CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- themesawesome history timelineWordPress History Timeline plugin <= 1.0.6 - Broken Access Control vulnerability4.3 Medium
- recorp ai content writing assistant (content writer, chatgpt, image generator) all in oneWordPress AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One plugin <= 1.1.7 - Broken Access Control vulnerability4.3 Medium
- marcelo torres download media libraryWordPress Download Media Library plugin <= 0.2.1 - Sensitive Data Exposure vulnerability5.3 Medium
- quadlayers ai copilotWordPress AI Copilot plugin <= 1.5.2 - Broken Access Control vulnerability5.3 Medium
- solwininfotech trash duplicate and 301 redirectWordPress Trash Duplicate and 301 Redirect plugin <= 1.9.1 - Broken Access Control vulnerability5.3 Medium
- damian wp export categories & taxonomiesWordPress WP Export Categories & Taxonomies plugin <= 1.0.3 - Broken Access Control vulnerability5.3 Medium
- razvan stanga varnish/nginx proxy cachingWordPress Varnish/Nginx Proxy Caching plugin <= 1.8.3 - Sensitive Data Exposure vulnerability5.3 Medium
- flowboxWordPress Flowbox plugin <= 1.1.6 - Broken Access Control vulnerability5.3 Medium
- aum watcharapon featured image generatorWordPress Featured Image Generator plugin <= 1.3.4 - Broken Access Control vulnerability5.3 Medium
- phpgurukul small crmPHPGurukul Small CRM edit-user.php authorization5.3 Medium
- eduardo villão myd deliveryWordPress MyD Delivery plugin <= 1.7.1 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- efí bank gerencianet oficialWordPress Gerencianet Oficial plugin <= 3.1.3 - Sensitive Data Exposure vulnerability5.3 Medium
- magnigenie restropressWordPress RestroPress plugin <= 3.2.7 - Broken Access Control vulnerability5.3 Medium
- wiremoWordPress Wiremo plugin <= 1.4.99 - Broken Access Control vulnerability5.3 Medium
- gs plugins portfolio for envatoWordPress GS Portfolio for Envato plugin <= 1.4.2 - Broken Access Control vulnerability5.3 Medium
- wp grids easytest – simplify a/b testingWordPress EasyTest – Simplify A/B Testing plugin <= 1.0.1 - Broken Access Control vulnerability5.3 Medium
- vladimir statsenko terms descriptionsWordPress Terms descriptions plugin <= 3.4.10 - Sensitive Data Exposure vulnerability5.3 Medium
- 101gen wawpWordPress Wawp plugin <= 4.4 - Broken Access Control vulnerability5.3 Medium
- illia simple like pageWordPress Simple Like Page plugin <= 1.5.3 - Broken Access Control vulnerability5.3 Medium
- quadlayers tiktok feedWordPress QuadLayers TikTok Feed plugin <= 4.6.5 - Broken Access Control vulnerability5.3 Medium
- newclarity dmca protection badgeWordPress DMCA Protection Badge plugin <= 2.2.0 - Broken Access Control vulnerability5.3 Medium
- nik melnik realbigWordPress Realbig plugin <= 1.1.3 - Broken Access Control vulnerability5.3 Medium
- channelize.io team live shopping & shoppable videos for woocommerceWordPress Live Shopping & Shoppable Videos For WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability5.3 Medium
- liton arefin master addons for elementorWordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- nicdark hotel bookingWordPress Hotel Booking plugin <= 3.8 - Broken Access Control vulnerability5.3 Medium
- reuters news agency directWordPress Reuters Direct plugin <= 3.0.0 - Broken Access Control vulnerability5.3 Medium
- totalsoft portfolio galleryWordPress Portfolio Gallery plugin <= 1.4.8 - Broken Access Control vulnerability5.4 Medium
- vollstart serial codes generator and validator with woocommerce supportWordPress Serial Codes Generator and Validator with WooCommerce Support plugin <= 2.8.2 - Broken Access Control vulnerability5.4 Medium
- saifumak add custom codesWordPress Add Custom Codes plugin <= 4.80 - Broken Access Control vulnerability5.4 Medium
- marco milesi wp attachmentsWordPress WP Attachments plugin <= 5.2 - Broken Access Control vulnerability5.4 Medium
- jayce53 easyindexWordPress EasyIndex plugin <= 1.1.1704 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- rick beckman openhookWordPress OpenHook plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- a wp life contact form widgetWordPress Contact Form Widget plugin <= 1.5.1 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- cedcommerce wp advanced pdfWordPress WP Advanced PDF plugin <= 1.1.7 - Other vulnerability Type vulnerability5.4 Medium
- mohammed kaludi core web vitals & pagespeed boosterWordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.28 - Broken Access Control vulnerability5.4 Medium
- inkthemescom colorwayWordPress ColorWay Theme <= 4.2.3 - Sensitive Data Exposure Vulnerability5.8 Medium
- viitorcloud technologies pvt ltd add featured image custom linkWordPress Add Featured Image Custom Link plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- imran emu logo slider , logo carousel , logo showcase , client logoWordPress Logo Slider , Logo Carousel , Logo showcase , Client Logo plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- soli wp post signatureWordPress WP Post Signature plugin <= 0.4.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- filipe seabra woocommerce parcelasWordPress WooCommerce Parcelas plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- plainware locatoraid store locatorWordPress Locatoraid Store Locator plugin <= 3.9.68 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- nicashmu post video playersWordPress Post Video Players plugin <= 1.163 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- saifumak add custom codesWordPress Add Custom Codes plugin <= 4.80 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- neilgee bootstrap modalsWordPress Bootstrap Modals plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpfactory maximum products per user for woocommerceWordPress Maximum Products per User for WooCommerce plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- seothemes seo sliderWordPress SEO Slider plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wayne allen postieWordPress Postie plugin <= 1.9.73 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- webvitaly extra shortcodesWordPress Extra Shortcodes plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- audiomackWordPress Audiomack plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- curator.ioWordPress Curator.io plugin <= 1.9.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…