CVEs published January 7, 2025
348 CVEs were published on January 7, 2025: 23 critical, 103 high.
- Published
- 348
- Critical
- 23
- High
- 103
- Medium
- 216
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- Mozilla Firefox · Mozilla Thunderbird
- 8
- code-projects Online Book Shop
- 7
- IBM Controller · IBM Cognos Controller
- 5
- IBM Concert Software
- 4
- Joomla! Project Joomla! CMS
- 3
- MacWarrior clipbucket-v5
- 3
- Mozilla Firefox
- 3
- OpenHarmony
- 3
- 8blocks 1003 Mortgage Application
- 2
- a3rev Compare Products for WooCommerce
- 2
Critical 23
- CVE-2018-4301This issue is fixed in SCSSU-201801.Apple Smart Card Services
- CVE-2025-22133WeGIA Allows Arbitrary File Upload with Remote Code Execution (RCE)nilsonLazarin WeGIA
- CVE-2025-0247Memory safety bugs fixed in Firefox 134 and Thunderbird 134Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-21624ClipBucket V5 Playlist Cover File Upload to Remote Code ExecutionMacWarrior clipbucket-v5
- CVE-2024-43243WordPress JobBoard Job listing plugin <= 1.2.6 - Arbitrary File Upload vulnerabilitythemeglow JobBoard Job listing
- CVE-2024-49222WordPress WPGuppy plugin <= 1.1.0 - PHP Object Injection vulnerabilityAmentoTech Private Limited WPGuppy
- CVE-2024-49649WordPress Build App Online plugin <= 1.0.23 - Local File Inclusion vulnerabilityhakeemnala Build App Online
- CVE-2024-56278WordPress WP Ultimate Exporter plugin <= 2.9.1 - Remote Code Execution (RCE) vulnerabilitySmackcoders Inc., WP Ultimate Exporter
- CVE-2024-56284WordPress SSL Wireless SMS Notification Plugin <= 3.5.0 - SQL Injection vulnerabilitysslplugins SSL Wireless SMS Notification
- CVE-2024-56290WordPress Multiple Shipping And Billing Address For Woocommerce Plugin <= 1.2 - Unauthenticated SQL Injection vulnerabilitysilverplugins217 Multiple Shipping And Billing Address For…
- CVE-2024-8855WordPress Auction <= 3.7 - Editor+ SQL InjectionWordPress Auction Plugin
- CVE-2024-12470School Management System – SakolaWP <= 1.0.8 - Unauthenticated Privilege Escalationthemesawesome School Management System – SakolaWP
- CVE-2024-12264PayU CommercePro Plugin <= 3.8.3 - Unauthenticated Privilege Escalationpayuplugin PayU CommercePro Plugin
- CVE-2024-12252SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)seobeginner SEO LAT Auto Post
- CVE-2024-12402Themes Coder – Create Android & iOS Apps For Your Woocommerce Site <= 1.3.4 - Insecure Direct Object Reference to Password Change/Account Takeover/Privilege Escalationthemescoder TC Ecommerce – Create Android & iOS Apps for Wo…
- CVE-2022-41572An issue was discovered in EyesOfNetwork (EON) through 5.3.11.
- CVE-2022-41573An issue was discovered in Ovidentia 8.3.
- CVE-2024-35532An XML External Entity (XXE) injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitr
- CVE-2024-50658Server-Side Template Injection (SSTI) was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the shippingAsBill
- CVE-2024-50660File Upload Bypass was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the file upload functionality
- CVE-2024-54819I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/sec
- CVE-2024-55414A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping phys
- CVE-2024-55556A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on th
High 103
- CVE-2025-22132WeGIA has a Cross-Site Scripting (XSS) in File Upload FieldnilsonLazarin WeGIA
- CVE-2024-54007Authenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client BridgeHewlett Packard Enterprise (HPE) HPE Aruba Networking 501 W…
- CVE-2024-54006Authenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client BridgeHewlett Packard Enterprise (HPE) HPE Aruba Networking 501 W…
- CVE-2025-22350WordPress Indeed Ultimate Learning Pro plugin <= 3.9 - SQL Injection vulnerabilityWpIndeed Ultimate Learning Pro
- CVE-2024-12430An attacker who successfully exploited these vulnerabilities could cause enable command execution.ABB AC500
- CVE-2024-40749[20250103] - Core - Read ACL violation in multiple core viewsJoomla! Project Joomla! CMS
- CVE-2024-40748[20250102] - Core - XSS vector in the id attribute of menu listsJoomla! Project Joomla! CMS
- CVE-2024-8361DoS caused due to wrong hash length returned for SHA2/224 algorithmsilabs.com WiSeConnect SDK
- CVE-2025-0241Memory corruption when using JavaScript Text SegmentationMozilla Firefox · Mozilla Thunderbird
- CVE-2024-40702IBM Cognos Controller improper certificate validationIBM Controller · IBM Cognos Controller
- CVE-2025-21623ClipBucket V5 Unauthenticated Template Directory Update to Denial-of-ServiceMacWarrior clipbucket-v5
- CVE-2025-21622ClipBucket V5 Avatar URL Path Traversal to Arbitrary File DeleteMacWarrior clipbucket-v5
- CVE-2024-53800WordPress Rezgo Online Booking plugin <= 4.17 - Local File Inclusion vulnerabilityRezgo
- CVE-2024-56056WordPress SimpleCharm Theme <= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerabilitykmfoysal06 SimpleCharm
- CVE-2025-22294WordPress Custom Field For WP Job Manager plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilitytheme funda Custom Field For WP Job Manager
- CVE-2025-22335WordPress Opencart Product in WP plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityrajib.dewan Opencart Product in WP
- CVE-2025-22338WordPress WP-tagMaker plugin <= 0.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilitylich_wang WP-tagMaker
- CVE-2025-22502WordPress MindValley Super PageMash Plugin <= 1.1 - SQL Injection vulnerabilityMindValley Super PageMash
- CVE-2025-22507WordPress WPMU Prefill Post Plugin <= 1.02 - SQL Injection vulnerabilityiDo8p WPMU Prefill Post
- CVE-2025-22519WordPress eDoc Easy Tables Plugin <= 1.29 - SQL Injection vulnerabilityjerodmoore eDoc Easy Tables
- CVE-2025-22520WordPress Tock Widget Plugin <= 1.1 - CSRF to Stored XSS vulnerabilityTock Widget
- CVE-2025-22522WordPress SingSong plugin <= 1.2 - CSRF to Stored XSS vulnerabilityroya khosravi SingSong
- CVE-2025-22533WordPress WOOEXIM Plugin <= 5.0.0 - SQL Injection vulnerabilitybulktheme WOOEXIM
- CVE-2025-22536WordPress WP Music Player Plugin <= 1.3 - SQL Injection vulnerabilityhiren.sabd WP Music Player
- CVE-2025-22538WordPress Virtual Bot Plugin <= 1.0.0 - CSRF Cross Site Scripting (XSS) vulnerabilityOfek Nakar Virtual Bot
- CVE-2025-22547WordPress JK Html To Pdf plugin <= 1.0.0 - CSRF to Stored XSS vulnerabilityjaykrishnang JK Html To Pdf
- CVE-2025-22548WordPress ldap_login_password_and_role_manager plugin <= 1.0.12 - CSRF to Stored XSS vulnerabilityfrankkoenen ldap_login_password_and_role_manager
- CVE-2025-22552WordPress Affiliate Disclosure Statement plugin <= 0.3 - CSRF to Stored XSS vulnerabilitybnielsen Affiliate Disclosure Statement
- CVE-2025-22555WordPress Smoothness Slider Shortcode plugin <= v1.2.2 - CSRF to Stored XSS vulnerabilitynjshofe Smoothness Slider Shortcode
- CVE-2025-22556WordPress Norse Rune Oracle plugin <= 1.4.2 - CSRF to Stored XSS vulnerabilityWP CMS Ninja Norse Rune Oracle Plugin
- CVE-2025-22557WordPress News Publisher Autopilot plugin <= 2.1.4 - CSRF to Stored XSS vulnerabilitycdowp News Publisher Autopilot
- CVE-2025-22559WordPress TubePress.NET Plugin <= 4.0.1 - CSRF to Stored XSS vulnerabilityTubePress.NET
- CVE-2025-22571WordPress Instabot plugin <= 1.10 - CSRF to Stored XSS vulnerabilityInstabot
- CVE-2025-22582WordPress Uptime Robot plugin <= 0.1.3 - CSRF to Stored XSS vulnerabilityScott Nelle Uptime Robot
- CVE-2025-22589WordPress Quote Tweet plugin <= 0.7 - CSRF to Stored XSS vulnerabilitybozdoz Quote Tweet
- CVE-2025-22590WordPress Prayer Times Anywhere plugin <= 2.0.1 - CSRF to Stored XSS vulnerabilitymmrs151 Prayer Times Anywhere
- CVE-2025-22592WordPress 1003 Mortgage Application plugin <= 1.87 - Broken Access Control vulnerability8blocks 1003 Mortgage Application
- CVE-2025-22593WordPress Laika Pedigree Tree plugin <= 1.4 - CSRF to Stored XSS vulnerabilityburria Laika Pedigree Tree
- CVE-2024-49249WordPress SMSA Shipping plugin <= 2.3 - Arbitrary File Deletion vulnerabilitySMSA Express SMSA Shipping
- CVE-2024-49633WordPress DirectoryPress plugin <= 3.6.19 - Cross Site Scripting (XSS) vulnerabilityDesigninvento DirectoryPress
- CVE-2024-49644WordPress Accessibility by AllAccessible plugin <= 1.3.4 - Privilege Escalation vulnerabilityAccessibility by AllAccessible
- CVE-2024-51700WordPress NAVER Analytics plugin <= 0.9 - CSRF to Stored XSS vulnerabilityeutrue NAVER Analytics
- CVE-2024-51715WordPress ClickWhale plugin <= 2.4.1 - SQL Injection vulnerabilityClickWhale
- CVE-2024-56280WordPress WPGuppy plugin <= 1.1.0 - Privilege Escalation vulnerabilityAmentoTech Private Limited WPGuppy
- CVE-2024-56281WordPress 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 plugin <= 5.2.0 - Local File Inclusion vulnerabilitycodemstory 워드프레스 결제 심플페이
- CVE-2024-56282WordPress WPMozo Addons Lite for Elementor plugin <= 1.1.0 - Local File Inclusion vulnerabilityElicus WPMozo Addons Lite for Elementor
- CVE-2024-56283WordPress Locatoraid Store Locator Plugin <= 3.9.50 - PHP Object Injection vulnerabilityplainware Locatoraid Store Locator
- CVE-2024-56286WordPress Classic Addons – WPBakery Page Builder plugin <= 3.0 - Local File Inclusion vulnerabilitywebcodingplace Classic Addons – WPBakery Page Builder
- CVE-2024-56289WordPress Groundhogg plugin <= 3.7.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityAdrian Tobey Groundhogg
- CVE-2024-56291WordPress PlainInventory – Inventory Management Plugin Plugin <= 3.1.6 - PHP Object Injection vulnerabilityplainware PlainInventory
- CVE-2024-56296WordPress Mang Board WP plugin <= 1.8.4 - Reflected Cross Site Scripting (XSS) vulnerabilityKitae Park Mang Board WP
- CVE-2024-56299WordPress Notify Odoo plugin <= 1.0.0 - CSRF to Stored XSS vulnerabilityPektsekye Notify Odoo
- CVE-2024-56300WordPress Post/Page Copying Tool plugin <= 2.0.0 - Sensitive Data Exposure vulnerabilitywpspin Post/Page Copying Tool
- CVE-2025-22320WordPress ProductDyno plugin <= 1.0.24 - Reflected Cross Site Scripting (XSS) vulnerabilityProductDyno
- CVE-2025-22324WordPress OZ Canonical plugin <= 0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityAndon Ivanov OZ Canonical
- CVE-2025-22325WordPress Autocompleter plugin <= 1.3.5.2 - CSRF to Stored XSS vulnerabilitynchankov Autocompleter
- CVE-2025-22326WordPress 5centsCDN plugin <= 25.4.15 - Reflected Cross Site Scripting (XSS) vulnerability5centsCDN
- CVE-2025-22328WordPress Elevio plugin <= 4.4.1 - CSRF to Stored XSS vulnerabilityElevio by Dixa Elevio
- CVE-2025-22336WordPress Wizhi Multi Filters by Wenprise plugin <= 1.8.6 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityAmos Lee（一刀） Wizhi Multi Filters by Wenprise
- CVE-2025-22342WordPress WP Simple Sitemap plugin <= 0.2 - CSRF to Stored XSS vulnerabilityJenst WP Simple Sitemap
- CVE-2025-22343WordPress wpSOL plugin <= 1.2.0 - CSRF to Stored XSS vulnerabilitykoter84 wpSOL
- CVE-2025-22347WordPress BSK Forms Blacklist plugin <= 3.9 - CSRF to SQL Injection vulnerabilitybannersky BSK Forms Blacklist
- CVE-2025-22348WordPress DynamicTags plugin <= 1.4.0 - SQL Injection vulnerabilityrtowebsites DynamicTags
- CVE-2025-22349WordPress WordPress Auction Plugin plugin <= 3.7 - SQL Injection vulnerabilityWP Marka WordPress Auction Plugin
- CVE-2025-22351WordPress Contact Form 7 Database – CFDB7 plugin <= 1.0.0 - SQL Injection vulnerabilitypenguinarts Contact Form 7 Database – CFDB7
- CVE-2025-22352WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Plugin <= 1.4.9 - SQL Injection vulnerabilityELEXtensions ELEX WooCommerce Advanced Bulk Edit Products,…
- CVE-2025-22353WordPress BVD Easy Gallery Manager plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilitybvads BVD Easy Gallery Manager
- CVE-2025-22355WordPress Kikx Simple Post Author Filter plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityasokaaso2 Kikx Simple Post Author Filter
- CVE-2025-22357WordPress Target Notifications plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitywpdever Target Notifications
- CVE-2025-22358WordPress Wp advertising management plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilitySimone Marcon Wp advertising management
- CVE-2025-22359WordPress SyncFields plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerabilitypjfc SyncFields
- CVE-2025-22364WordPress Ach Invoice App plugin <= 1.0.1 - Local File Inclusion vulnerabilityService Shogun Ach Invoice App
- CVE-2024-12152MIPL WC Multisite Sync <= 1.1.5 - Unauthenticated Arbitrary File Downloadmulika MIPL Multistore Sync for WooCommerce. Sync Products,…
- CVE-2024-47398Liteos_a has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2024-11626Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerabilitProgress Software Sitefinity
- CVE-2024-11625Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from Progress Software Sitefinity
- CVE-2024-12202Croma Music <= 3.6 - Authenticated (Subscriber+) Arbitrary Options Update in ironMusic_ajaxIronTemplates Croma Music
- CVE-2024-11725SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Updatecozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…
- CVE-2024-12471Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Uploadpostsaint Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusi…
- CVE-2024-12633JoomSport <= 5.6.17 - Reflected Cross-Site Scripting via pagebeardev JoomSport – for Sports: Team & League, Football, Ho…
- CVE-2024-12535Host PHP Info <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosureeflyjason Host PHP Info
- CVE-2024-12849Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Readwpguruin Error Log Viewer By WP Guru
- CVE-2024-12322ThePerfectWedding.nl Widget <= 2.8 - Cross-Site Request Forgery to Stored Cross-Site ScriptingThePerfectWedding.nl Widget
- CVE-2024-12313Compare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object Injectiona3rev Compare Products for WooCommerce
- CVE-2024-12157Popup – MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Unauthenticated SQL Injectionarrowplugins Popup – MailChimp, GetResponse and ActiveCampa…
- CVE-2024-11465Custom Product Tabs for WooCommerce <= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injectioneherman24 Custom Product Tabs for WooCommerce
- CVE-2024-12416Woomotiv <= 3.6.1 - Unauthenticated SQL Injectiondelabon Live Sales Notification for Woocommerce – Woomotiv
- CVE-2025-22395Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability.Dell Update Package (DUP) Framework
- CVE-2022-45185An issue was discovered in SuiteCRM 7.12.7.
- CVE-2022-45186An issue was discovered in SuiteCRM 7.12.7.
- CVE-2024-40427Stack Buffer Overflow in PX4-Autopilot v1.14.3, which allows attackers to execute commands to exploit this vulnerability and cause the progr
- CVE-2024-46242An issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression De
- CVE-2024-46601Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 was discovered to contain a buffer overflow.
- CVE-2024-46602An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier.
- CVE-2024-46603An XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a De
- CVE-2024-48245Vehicle Management System 1.0 is vulnerable to SQL Injection.
- CVE-2024-53345An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code
- CVE-2024-53522Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI co
- CVE-2024-55008JATOS 3.9.4 contains a denial-of-service (DoS) vulnerability in the authentication system, where an attacker can prevent legitimate users fr
- CVE-2024-55411An issue in the snxpcamd.sys component of SUNIX Multi I/O Card v10.1.0.0 allows attackers to perform arbitrary read and write actions via su
- CVE-2024-55412A vulnerability exits in driver snxpsamd.sys in SUNIX Serial Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbi
- CVE-2024-55413A vulnerability exits in driver snxppamd.sys in SUNIX Parallel Driver x64 - 10.1.0.0, which allows low-privileged users to read and write ar
- CVE-2024-55555Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP_KEY.
Medium, low and unrated 222
- CVE-2025-0218pgAgent scheduled batch job scripts are created in a predictable temporary directory potentially allowing a denial of servicepgAgent
- CVE-2025-0301code-projects Online Book Shop subcat.php cross site scriptingcode-projects Online Book Shop
- CVE-2025-0300code-projects Online Book Shop subcat.php sql injectioncode-projects Online Book Shop
- CVE-2025-22306WordPress Link Whisper Free plugin <= 0.7.7 - Sensitive Data Exposure vulnerabilitySpencer Haws Link Whisper Free
- CVE-2025-22363WordPress Allada T-shirt Designer for Woocommerce plugin <= 1.1 - Broken Access Control vulnerabilityHermann LAHAMI Allada T-shirt Designer for Woocommerce
- CVE-2025-22296WordPress Hash Elements plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityhashthemes Hash Elements
- CVE-2025-22319WordPress MashShare plugin <= 4.0.47 - Broken Access Control vulnerabilityDearHive Social Media Share Buttons | MashShare
- CVE-2025-22334WordPress Education LMS theme <= 0.0.7 - Stored Cross Site Scripting (XSS) vulnerabilityFilaThemes Education LMS
- CVE-2024-12429An attacker who successfully exploited these vulnerabilities could grant read access to files.ABB AC500
- CVE-2025-22354WordPress Digi Store theme <= 1.1.4 - Cross Site Scripting (XSS) vulnerabilityCode Themes Digi Store
- CVE-2025-22365WordPress EMC2 Alert Boxes Plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityEric McNiece EMC2 Alert Boxes
- CVE-2025-22500WordPress Alpha Price Table For Elementor plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityAli Ali Alpha Price Table For Elementor
- CVE-2025-22621Privilege escalation for users who hold the “splunk_app_soar“ role in the Splunk App for SOARSplunk App for SOAR
- CVE-2024-56270WordPress WP SecureSubmit plugin <= 1.5.20 - Sensitive Data Exposure vulnerabilityWP SecureSubmit
- CVE-2024-56272WordPress Hide Category by User Role for WooCommerce plugin <= 2.1.1 - Broken Access Control vulnerabilityThemeSupport Hide Category by User Role for WooCommerce
- CVE-2025-0299code-projects Online Book Shop search_result.php sql injectioncode-projects Online Book Shop
- CVE-2024-40747[20250101] - Core - XSS vectors in module chromesJoomla! Project Joomla! CMS
- CVE-2025-0243Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-0242Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-0240Compartment mismatch when parsing JavaScript JSON moduleMozilla Firefox · Mozilla Thunderbird
- CVE-2025-0239Alt-Svc ALPN validation failure when redirectedMozilla Firefox · Mozilla Thunderbird
- CVE-2025-0238Use-after-free when breaking lines in textMozilla Firefox · Mozilla Thunderbird
- CVE-2025-0237WebChannel APIs susceptible to confused deputy attackMozilla Firefox · Mozilla Thunderbird
- CVE-2025-0246Address bar spoofing using an invalid protocol scheme on Firefox for AndroidMozilla Firefox
- CVE-2025-0245Lock screen setting bypass in Firefox Focus for AndroidMozilla Firefox
- CVE-2025-0244Address bar spoofing using an invalid protocol scheme on Firefox for AndroidMozilla Firefox
- CVE-2022-22363IBM Cognos Controller information disclosureIBM Controller · IBM Cognos Controller
- CVE-2021-20455IBM Cognos Controller information disclosureIBM Controller · IBM Cognos Controller
- CVE-2025-0298code-projects Online Book Shop process_login.php sql injectioncode-projects Online Book Shop
- CVE-2024-28778IBM Cognos Controller information disclosureIBM Controller · IBM Cognos Controller
- CVE-2024-25037IBM Cognos Controller information disclosureIBM Controller · IBM Cognos Controller
- CVE-2024-52813matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identitymatrix-org matrix-rust-sdk · matrix-sdk-crypto
- CVE-2025-0297code-projects Online Book Shop detail.php sql injectioncode-projects Online Book Shop
- CVE-2025-22503WordPress Admin debug wordpress – enable debug Plugin <= 1.0.13 - Cross Site Request Forgery vulnerabilitydigitalzoomstudio Admin debug wordpress – enable debug
- CVE-2025-22511WordPress Slides & Presentations Plugin <= 0.0.39 - Cross Site Scripting (XSS) vulnerabilityElla Van Durpe Slides & Presentations
- CVE-2025-22512WordPress Help Scout Plugin <= 6.5.6 - Broken Access Control vulnerabilityBoldGrid Help Scout
- CVE-2025-22515WordPress Show Google Analytics widget plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerabilitySimon Show Google Analytics widget
- CVE-2025-22516WordPress Metadata SEO plugin <= 2.3 - Cross Site Scripting (XSS) vulnerabilityhpinfosys Metadata SEO
- CVE-2025-22517WordPress List Pages at Depth plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityBen Huson List Pages at Depth
- CVE-2025-22518WordPress Justified Image Gallery plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityPluginsPoint Justified Image Gallery
- CVE-2025-22524WordPress فرم ساز فرم افزار Plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityformafzar فرم ساز فرم افزار
- CVE-2025-22525WordPress Donation Block For PayPal Plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilityBharat Kambariya Donation Block For PayPal
- CVE-2025-22528WordPress Huurkalender WP Plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerabilityHuurkalender.nl Huurkalender WP
- CVE-2025-22529WordPress WE Blocks <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilitywordpresteem WE Blocks
- CVE-2025-22530WordPress 아임포트 결제버튼 생성 플러그인 plugin <= 1.1.19 - Cross Site Scripting (XSS) vulnerabilityPORTONE 아임포트 결제버튼 생성 플러그인
- CVE-2025-22531WordPress Urdu Formatter – Shamil plugin <= 0.1 - Cross Site Scripting (XSS) vulnerabilityM Bilal M Urdu Formatter – Shamil
- CVE-2025-22532WordPress Simple Photo Sphere plugin <= 0.0.10 - Cross Site Scripting (XSS) vulnerabilitysnagysandor Simple Photo Sphere
- CVE-2025-22534WordPress Slides & Presentations Plugin <= 0.0.39 - Broken Access Control vulnerabilityElla Van Durpe Slides & Presentations
- CVE-2025-22541WordPress WP Delete Post Copies plugin <= 5.5 - Broken Access Control vulnerabilityetruel WP Delete Post Copies
- CVE-2025-22543WordPress ST Gallery WP plugin <= 1.0.8 - Settings Change vulnerabilitybeautifultemplates ST Gallery WP
- CVE-2025-22544WordPress Mind Doodle Visual Sitemaps & Tasks plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityMind Doodle Visual Sitemaps & Tasks
- CVE-2025-22545WordPress iframe to embed plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilitysw.galati iframe to embed
- CVE-2025-22546WordPress jQuery TwentyTwenty plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityObaid Hossain jQuery TwentyTwenty
- CVE-2025-22549WordPress WP Github plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityseinoxygen WP Github
- CVE-2025-22550WordPress AddFunc Mobile Detect plugin <= 3.1 - Cross Site Scripting (XSS) vulnerabilityJoe Rhoney AddFunc Mobile Detect
- CVE-2025-22551WordPress Boot-Modal plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerabilityalbedo0 Boot-Modal
- CVE-2025-22554WordPress Video Embed Optimizer plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityfdfranklin06 Video Embed Optimizer
- CVE-2025-22558WordPress mcjh button shortcode plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilityMarcus C. J. Hartmann mcjh button shortcode
- CVE-2025-22560WordPress Saoshyant Page Builder plugin <= 3.8 - Broken Access Control vulnerabilitysaoshyant1994 Saoshyant Page Builder
- CVE-2025-22562WordPress Title Experiments Free plugin <= 9.0.4 - Cross Site Request Forgery (CSRF) vulnerabilitykbowson Title Experiments Free
- CVE-2025-22563WordPress Pretty Urls Plugin <= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerabilityfaaiq Pretty Url
- CVE-2025-22572WordPress Legacy ePlayer plugin <= 0.9.9 - Cross Site Scripting (XSS) vulnerabilityBrian Legacy ePlayer
- CVE-2025-22573WordPress Icons Enricher plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerabilitycopist Icons Enricher
- CVE-2025-22574WordPress ICS Button plugin <= 0.6 - Cross Site Scripting (XSS) vulnerabilityCleanshooter ICS Button
- CVE-2025-22577WordPress Able Player plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityDamion Armentrout Able Player
- CVE-2025-22578WordPress WP Cookie plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityaazztech WP Cookie
- CVE-2025-22579WordPress WP Header Notification plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityArefly WP Header Notification
- CVE-2025-22580WordPress Biltorvet Dealer Tools plugin <= 1.0.22 - Cross Site Scripting (XSS) vulnerabilityAuto IT Biltorvet Dealer Tools
- CVE-2025-22581WordPress Arcade Ready plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityBytephp Arcade Ready
- CVE-2025-22584WordPress Timeline Pro plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityPluginsPoint Timeline Pro
- CVE-2025-22585WordPress Ultimate Image Hover Effects plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerabilitythemebon Ultimate Image Hover Effects
- CVE-2025-22591WordPress 1003 Mortgage Application plugin <= 1.87 - Broken Access Control vulnerability8blocks 1003 Mortgage Application
- CVE-2024-11681Remote Code Execution in MacPortsMacPorts
- CVE-2025-0296code-projects Online Book Shop booklist.php sql injectioncode-projects Online Book Shop
- CVE-2025-0295code-projects Online Book Shop booklist.php cross site scriptingcode-projects Online Book Shop
- CVE-2025-0294SourceCodester Home Clean Services Management System process.php sql injectionSourceCodester Home Clean Services Management System
- CVE-2024-12131WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.5- Authenticated (Subscriber+) Insecure Direct Object Referencewpjobportal WP Job Portal – AI-Powered Recruitment System f…
- CVE-2024-12738User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scriptingcozmoslabs User Profile Builder – Beautiful User Registrati…
- CVE-2024-45100IBM Security QRadar EDR denial of serviceIBM Security QRadar EDR
- CVE-2024-12426URL fetching can be used to exfiltrate arbitrary INI file values and environment variablesThe Document Foundation LibreOffice
- CVE-2024-45640IBM Security QRadar EDR information disclosureIBM Security QRadar EDR
- CVE-2024-52893IBM Concert Software information disclosureIBM Concert Software
- CVE-2024-52366IBM Concert Software information disclosureIBM Concert Software
- CVE-2024-52891IBM Concert Software log manipulationIBM Concert Software
- CVE-2024-52367IBM Concert Software information disclosureIBM Concert Software
- CVE-2024-12425Path traversal leading to arbitrary .ttf file writeThe Document Foundation LibreOffice
- CVE-2024-11826Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingmdmag Quill Forms | Conversational Multi Step Forms, Survey…
- CVE-2024-12711RSVP and Event Management <= 2.7.13 - Missing Authorizationwpchill RSVP and Event Management
- CVE-2024-12532BWD Elementor Addons <= 4.3.18 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templatesbestwpdeveloper BWD Elementor Addons
- CVE-2024-12033Jupiter X Core <= 4.8.5 - Missing Authorization to Authenticated Library Syncartbees Jupiter X Core
- CVE-2024-12316Jupiter X Core <= 4.8.5 - Missing Authorization to Unauthenticated Popup Template Exportartbees Jupiter X Core
- CVE-2024-49294WordPress WpBusTicketly plugin <= 5.4.3 - Cross Site Request Forgery (CSRF) vulnerabilitymagepeopleteam Bus Ticket Booking with Seat Reservation
- CVE-2024-51651WordPress CubeWP Forms plugin <= 1.1.10 - Broken Access Control vulnerabilityImran Tauqeer CubeWP Forms
- CVE-2024-56271WordPress WP SecureSubmit plugin <= 1.5.20 - Broken Access Control vulnerabilityWP SecureSubmit
- CVE-2024-56273WordPress WPvivid Backup plugin <= 0.9.106 - Broken Access Control vulnerabilitywpvividplugins WPvivid Backup and Migration
- CVE-2024-56274WordPress Astra Widgets plugin <= 1.2.15 - Cross Site Scripting (XSS) vulnerabilityBrainstorm Force Astra Widgets
- CVE-2024-56275WordPress Envato Elements plugin <= 2.0.14 - Server Side Request Forgery (SSRF) vulnerabilityEnvato Elements
- CVE-2024-56276WordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerabilitySyed Balkhi Contact Form by WPForms
- CVE-2024-56279WordPress Compact WP Audio Player plugin <= 1.9.14 - Server Side Request Forgery (SSRF) vulnerabilitymra13 Compact WP Audio Player
- CVE-2024-56285WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.5.1 - Cross-Site Scripting vulnerabilityWPBITS Addons For Elementor Page Builder
- CVE-2024-56287WordPress WP jQuery DataTable Plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilityAppJetty WP jQuery DataTable
- CVE-2024-56288WordPress WP Docs plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerabilityFahad Mahmood WP Docs
- CVE-2024-56292WordPress Email Reminders Plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerabilitywpdevelop Email Reminders
- CVE-2024-56293WordPress AFI – The Easiest Integration Plugin <= 1.95.0 - Cross Site Scripting (XSS) vulnerabilityNasir Ahmed Advanced Form Integration
- CVE-2024-56294WordPress Nexter Blocks plugin <= 4.0.7 - Broken Access Control vulnerabilityPOSIMYTH Nexter Blocks
- CVE-2024-56297WordPress Highlight plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilityQuantumCloud Highlight
- CVE-2024-56298WordPress Pretty Simple Popup Builder Plugin <= 1.0.9 - Stored Cross Site Scripting (XSS) vulnerabilityRob @ 5 Star Plugins Pretty Simple Popup Builder
- CVE-2025-22261WordPress WP FullCalendar plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityMarcus (aka @msykes) WP FullCalendar
- CVE-2025-22293WordPress Gutentor plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerabilityGutentor
- CVE-2025-22297WordPress AI WP Writer plugin <= 3.8.4.4 - Cross Site Request Forgery (CSRF) vulnerabilityaipost AI WP Writer
- CVE-2025-22298WordPress Hive Support plugin <= 1.1.6 - Broken Access Control vulnerabilityHive Support
- CVE-2025-22299WordPress AI for SEO plugin <= 1.2.9 - Broken Access Control vulnerabilitySpace Codes AI for SEO
- CVE-2025-22300WordPress PixelYourSite plugin <= 10.0.1.2 - Cross Site Request Forgery (CSRF) vulnerabilityPixelYourSite – Your smart PIXEL (TAG) Manager
- CVE-2025-22301WordPress MyBookTable Bookstore by Stormhill Media plugin <= 3.5.3 - Cross Site Request Forgery (CSRF) vulnerabilityzookatron MyBookTable Bookstore
- CVE-2025-22302WordPress WP Wand plugin <= 1.2.5 - Broken Access Control vulnerabilityWP Grids WP Wand
- CVE-2025-22303WordPress WP Mailster plugin <= 1.8.17.0 - Sensitive Data Exposure vulnerabilitybrandtoss WP Mailster
- CVE-2025-22304WordPress WP Visitor Statistics plugin <= 7.5 - Broken Access Control vulnerabilityosama.esh WP Visitor Statistics
- CVE-2025-22305WordPress Hero Banner Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerabilityEssential Plugin Hero Banner Ultimate
- CVE-2025-22308WordPress Smart Custom FIelds plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerabilityTakashi Kitajima Smart Custom Fields
- CVE-2025-22309WordPress SpeakOut! Email Petitions plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerabilityRopeSwingHld SpeakOut! Email Petitions
- CVE-2025-22310WordPress TemplatesNext ToolKit plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerabilitymarsian TemplatesNext ToolKit
- CVE-2025-22312WordPress Thim Elementor Kit plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerabilityThimPress Thim Elementor Kit
- CVE-2025-22315WordPress Typing Text plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityWPDeveloper Typing Text
- CVE-2025-22316WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityWPBITS Addons For Elementor Page Builder
- CVE-2025-22321WordPress ElementsCSS Addons for Elementor plugin <= 1.0.8.9 - Cross Site Scripting (XSS) vulnerabilityTheInnovs ElementsCSS Addons for Elementor
- CVE-2025-22323WordPress Image Hover Effects for Elementor plugin <= 1.0.2.4 - Cross Site Scripting (XSS) vulnerabilityLiton Arefin Image Hover Effects for Elementor
- CVE-2025-22327WordPress EO4WP plugin <= 1.0.8.1 - Cross Site Scripting (XSS) vulnerabilityOlaf Lederer EO4WP
- CVE-2025-22333WordPress Piotnet Addons For Elementor plugin <= 2.4.31 - Cross-Site Scripting vulnerabilitypiotnetdotcom Piotnet Addons For Elementor
- CVE-2025-22339WordPress Store Commerce theme <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilityathemeart Store Commerce
- CVE-2025-22362WordPress WPAchievements Free Plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityDaniel Bakovic WPAchievements Free
- CVE-2024-12699Service Box <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingthemepoints Service Box
- CVE-2024-12719WordPress File Upload <= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversalnickboss Iptanus File Upload
- CVE-2024-54030Communication_dsoftbus has an UAF vulnerabilityOpenHarmony
- CVE-2024-45070Liteos_a has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2024-11627: Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 thrProgress Sitefinity
- CVE-2024-12516Coupon Plugin <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingvickydalmia Coupon Plugin
- CVE-2024-12077Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'wpdevart Booking calendar, Appointment Booking System · Boo…
- CVE-2024-10866Export Import Menus <= 1.9.1 - Missing Authorization to Unauthenticated Menu Exportakshay-menariya Export Import Menus
- CVE-2024-12437Marketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodelumiblog Marketplace Items
- CVE-2024-12781Aurum - WordPress & WooCommerce Shopping Theme <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Demo Content ImportLaborator Aurum - WordPress & WooCommerce Shopping Theme
- CVE-2024-11764Solar Wizard Lite <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingcovertcommunication Solar Wizard Lite
- CVE-2024-12499WP jQuery DataTable <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingbiztechc WP jQuery DataTable
- CVE-2024-12495Bootstrap Blocks for WP Editor v2 <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingvirgial Bootstrap Blocks for WP Editor
- CVE-2024-9354Estatik Mortgage Calculator <= 2.0.11 - Reflected Cross-Site ScriptingEstatik Mortgage Calculator
- CVE-2024-9502Master Addons -- Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip Modulelitonice13 Master Addons For Elementor – Widgets, Extension…
- CVE-2024-12624Sina Extension for Elementor <= 3.5.91 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Sina Image Differshaonsina Sina Extension for Elementor
- CVE-2024-11282Passster – Password Protect Pages and Content <= 4.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposurewpchill Passster – Password Protect Pages and Content
- CVE-2024-9638Category Posts Widget < 4.9.18 - Admin+ Stored XSSCategory Posts Widget
- CVE-2024-8857WordPress Auction <= 3.7 - Editor+ Stored XSSWordPress Auction Plugin
- CVE-2024-11606Tabs Shortcode <= 2.0.2 - Contributor+ XSS via ShortcodeTabs Shortcode
- CVE-2024-10562Form Maker by 10Web < 1.15.31 - Admin+ Stored XSSForm Maker by 10Web
- CVE-2024-10102Photo Gallery, Images, Slider in Rbs Image Gallery < 3.2.22 - Contributor+ Stored XSSPhoto Gallery, Images, Slider in Rbs Image Gallery
- CVE-2024-7696Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tamAxis Communications AB AXIS Camera Station Pro
- CVE-2024-12384Binary MLM Woocommerce <= 2.0 - Reflected Cross-Site Scripting via 'page'letscms Binary MLM For WooCommerce
- CVE-2024-11756SweepWidget Contests, Giveaways, Photo Contests, Competitions <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingSweepWidget – Contests, Giveaways, Sweepstakes & Photo Cont…
- CVE-2024-10536FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 6.0.0 - Missing Authorization to Authenticated (Subscriber+) Shortcode Exportwpqode FancyPost – Post Blocks, Grids & Sliders for Block E…
- CVE-2024-11887Geo Content <= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scriptinggeotargetly Geo Content
- CVE-2024-12440Candifly <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingCandifly
- CVE-2024-12073Meteor Slides <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingjleuze Meteor Slides
- CVE-2024-12383Binary MLM Woocommerce <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scriptingletscms Binary MLM For WooCommerce
- CVE-2024-12438WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket <= 4.75 - Reflected Cross-Site ScriptingDigital Content Delivery (incl. DRM) by Flickrocket for Woo…
- CVE-2024-9702Social Rocket <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodesocialrocket Social Rocket – Social Sharing Plugin
- CVE-2024-12464Chatroll Live Chat <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingChatroll Live Chat
- CVE-2024-12261SmartEmailing.cz <= 2.2.0 - Reflected Cross-Site Scriptingmarekzak01 SmartEmailing
- CVE-2024-12439Marketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marketplace' Shortcodelumiblog Marketplace Items
- CVE-2024-11369Store credit / Gift cards for woocommerce <= 1.0.49.46 - Reflected Cross-Site Scriptingrajeshsingh520 Store credit / Gift cards for woocommerce
- CVE-2024-9697Social Rocket – Social Sharing Plugin <= 1.3.4 - Missing Authorization to Settings Updatesocialrocket Social Rocket – Social Sharing Plugin
- CVE-2024-11749App Embed <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingappizy App Embed
- CVE-2024-12324Unilevel MLM Plan <= 1.1.0 - Reflected Cross-Site Scripting via 'page'letscms Unilevel MLM Plan
- CVE-2024-12435Compare Products for WooCommerce <= 3.2.1 - Reflected Cross-Site Scriptinga3rev Compare Products for WooCommerce
- CVE-2024-11382Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingcommonninja Common Ninja: Fully Customizable & Perfectly Re…
- CVE-2024-12445RightMessage WP <= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingRightMessage WP
- CVE-2024-11810PayGreen Payment Gateway <= 1.0.26 - Reflected Cross-Site ScriptingPayGreen Payment Gateway
- CVE-2024-9208Enable Accessibility <= 1.4.1 - Reflected Cross-Site Scriptingupress Enable Accessibility
- CVE-2024-12327LazyLoad Background Images <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updateproloybhaduri LazyLoad Background Images
- CVE-2024-11496Infility Global <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Plugin Options UpdateInfility Global
- CVE-2024-12159Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords <= 3.1 - Information Exposuremuzaara Optimize Your Campaigns – Google Shopping – Google…
- CVE-2024-12256Simple Video Management System <= 1.0.4 - Reflected Cross-Site Scriptingmaximize Simple Video Management System
- CVE-2024-12176WordLift – AI powered SEO – Schema <= 3.54.2 - Missing Authorization to Authenticated (Subscriber+) Settings UpdateWordLift – AI powered SEO – Schema
- CVE-2024-12332School Management System – WPSchoolPress <= 2.2.14 - Authenticated (Student/Parent+) SQL Injectionjdsofttech School Management System – WPSchoolPress
- CVE-2024-12140Elementor AI Addons – 70 Widgets, Premium Templates, Ultimate Elements <= 2.2.1 - Authenticated (Contributor+) Private Templates Content Disclosureaiwp Elementor Addons AI Addons – 70 Widgets, Premium Templ…
- CVE-2024-11290Member Access <= 1.1.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposurebrownoxford Member Access
- CVE-2024-11377Automate Hub Free by Sperse.IO <= 1.7.0 - Reflected Cross-Site ScriptingAutomate Hub Free by Sperse.IO
- CVE-2024-12158Popup – MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Missing Authorization to Unauthenticated DB Table Truncationarrowplugins Popup – MailChimp, GetResponse and ActiveCampa…
- CVE-2024-12153GDY Modular Content <= 0.9.92 - Reflected Cross-Site Scriptinggrandy GDY Modular Content
- CVE-2024-11363Same but Different – Related Posts by Taxonomy <= 1.0.16 - Reflected Cross-Site Scriptingouttheboxthemes Same but Different – Related Posts by Taxon…
- CVE-2024-12453Uptodown APK Download Widget <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site ScriptingUptodown APK Download Widget
- CVE-2024-12457Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingfaysal61 Chat Support for Viber – Chat Bubble and Chat Butt…
- CVE-2024-12207Toggles Shortcode and Widget <= 1.14 - Authenticated (Administrator+) Stored Cross-Site Scriptingotwthemes Toggles Shortcode and Widget
- CVE-2024-11337Horoscope And Tarot <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingdivineapi Divine Astro
- CVE-2024-12291ViewMedica 9 <= 1.4.17 - Cross-Site Request Forgery to Reflected Cross-Site Scriptingswarminteractive ViewMedica
- CVE-2024-12290Infility Global <= 2.9.8 - Reflected Cross-Site Scripting via set_type ParameterInfility Global
- CVE-2024-12170ViewMedica Embed <= 1.4.15 - Cross-Site Request Forgery to SQL Injectionswarminteractive ViewMedica
- CVE-2024-11445Image Magnify <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingsazzadh Image Magnify
- CVE-2024-11375WC1C <= 0.23.0 - Reflected Cross-Site ScriptingWC1C
- CVE-2024-12288Simple add pages or posts <= 2.0.0 - Cross-Site Request Forgery to Reflected Cross-Site Scriptingramon-fincken Simple add pages or posts
- CVE-2024-11378Bizapp for WooCommerce <= 2.0.8 - Reflected Cross-Site Scriptingbizappventures Bizapp for WooCommerce
- CVE-2024-12126SEO Keywords <= 1.1.3 - Reflected Cross-Site Scripting via google_error Parameterseomantis SEO Keywords
- CVE-2024-11690Financial Stocks & Crypto Market Data Plugin <= 1.10.3 - Reflected Cross-Site Scriptingdeios Financial Stocks & Crypto Market Data Plugin
- CVE-2024-12214WooCommerce HSS Extension for Streaming Video <= 3.31 - Reflected Cross-Site Scripting via videolink Parameterhoststreamsell WooCommerce HSS Extension for Streaming Video
- CVE-2024-11434WP – Bulk SMS – by SMS.to <= 1.0.12 - Reflected Cross-Site Scriptingintergotelecom WP – Bulk SMS – by SMS.to
- CVE-2024-11338PIXNET Plugin <= 2.9.10 - Authenticated (Subscriber+) Stored Cross-Site Scriptingdaniel1088 PIXNET Plugin
- CVE-2024-12462YOGO Booking <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingandersyogo YOGO Booking
- CVE-2024-10527Spacer <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Limited Information Disclosureclevelandwebdeveloper Spacer
- CVE-2024-12049Woo Ukrposhta <= 1.17.11 - Reflected Cross-Site Scripting via order, post, and idd Parametersbandido Ukrposhta
- CVE-2024-11383CC Canadian Mortgage Calculator <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingcalculatorscanadaca CC Canadian Mortgage Calculator
- CVE-2024-12538Duplicate Post, Page and Any Custom Post <= 3.5.5 - Authenticated (Contributor+) Post Disclosure via Post Duplicationbinsaifullah Duplicate Post, Page and Any Custom Post
- CVE-2024-11899Slider Pro Lite <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingbqworks Slider Pro Lite
- CVE-2024-12559ClickDesigns <= 1.8.0 - Missing Authorization to API Key Modification or Removal1clickdesigns ClickDesigns
- CVE-2024-12098ARS Affiliate Page Plugin <= 2.0.2 - Reflected Cross-Site Scriptingarsdeveloper ARS Affiliate Page Plugin
- CVE-2024-12592Sellsy <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingSellsy
- CVE-2024-11777Sell Media <= 2.5.8.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingendortrails Sell Media
- CVE-2024-12541Chative Live chat and Chatbot <= 1.1 - Cross-Site Request Forgery via add_chative_widget_action FunctionChative Live chat and Chatbot
- CVE-2024-12419Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler <= 1.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scriptingtobias_conrad WOW Styler for CF7 – Visual Styler for Contac…
- CVE-2024-12528WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingpantherius WordPress Survey & Poll – Quiz, Survey and Poll…
- CVE-2024-11934Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce <= 2.1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeFormaloo Form Maker & Customer Analytics for WordPress & Wo…
- CVE-2024-12557Transporters.io <= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scriptingtransportersio Transporters.io
- CVE-2024-11437Timeline Designer <= 1.4 - Authenticated (Admin+) SQL Injectionsolwininfotech Timeline Designer
- CVE-2024-12590WP Youtube Gallery <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameterindia-web-developer WP Youtube Gallery
- CVE-2024-44450Multiple functions are vulnerable to Authorization Bypass in AIMS eCrew.
- CVE-2024-50659Cross Site Scripting vulnerability iPublish Media Solutions AdPortal 3.0.39 allows a remote attacker to escalate privileges via the shipping
- CVE-2024-55218IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter.