CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- merkulove countdowner for elementorWordPress Countdowner for Elementor plugin <= 1.0.4 - Broken Access Control vulnerability5.4 Medium
- merkulove criptopayer for elementorWordPress Criptopayer for Elementor plugin <= 1.0.1 - Broken Access Control vulnerability5.4 Medium
- kodicms-kohana kodicmsKohana KodiCMS Layout API Endpoint file.php save code injection5.3 Medium
- merkulove headinger for elementorWordPress Headinger for Elementor plugin <= 1.1.4 - Broken Access Control vulnerability5.4 Medium
- kodicms-kohana kodicmsKohana KodiCMS Search API Endpoint page.php like sql injection5.3 Medium
- d-link dir-806a, dlink dir-806a firmware +1 moreD-Link DIR-806A SSDP Request ssdpcgi_main command injection5.3 Medium
- ikaes accessibility pressWordPress Accessibility Press plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- janhenckens dashboard beaconWordPress Dashboard Beacon plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- eleopard behance portfolio managerWordPress Behance Portfolio Manager plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- boxy studio cookedWordPress Cooked plugin <= 1.11.3 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- omar mohamed mohamoud live tvWordPress LIVE TV plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- extendons wordpress & woocommerce scraper plugin, import data from any siteWordPress WordPress & WooCommerce Scraper plugin, Import Data from Any Site plugin <= 1.0.7 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- jthemes genemyWordPress Genemy theme <= 1.6.6 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- elinicksic razgoverelinicksic Razgover Chat Message send.php cross site scripting5.1 Medium
- merkulove couponer for elementorWordPress Couponer for Elementor plugin <= 1.1.7 - Broken Access Control vulnerability5.4 Medium
- merkulove questionar for elementorWordPress Questionar for Elementor plugin <= 1.1.7 - Broken Access Control vulnerability5.4 Medium
- merkulove watcher for elementorWordPress Watcher for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability5.4 Medium
- merkulove sliper for elementorWordPress Sliper for Elementor plugin <= 1.0.10 - Broken Access Control vulnerability5.4 Medium
- merkulove gmaper for elementorWordPress Gmaper for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability5.4 Medium
- merkulove walker for elementorWordPress Walker for Elementor plugin <= 1.1.6 - Broken Access Control vulnerability5.4 Medium
- merkulove select graphist for elementor graphist for elementorWordPress Select Graphist for Elementor Graphist for Elementor plugin <= 1.2.10 - Broken Access Control vulnerability5.4 Medium
- codetipi valenti engineWordPress Valenti Engine plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- alexander anycommentWordPress AnyComment plugin <= 0.3.6 - Broken Access Control vulnerability4.3 Medium
- approveme signature add-on for gravity formsWordPress Signature Add-On for Gravity Forms plugin <= 1.8.6 - Broken Access Control vulnerability4.3 Medium
- omid shamloo pardakht delkhahWordPress Pardakht Delkhah plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- northern beaches websites wp custom admin interfaceWordPress WP Custom Admin Interface plugin <= 7.40 - Broken Access Control vulnerability4.3 Medium
- fahad mahmood easy upload files during checkoutWordPress Easy Upload Files During Checkout plugin <= 3.0.0 - Broken Access Control vulnerability4.3 Medium
- digages direct payments wpWordPress Direct Payments WP plugin <= 1.3.2 - Broken Access Control vulnerability4.3 Medium
- digages direct payments wpWordPress Direct Payments WP plugin <= 1.3.2 - Sensitive Data Exposure vulnerability4.3 Medium
- wp messiah boomdevs wordpress coming soonWordPress BoomDevs WordPress Coming Soon plugin plugin <= 1.0.4 - Sensitive Data Exposure vulnerability4.3 Medium
- emendo seb co-marquage service-public.frWordPress Co-marquage service-public.fr plugin <= 0.5.77 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- themeboy hide pluginsWordPress Hide Plugins plugin <= 1.0.4 - Broken Access Control vulnerability4.3 Medium
- inkthemes wp gmail smtpWordPress WP Gmail SMTP plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- yoohw studio order cancellation & returns for woocommerceWordPress Order Cancellation & Returns for WooCommerce plugin <= 1.1.10 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- web builder 143 sticky notes for wp dashboardWordPress Sticky Notes for WP Dashboard plugin <= 1.2.4 - Broken Access Control vulnerability4.3 Medium
- saad iqbal post snippetsWordPress Post Snippets plugin <= 4.0.11 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- mykola lukin orders chat for woocommerceWordPress Orders Chat for WooCommerce plugin <= 1.2.0 - Broken Access Control vulnerability4.3 Medium
- skynet technologies usa llc all in one accessibilityWordPress All in One Accessibility plugin <= 1.15 - Broken Access Control vulnerability4.3 Medium
- appointifyWordPress Appointify plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- wpdiscover accordion slider galleryWordPress Accordion Slider Gallery plugin <= 2.7 - Broken Access Control vulnerability4.3 Medium
- strategy11 team tasty recipes liteWordPress Tasty Recipes Lite plugin <= 1.1.5 - Broken Access Control vulnerability4.3 Medium
- strategy11 team tasty recipes liteWordPress Tasty Recipes Lite plugin <= 1.1.5 - Broken Access Control vulnerability4.3 Medium
- extend themes vireoWordPress Vireo theme <= 1.0.24 - Broken Access Control vulnerability4.3 Medium
- manidoraisamy formfacadeWordPress FormFacade plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- serhii pasyuk gmedia photo galleryWordPress Gmedia Photo Gallery plugin <= 1.25.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- mergado packWordPress Mergado Pack plugin <= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- imdad next web inext woo pincode checkerWordPress iNext Woo Pincode Checker plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- nicashmu post video playersWordPress Post Video Players plugin <= 1.163 - Sensitive Data Exposure vulnerability4.3 Medium
- eugen bobrowski robots.txt rewriteWordPress Robots.txt rewrite plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- channelize.io team live shopping & shoppable videos for woocommerceWordPress Live Shopping & Shoppable Videos For WooCommerce plugin <= 2.2.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- Show moreLoading…