin <= 3.9.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- anshul gangrade custom background changerWordPress Custom Background Changer plugin <= 3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- zookatron mybooktable bookstoreWordPress MyBookTable Bookstore plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- chris steman page title splitterWordPress Page Title Splitter plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- genetech products web and woocommerce addons for wpbakery builderWordPress Web and WooCommerce Addons for WPBakery Builder plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ruhul amin content fetcherWordPress Content Fetcher plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bainternet user specific contentWordPress User Specific Content plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kalender.digitalWordPress Calendar.online / Kalender.digital plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- landwire responsive block controlWordPress Responsive Block Control plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- lvaudore the moneytizerWordPress The Moneytizer plugin <= 10.0.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- webman design | oliver juhas amplifierWordPress WebMan Amplifier plugin <= 1.5.12 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- thinkupthemes minamazeWordPress Minamaze theme <= 1.10.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- thinkupthemes consultingWordPress Consulting theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- qno technology vpn firewallQNO Technology｜VPN Firewall - OS Command Injection8.7 High
- zoho mail zeptomailWordPress Zoho ZeptoMail plugin <= 3.3.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability7.1 High
- qno technology vpn firewallQNO Technology｜VPN Firewall - OS Command Injection8.7 High
- thinkupthemes melosWordPress Melos theme <= 1.6.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- everestthemes everest backupWordPress Everest Backup plugin <= 2.3.11 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- shuttlethemes shuttleWordPress Shuttle theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- funnelforms freeWordPress Funnelforms Free plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- justin tadlock seriesWordPress Series plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- buddydev buddypress activity shortcodeWordPress BuddyPress Activity Shortcode plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp for church sermon managerWordPress Sermon Manager plugin <= 2.30.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- maksym marko mx time zone clocksWordPress MX Time Zone Clocks plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- tomas wordpress tooltipsWordPress WordPress Tooltips plugin <= 10.9.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- basepress knowledge base documentation & wiki plugin – basepressWordPress Knowledge Base documentation & wiki plugin – BasePress plugin <= 2.17.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- qno technology vpn firewallQNO Technology｜VPN Firewall - Insufficient Entropy8.7 High
- moxa nport 5000ai-m12 series, nport 5100 series, nport 5100a series +8 more +10 moreA vulnerability exists in serial device servers where active debug code remains enabled in the...7.0 High
- moxa nport 6100-g2/6200-g2 seriesThe NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026)...7.1 High
- moxa nport 6100-g2/6200-g2 seriesThe NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges...7.7 High
- fontforgeFontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability7.8 High
- fontforgeFontForge GUtils XBM File Parsing Integer Overflow Remote Code Execution Vulnerability7.8 High
- fontforgeFontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability7.8 High
- fontforgeFontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- fontforgeFontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability8.8 High
- fontforgeFontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability8.8 High
- fontforgeFontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability8.8 High
- fontforgeFontForge PFB File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability8.8 High
- fontforgeFontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability8.8 High
- fontforgeFontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability8.8 High
- fontforgeFontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability8.8 High
- fontforgeFontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability8.8 High
- smub easy digital downloads – ecommerce payments and subscriptions made easyEasy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect4.3 Medium
- unknown ultimate post kit addons for elementorUltimate Post Kit < 4.0.16 – Unauthenticated Arbitrary Post Content Disclosure5.3 Medium
- unknown knowband mobile app builderKnowband Mobile App Builder for wooCommerce < 3.0.0 – Unauthenticated Arbitrary User Deletion7.5 High
- merzedes custom styleWordPress Custom Style plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- libsodiumlibsodium has Incomplete List of Disallowed Inputs4.5 Medium
- marcin kijak noindex by pathWordPress Noindex by Path plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- page carbajal custom post statusWordPress Custom Post Status plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability7.1 High
- Show moreLoading…