# CVEs published 2025-12-13

82 CVEs were published on December 13, 2025: 7 critical, 11 high. Days are UTC.

- [CVE-2025-14637](https://cve.now/CVE-2025-14637.md): itsourcecode Online Pet Shop Management System addcnp.php sql injection (CVSS 6.9, itsourcecode Online Pet Shop Management System)
- [CVE-2025-14636](https://cve.now/CVE-2025-14636.md): Tenda AX9 httpd image\_check weak hash (CVSS 6.3, Tenda AX9)
- [CVE-2025-14623](https://cve.now/CVE-2025-14623.md): code-projects Student File Management System update\_student.php sql injection (CVSS 6.9, code-projects Student File Management System)
- [CVE-2025-14622](https://cve.now/CVE-2025-14622.md): code-projects Student File Management System save\_user.php sql injection (CVSS 6.9, code-projects Student File Management System)
- [CVE-2025-14621](https://cve.now/CVE-2025-14621.md): code-projects Student File Management System update\_user.php sql injection (CVSS 6.9, code-projects Student File Management System)
- [CVE-2025-14620](https://cve.now/CVE-2025-14620.md): code-projects Student File Management System login\_query.php sql injection (CVSS 6.9, code-projects Student File Management System)
- [CVE-2025-14619](https://cve.now/CVE-2025-14619.md): code-projects Student File Management System login\_query.php sql injection (CVSS 6.9, code-projects Student File Management System)
- [CVE-2025-14617](https://cve.now/CVE-2025-14617.md): Jehovahs Witnesses JW Library App org.jw.jwlibrary.mobile.activity.SiloContainer path traversal (CVSS 4.8, Jehovahs Witnesses JW Library App)
- [CVE-2025-14607](https://cve.now/CVE-2025-14607.md): OFFIS DCMTK dcmdata dcbytstr.cc makeDicomByteString memory corruption (CVSS 5.3, OFFIS DCMTK)
- [CVE-2025-14606](https://cve.now/CVE-2025-14606.md): tiny-rdm Tiny RDM Pickle Decoding pickle\_convert.go pickle.loads deserialization (CVSS 2.3, tiny-rdm Tiny RDM)
- [CVE-2025-14590](https://cve.now/CVE-2025-14590.md): code-projects Prison Management System search1.php sql injection (CVSS 6.9, code-projects Prison Management System)
- [CVE-2025-14589](https://cve.now/CVE-2025-14589.md): code-projects Prison Management System search.php sql injection (CVSS 5.3, code-projects Prison Management System)
- [CVE-2025-14588](https://cve.now/CVE-2025-14588.md): itsourcecode Student Management System update\_program.php sql injection (CVSS 6.9, itsourcecode Student Management System)
- [CVE-2025-14542](https://cve.now/CVE-2025-14542.md): Command execution in python-utcp allows attackers to achieve remote code execution when fetching a remote Manual from a malicious endpoint (CVSS 7.5, utcp)
- [CVE-2025-14587](https://cve.now/CVE-2025-14587.md): itsourcecode Online Pet Shop Management System available.php sql injection (CVSS 6.9, itsourcecode Online Pet Shop Management System)
- [CVE-2025-8780](https://cve.now/CVE-2025-8780.md): Livemesh SiteOrigin Widgets \<= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Hero Header and Pricing Table Widgets (CVSS 6.4, Livemesh SiteOrigin Widgets)
- [CVE-2025-9856](https://cve.now/CVE-2025-9856.md): Popup Builder – Create highly converting, mobile friendly marketing popups. \<= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, popupbuilder Popup Builder – Create highly converting, mobi…)
- [CVE-2025-8687](https://cve.now/CVE-2025-8687.md): Enter Addons \<= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown and Image Comparison Widgets (CVSS 6.4, themelooks Enter Addons – Ultimate Template Builder for Ele…)
- [CVE-2025-8199](https://cve.now/CVE-2025-8199.md): MarqueeAddons \<= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Marquee Widget (CVSS 6.4, debuggersstudio Marquee Addons for Elementor – Essential Mo…)
- [CVE-2025-8195](https://cve.now/CVE-2025-8195.md): JetWidgets For Elementor \<= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison and Subscribe Widgets (CVSS 6.4, jetmonsters JetWidgets For Elementor)
- [CVE-2025-0969](https://cve.now/CVE-2025-0969.md): Brizy – Page Builder \<= 2.7.16 - Authenticated (Contributor+) Sensitive Information Exposure via get\_users Function (CVSS 6.5, themefusecom Brizy – Page Builder)
- [CVE-2025-7960](https://cve.now/CVE-2025-7960.md): King Addons for Elementor \<= 51.1.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, kingaddons King Addons for Elementor – 80+ Elementor Widget…)
- [CVE-2025-36747](https://cve.now/CVE-2025-36747.md): Hardcoded FTP Credentials within the firmware (CVSS 9.4, Growatt ShineLan-X)
- [CVE-2025-36752](https://cve.now/CVE-2025-36752.md): Undocumented backup Account and No Password Configuration Capability (CVSS 9.4, Growatt ShineLan-X)
- [CVE-2025-36754](https://cve.now/CVE-2025-36754.md): Authentication bypass on web interface (CVSS 9.3, Growatt ShineLan-X)
- [CVE-2025-36748](https://cve.now/CVE-2025-36748.md): Stored Cross-Site Scripting (XSS) vulnerability in Growatt ShineLan-X (CVSS 8.4, Growatt ShineLan-X)
- [CVE-2025-36750](https://cve.now/CVE-2025-36750.md): Stored cross site scripting (XSS) vulnerability in Growatt ShineLan-X (CVSS 8.5, Growatt ShineLan-X)
- [CVE-2025-36753](https://cve.now/CVE-2025-36753.md): SWD Interface Open on Growatt ShineLan-X (CVSS 8.6, Growatt ShineLan-X)
- [CVE-2025-36751](https://cve.now/CVE-2025-36751.md): Missing encryption on Local Configuration Interface or Cloud Endpoint Communication - Growatt MIC3300TL-X and ShineLan-X (CVSS 9.4, Growatt ShineLan-X)
- [CVE-2025-10289](https://cve.now/CVE-2025-10289.md): Filter & Grids \<= 3.2.0 - Unauthenticated SQL Injection (CVSS 5.9, wssoffice21 YMC Filter)
- [CVE-2025-8779](https://cve.now/CVE-2025-8779.md): All-in-One Addons for Elementor – WidgetKit \<= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team and Countdown Widgets (CVSS 6.4, shamsbd71 All-in-One Addons for Elementor – WidgetKit)
- [CVE-2025-9207](https://cve.now/CVE-2025-9207.md): TI WooCommerce Wishlist \<= 2.10.0 - Unauthenticated HTML Injection (CVSS 5.3, templateinvaders TI WooCommerce Wishlist)
- [CVE-2025-10738](https://cve.now/CVE-2025-10738.md): URL Shortener Plugin For WordPress \<= 3.0.7 - Unauthenticated SQL Injection (CVSS 9.8, rupok98 URL Shortener Plugin For WordPress)
- [CVE-2025-14586](https://cve.now/CVE-2025-14586.md): TOTOLINK X5000R cstecgi.cgi snprintf os command injection (CVSS 5.3, TOTOLINK X5000R)
- [CVE-2025-9116](https://cve.now/CVE-2025-9116.md): WPS Visitor Counter Plugin \<= 1.4.8 - Reflected XSS via $\_SERVER\['REQUEST\_URI'\] (CVSS 5.8, WPS Visitor Counter)
- [CVE-2025-12362](https://cve.now/CVE-2025-12362.md): myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program \<= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval (CVSS 5.3, saadiqbal Points Management System For Gamification, Ranks,…)
- [CVE-2025-14446](https://cve.now/CVE-2025-14446.md): Popup Builder \<= 1.1.37 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Reset (CVSS 5.4, ghozylab Easy Notify Lite)
- [CVE-2025-11693](https://cve.now/CVE-2025-11693.md): Export WP Page to Static HTML & PDF \<= 4.3.4 - Unauthenticated Cookie Exposure via Log File (CVSS 9.8, recorp Export WordPress Pages to Static HTML & PDF — Static…)
- [CVE-2025-9488](https://cve.now/CVE-2025-9488.md): Redux Framework \<= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter (CVSS 6.4, davidanderson Redux Framework)
- [CVE-2025-12109](https://cve.now/CVE-2025-12109.md): Header Footer Script Adder – Insert Code in Header, Body & Footer \<= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mahethekiller Header Footer Script Adder – Insert Code in H…)
- [CVE-2025-13092](https://cve.now/CVE-2025-13092.md): Devs CRM – Manage tasks, attendance and teams all together \<= 1.1.8 - Unauthenticated Information Expsoure (CVSS 5.3, ajitdas Devs CRM – Manage tasks, attendance and teams all t…)
- [CVE-2025-14394](https://cve.now/CVE-2025-14394.md): Popover Windows \<= 1.2 - Cross-Site Request Forgery to Arbitrary Popover Configuration Update (CVSS 4.3, melodicmedia Popover Windows)
- [CVE-2025-14365](https://cve.now/CVE-2025-14365.md): Eyewear prescription form \<= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Category Deletion (CVSS 5.3, dugudlabs Eyewear prescription form)
- [CVE-2025-12077](https://cve.now/CVE-2025-12077.md): WP to LinkedIn Auto Publish \<= 1.9.8 - Reflected Cross-Site Scripting via PostMessage (CVSS 6.1, f1logic WP to LinkedIn Auto Publish)
- [CVE-2025-11164](https://cve.now/CVE-2025-11164.md): Mavix Education \<= 1.0 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin Activation (CVSS 4.3, creativthemes Mavix Education)
- [CVE-2025-11707](https://cve.now/CVE-2025-11707.md): Login Lockdown & Protection \<= 2.14 - IP Block Bypass (CVSS 5.3, webfactory Login Lockdown & Protection)
- [CVE-2025-14440](https://cve.now/CVE-2025-14440.md): JAY Login & Register \<= 2.4.01 - Authentication Bypass via Cookie (CVSS 9.8, jayarsiech JAY Login & Register)
- [CVE-2025-14508](https://cve.now/CVE-2025-14508.md): MediaCommander – Bring Folders to Media, Posts, and Pages \<= 2.3.1 - Missing Authorization to Authenticated (Author+) Media Folder Deletion (CVSS 6.5, yalogica MediaCommander – Bring Folders to Media, Posts, an…)
- [CVE-2025-14539](https://cve.now/CVE-2025-14539.md): Shortcode Loader \<= 1.0 - Unauthenticated Arbitrary Shortcode Execution via 'code' Parameter (CVSS 5.4, rang501 Shortcode Ajax)
- [CVE-2025-8617](https://cve.now/CVE-2025-8617.md): YITH WooCommerce Quick View \<= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith\_quick\_view Shortcode (CVSS 6.4, yithemes YITH WooCommerce Quick View)
- [CVE-2025-14367](https://cve.now/CVE-2025-14367.md): Easy Theme Options \<= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Import (CVSS 5.3, corsonr Easy Theme Options)
- [CVE-2025-7058](https://cve.now/CVE-2025-7058.md): Kingcabs \<= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parameter (CVSS 6.4, sparklewpthemes Kingcabs)
- [CVE-2025-12076](https://cve.now/CVE-2025-12076.md): Social Media Auto Publish \<= 3.6.5 - Reflected Cross-Site Scripting via PostMessage (CVSS 6.1, f1logic Social Media Auto Publish)
- [CVE-2025-13093](https://cve.now/CVE-2025-13093.md): Devs CRM – Manage tasks, attendance and teams all together \<= 1.1.8 - Missing Authorization to Unauthenticated Lead Tag Update (CVSS 5.3, ajitdas Devs CRM – Manage tasks, attendance and teams all t…)
- [CVE-2025-13077](https://cve.now/CVE-2025-13077.md): افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce \<= 1.3.5 - Unauthenticated Time-Based Blind SQL Injection (CVSS 7.5, افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocom…)
- [CVE-2025-14451](https://cve.now/CVE-2025-14451.md): Solutions Ad Manager \<= 1.0.0 - Unauthenticated Open Redirect via 'sam-redirect-to' Parameter (CVSS 4.7, solutionsbysteve Solutions Ad Manager)
- [CVE-2025-9218](https://cve.now/CVE-2025-9218.md): rtMedia for WordPress, BuddyPress and bbPress 4.7.0 - 4.7.3 - Missing Authorization to Unauthenticated Information Disclosure via handle\_rest\_pre\_dispatch Function (CVSS 3.7, rtcamp rtMedia for WordPress, BuddyPress and bbPress)
- [CVE-2025-14288](https://cve.now/CVE-2025-14288.md): Gallery Blocks with Lightbox \<= 3.3.0 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Modification (CVSS 4.3, gallerycreator Mixed Media Gallery Blocks)
- [CVE-2025-13705](https://cve.now/CVE-2025-13705.md): Custom Frames \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Parameter (CVSS 6.4, blakelong Custom Frames)
- [CVE-2025-14476](https://cve.now/CVE-2025-14476.md): Doubly \<= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Import (CVSS 8.8, unitecms Doubly – Cross Domain Copy Paste for WordPress)
- [CVE-2025-14475](https://cve.now/CVE-2025-14475.md): Extensive VC Addons for WPBakery page builder \<= 1.9.1 - Unauthenticated Local File Inclusion via 'shortcode\_name' Parameter (CVSS 8.1, nenad-obradovic Extensive VC Addons for WPBakery page build…)
- [CVE-2025-14462](https://cve.now/CVE-2025-14462.md): Lucky Draw Contests \<= 4.2 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3, owais4377 Lucky Draw Contests)
- [CVE-2025-11376](https://cve.now/CVE-2025-11376.md): Colibri Page Builder \<= 1.0.335 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, extendthemes Colibri Page Builder)
- [CVE-2025-13094](https://cve.now/CVE-2025-13094.md): WP3D Model Import Viewer \<= 1.0.7 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, WP3D Model Import Viewer)
- [CVE-2025-14447](https://cve.now/CVE-2025-14447.md): AnnunciFunebri Impresa \<= 4.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Deletion (CVSS 4.3, pcantoni AnnunciFunebri)
- [CVE-2025-14397](https://cve.now/CVE-2025-14397.md): Postem Ipsum \<= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation in postem\_ipsum\_generate\_users (CVSS 8.8, franciscopalacios Postem Ipsum)
- [CVE-2025-14540](https://cve.now/CVE-2025-14540.md): Userback \<= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Plugin's Configuration Exposure (CVSS 4.3, Userback)
- [CVE-2025-14378](https://cve.now/CVE-2025-14378.md): Quick Testimonials \<= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, themeregion Quick Testimonials)
- [CVE-2025-14366](https://cve.now/CVE-2025-14366.md): Eyewear prescription form \<= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Product Creation (CVSS 5.3, dugudlabs Eyewear prescription form)
- [CVE-2025-9873](https://cve.now/CVE-2025-9873.md): a3 Lazy Load \<= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, a3rev a3 Lazy Load)
- [CVE-2025-14395](https://cve.now/CVE-2025-14395.md): Popover Windows \<= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX Actions (CVSS 4.3, melodicmedia Popover Windows)
- [CVE-2025-11970](https://cve.now/CVE-2025-11970.md): Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated \<= 1.0.9 - Authenticated (Admin+) Server-Side Request Forgery (CVSS 4.4, Emplibot – AI Content Writer with Keyword Research, Infogra…)
- [CVE-2025-14454](https://cve.now/CVE-2025-14454.md): Image Slider by Ays- Responsive Slider and Carousel \<= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion (CVSS 4.3, ays-pro Image Slider by Ays- Responsive Slider and Carousel)
- [CVE-2025-14050](https://cve.now/CVE-2025-14050.md): Design Import/Export \<= 2.2 - Authenticated (Administrator+) SQL Injection via XML File Import (CVSS 4.9, uxl Design Import/Export – Styles, Templates, Template Part…)
- [CVE-2025-13089](https://cve.now/CVE-2025-13089.md): WP Directory Kit \<= 1.4.7 - Unauthenticated SQL Injection (CVSS 7.5, wpdirectorykit WP Directory Kit)
- [CVE-2025-14278](https://cve.now/CVE-2025-14278.md): HT Slider for Elementor \<= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, htplugins HT Slider For Elementor)
- [CVE-2025-14056](https://cve.now/CVE-2025-14056.md): Custom Post Type UI \<= 1.18.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'label' Import Parameter (CVSS 4.4, webdevstudios Custom Post Type UI)
- [CVE-2025-12512](https://cve.now/CVE-2025-12512.md): GenerateBlocks \<= 2.1.2 - Authenticated (Contributor+) Information Exposure via Metadata (CVSS 4.3, edge22 GenerateBlocks)
- [CVE-2025-14581](https://cve.now/CVE-2025-14581.md): HAPPY – Helpdesk Support Ticket System \<= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Reply (CVSS 4.3, villatheme HAPPY – Helpdesk Support Ticket System)
- [CVE-2025-14477](https://cve.now/CVE-2025-14477.md): 404 Solution \<= 3.1.0 - Authenticated (Admin+) SQL Injection via 'filterText' Parameter (CVSS 4.9, aaron13100 404 Solution)
- [CVE-2025-13403](https://cve.now/CVE-2025-13403.md): Employee Spotlight – Team Member Showcase & Meet the Team Plugin \<= 5.1.3 - Missing Authorization to Authenticated (Subscriber+) Tracking Opt-In/Opt-Out Modification (CVSS 4.3, emarket-design Employee Spotlight – Team Member Showcase &…)
- [CVE-2025-13970](https://cve.now/CVE-2025-13970.md): OpenPLC\_V3 Cross-Site Request Forgery (CVSS 8.0, OpenPLC\_V3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.