CVEs published December 13, 2025
82 CVEs were published on December 13, 2025: 7 critical, 11 high.
- Published
- 82
- Critical
- 7
- High
- 11
- Medium
- 62
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Growatt ShineLan-X
- 7
- code-projects Student File Management System
- 5
- ajitdas Devs CRM – Manage tasks, attendance and teams all t…
- 2
- code-projects Prison Management System
- 2
- dugudlabs Eyewear prescription form
- 2
- itsourcecode Online Pet Shop Management System
- 2
- melodicmedia Popover Windows
- 2
- a3rev a3 Lazy Load
- 1
- aaron13100 404 Solution
- 1
- ays-pro Image Slider by Ays- Responsive Slider and Carousel
- 1
Critical 7
- CVE-2025-36747Hardcoded FTP Credentials within the firmwareGrowatt ShineLan-X
- CVE-2025-36752Undocumented backup Account and No Password Configuration CapabilityGrowatt ShineLan-X
- CVE-2025-36754Authentication bypass on web interfaceGrowatt ShineLan-X
- CVE-2025-36751Missing encryption on Local Configuration Interface or Cloud Endpoint Communication - Growatt MIC3300TL-X and ShineLan-XGrowatt ShineLan-X
- CVE-2025-10738URL Shortener Plugin For WordPress <= 3.0.7 - Unauthenticated SQL Injectionrupok98 URL Shortener Plugin For WordPress
- CVE-2025-11693Export WP Page to Static HTML & PDF <= 4.3.4 - Unauthenticated Cookie Exposure via Log Filerecorp Export WordPress Pages to Static HTML & PDF — Static…
- CVE-2025-14440JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookiejayarsiech JAY Login & Register
High 11
- CVE-2025-14542Command execution in python-utcp allows attackers to achieve remote code execution when fetching a remote Manual from a malicious endpointutcp
- CVE-2025-36748Stored Cross-Site Scripting (XSS) vulnerability in Growatt ShineLan-XGrowatt ShineLan-X
- CVE-2025-36750Stored cross site scripting (XSS) vulnerability in Growatt ShineLan-XGrowatt ShineLan-X
- CVE-2025-36753SWD Interface Open on Growatt ShineLan-XGrowatt ShineLan-X
- CVE-2025-13077افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce <= 1.3.5 - Unauthenticated Time-Based Blind SQL Injectionافزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocom…
- CVE-2025-14476Doubly <= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Importunitecms Doubly – Cross Domain Copy Paste for WordPress
- CVE-2025-14475Extensive VC Addons for WPBakery page builder <= 1.9.1 - Unauthenticated Local File Inclusion via 'shortcode_name' Parameternenad-obradovic Extensive VC Addons for WPBakery page build…
- CVE-2025-13094WP3D Model Import Viewer <= 1.0.7 - Authenticated (Contributor+) Arbitrary File UploadWP3D Model Import Viewer
- CVE-2025-14397Postem Ipsum <= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation in postem_ipsum_generate_usersfranciscopalacios Postem Ipsum
- CVE-2025-13089WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injectionwpdirectorykit WP Directory Kit
- CVE-2025-13970OpenPLC_V3 Cross-Site Request ForgeryOpenPLC_V3
Medium, low and unrated 64
- CVE-2025-14637itsourcecode Online Pet Shop Management System addcnp.php sql injectionitsourcecode Online Pet Shop Management System
- CVE-2025-14636Tenda AX9 httpd image_check weak hashTenda AX9
- CVE-2025-14623code-projects Student File Management System update_student.php sql injectioncode-projects Student File Management System
- CVE-2025-14622code-projects Student File Management System save_user.php sql injectioncode-projects Student File Management System
- CVE-2025-14621code-projects Student File Management System update_user.php sql injectioncode-projects Student File Management System
- CVE-2025-14620code-projects Student File Management System login_query.php sql injectioncode-projects Student File Management System
- CVE-2025-14619code-projects Student File Management System login_query.php sql injectioncode-projects Student File Management System
- CVE-2025-14617Jehovahs Witnesses JW Library App org.jw.jwlibrary.mobile.activity.SiloContainer path traversalJehovahs Witnesses JW Library App
- CVE-2025-14607OFFIS DCMTK dcmdata dcbytstr.cc makeDicomByteString memory corruptionOFFIS DCMTK
- CVE-2025-14606tiny-rdm Tiny RDM Pickle Decoding pickle_convert.go pickle.loads deserializationtiny-rdm Tiny RDM
- CVE-2025-14590code-projects Prison Management System search1.php sql injectioncode-projects Prison Management System
- CVE-2025-14589code-projects Prison Management System search.php sql injectioncode-projects Prison Management System
- CVE-2025-14588itsourcecode Student Management System update_program.php sql injectionitsourcecode Student Management System
- CVE-2025-14587itsourcecode Online Pet Shop Management System available.php sql injectionitsourcecode Online Pet Shop Management System
- CVE-2025-8780Livemesh SiteOrigin Widgets <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Hero Header and Pricing Table WidgetsLivemesh SiteOrigin Widgets
- CVE-2025-9856Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingpopupbuilder Popup Builder – Create highly converting, mobi…
- CVE-2025-8687Enter Addons <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown and Image Comparison Widgetsthemelooks Enter Addons – Ultimate Template Builder for Ele…
- CVE-2025-8199MarqueeAddons <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Marquee Widgetdebuggersstudio Marquee Addons for Elementor – Essential Mo…
- CVE-2025-8195JetWidgets For Elementor <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison and Subscribe Widgetsjetmonsters JetWidgets For Elementor
- CVE-2025-0969Brizy – Page Builder <= 2.7.16 - Authenticated (Contributor+) Sensitive Information Exposure via get_users Functionthemefusecom Brizy – Page Builder
- CVE-2025-7960King Addons for Elementor <= 51.1.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetskingaddons King Addons for Elementor – 80+ Elementor Widget…
- CVE-2025-10289Filter & Grids <= 3.2.0 - Unauthenticated SQL Injectionwssoffice21 YMC Filter
- CVE-2025-8779All-in-One Addons for Elementor – WidgetKit <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team and Countdown Widgetsshamsbd71 All-in-One Addons for Elementor – WidgetKit
- CVE-2025-9207TI WooCommerce Wishlist <= 2.10.0 - Unauthenticated HTML Injectiontemplateinvaders TI WooCommerce Wishlist
- CVE-2025-14586TOTOLINK X5000R cstecgi.cgi snprintf os command injectionTOTOLINK X5000R
- CVE-2025-9116WPS Visitor Counter Plugin <= 1.4.8 - Reflected XSS via $_SERVER['REQUEST_URI']WPS Visitor Counter
- CVE-2025-12362myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approvalsaadiqbal Points Management System For Gamification, Ranks,…
- CVE-2025-14446Popup Builder <= 1.1.37 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Resetghozylab Easy Notify Lite
- CVE-2025-9488Redux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameterdavidanderson Redux Framework
- CVE-2025-12109Header Footer Script Adder – Insert Code in Header, Body & Footer <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingmahethekiller Header Footer Script Adder – Insert Code in H…
- CVE-2025-13092Devs CRM – Manage tasks, attendance and teams all together <= 1.1.8 - Unauthenticated Information Expsoureajitdas Devs CRM – Manage tasks, attendance and teams all t…
- CVE-2025-14394Popover Windows <= 1.2 - Cross-Site Request Forgery to Arbitrary Popover Configuration Updatemelodicmedia Popover Windows
- CVE-2025-14365Eyewear prescription form <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Category Deletiondugudlabs Eyewear prescription form
- CVE-2025-12077WP to LinkedIn Auto Publish <= 1.9.8 - Reflected Cross-Site Scripting via PostMessagef1logic WP to LinkedIn Auto Publish
- CVE-2025-11164Mavix Education <= 1.0 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin Activationcreativthemes Mavix Education
- CVE-2025-11707Login Lockdown & Protection <= 2.14 - IP Block Bypasswebfactory Login Lockdown & Protection
- CVE-2025-14508MediaCommander – Bring Folders to Media, Posts, and Pages <= 2.3.1 - Missing Authorization to Authenticated (Author+) Media Folder Deletionyalogica MediaCommander – Bring Folders to Media, Posts, an…
- CVE-2025-14539Shortcode Loader <= 1.0 - Unauthenticated Arbitrary Shortcode Execution via 'code' Parameterrang501 Shortcode Ajax
- CVE-2025-8617YITH WooCommerce Quick View <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_quick_view Shortcodeyithemes YITH WooCommerce Quick View
- CVE-2025-14367Easy Theme Options <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Importcorsonr Easy Theme Options
- CVE-2025-7058Kingcabs <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parametersparklewpthemes Kingcabs
- CVE-2025-12076Social Media Auto Publish <= 3.6.5 - Reflected Cross-Site Scripting via PostMessagef1logic Social Media Auto Publish
- CVE-2025-13093Devs CRM – Manage tasks, attendance and teams all together <= 1.1.8 - Missing Authorization to Unauthenticated Lead Tag Updateajitdas Devs CRM – Manage tasks, attendance and teams all t…
- CVE-2025-14451Solutions Ad Manager <= 1.0.0 - Unauthenticated Open Redirect via 'sam-redirect-to' Parametersolutionsbysteve Solutions Ad Manager
- CVE-2025-9218rtMedia for WordPress, BuddyPress and bbPress 4.7.0 - 4.7.3 - Missing Authorization to Unauthenticated Information Disclosure via handle_rest_pre_dispatch Functionrtcamp rtMedia for WordPress, BuddyPress and bbPress
- CVE-2025-14288Gallery Blocks with Lightbox <= 3.3.0 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Modificationgallerycreator Mixed Media Gallery Blocks
- CVE-2025-13705Custom Frames <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Parameterblakelong Custom Frames
- CVE-2025-14462Lucky Draw Contests <= 4.2 - Cross-Site Request Forgery to Plugin Settings Updateowais4377 Lucky Draw Contests
- CVE-2025-11376Colibri Page Builder <= 1.0.335 - Authenticated (Contributor+) Stored Cross-Site Scriptingextendthemes Colibri Page Builder
- CVE-2025-14447AnnunciFunebri Impresa <= 4.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Deletionpcantoni AnnunciFunebri
- CVE-2025-14540Userback <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Plugin's Configuration ExposureUserback
- CVE-2025-14378Quick Testimonials <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scriptingthemeregion Quick Testimonials
- CVE-2025-14366Eyewear prescription form <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Product Creationdugudlabs Eyewear prescription form
- CVE-2025-9873a3 Lazy Load <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scriptinga3rev a3 Lazy Load
- CVE-2025-14395Popover Windows <= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX Actionsmelodicmedia Popover Windows
- CVE-2025-11970Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated <= 1.0.9 - Authenticated (Admin+) Server-Side Request ForgeryEmplibot – AI Content Writer with Keyword Research, Infogra…
- CVE-2025-14454Image Slider by Ays- Responsive Slider and Carousel <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletionays-pro Image Slider by Ays- Responsive Slider and Carousel
- CVE-2025-14050Design Import/Export <= 2.2 - Authenticated (Administrator+) SQL Injection via XML File Importuxl Design Import/Export – Styles, Templates, Template Part…
- CVE-2025-14278HT Slider for Elementor <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scriptinghtplugins HT Slider For Elementor
- CVE-2025-14056Custom Post Type UI <= 1.18.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'label' Import Parameterwebdevstudios Custom Post Type UI
- CVE-2025-12512GenerateBlocks <= 2.1.2 - Authenticated (Contributor+) Information Exposure via Metadataedge22 GenerateBlocks
- CVE-2025-14581HAPPY – Helpdesk Support Ticket System <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Replyvillatheme HAPPY – Helpdesk Support Ticket System
- CVE-2025-14477404 Solution <= 3.1.0 - Authenticated (Admin+) SQL Injection via 'filterText' Parameteraaron13100 404 Solution
- CVE-2025-13403Employee Spotlight – Team Member Showcase & Meet the Team Plugin <= 5.1.3 - Missing Authorization to Authenticated (Subscriber+) Tracking Opt-In/Opt-Out Modificationemarket-design Employee Spotlight – Team Member Showcase &…