CVEs published December 20, 2025
24 CVEs were published on December 20, 2025: 2 critical, 5 high.
- Published
- 24
- Critical
- 2
- High
- 5
- Medium
- 17
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- nestornoe Amazon affiliate lite Plugin
- 2
- WP JobHunt
- 2
- Campcodes Complete Online Beauty Parlor Management System
- 1
- CMSSuperHeroes Flex Store Users
- 1
- damian-gora FiboSearch – Ajax Search for WooCommerce
- 1
- edckwt Quran Gateway
- 1
- kaizencoders Attachments Handler
- 1
- lbell Pretty Google Calendar
- 1
- mansoormunib RESPONSIVE AND SWIPE SLIDER!
- 1
- Mapro Collins Magazine Edge
- 1
Critical 2
High 5
- CVE-2025-34290Versa SASE Client for Windows < 7.9.5 Arbitrary Folder Deletion Leading to Local Privilege EscalationVersa Networks SASE Client for Windows
- CVE-2025-7782WP JobHunt <= 7.7 - Missing Authorization to Authenticated (Candidate+) Stored Cross-Site Scripting via 'status'WP JobHunt
- CVE-2025-14300Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425TP-Link Systems Tapo C200 · TP Link Systems Tapo C100 +1
- CVE-2025-14299Improper Content-Length Validation in HTTPS Requests on Tapo C200TP-Link Systems Tapo C200
- CVE-2025-8065Remote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WSTP-Link Systems Tapo C200 · TP-Link Systems Tapo C520WS
Medium, low and unrated 17
- CVE-2023-25068WordPress Magazine Edge theme <= 1.13 - Authenticated Arbitrary Plugin ActivationMapro Collins Magazine Edge
- CVE-2025-14989Campcodes Complete Online Beauty Parlor Management System search-invoices.php sql injectionCampcodes Complete Online Beauty Parlor Management System
- CVE-2025-7733WP JobHunt <= 7.7 - Authenticated (Candidate+) Insecure Direct Object ReferenceWP JobHunt
- CVE-2025-14298FiboSearch – Ajax Search for WooCommerce <= 1.32.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via thegem_te_search Shortcodedamian-gora FiboSearch – Ajax Search for WooCommerce
- CVE-2025-12492Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposureultimatemember Ultimate Member – User Profile, Registration…
- CVE-2025-12820Pure WC Variation Swatches <= 1.1.7 - Unauthenticated Settings UpdatePure WC Variation Swatches
- CVE-2025-13365WP Hallo Welt <= 1.4. - Cross-Site Request Forgery to Stored Cross-Site Scriptingtikolan WP Hallo Welt
- CVE-2025-12581Attachments Handler <= 1.1.7 - Reflected Cross-Site Scriptingkaizencoders Attachments Handler
- CVE-2025-14168WP DB Booster <= 1.0.1 - Cross-Site Request Forgery to Database Cleanupwpmaniax WP DB Booster
- CVE-2025-13624Overstock Affiliate Links <= 1.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']travishoki Overstock Affiliate Links
- CVE-2025-14633F70 Lead Document Download <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Media File Downloadniao70 F70 Lead Document Download
- CVE-2025-14721Responsive and Swipe slider <= 1.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting via Shortcodemansoormunib RESPONSIVE AND SWIPE SLIDER!
- CVE-2025-12898Pretty Google Calendar <= 2.0.0 - Missing Authorization to Unauthenticated Google API Key Exposurelbell Pretty Google Calendar
- CVE-2025-14734Amazon affiliate lite Plugin <= 1.0.0 - Cross-Site Request Forgery to Plugin Settings Updatenestornoe Amazon affiliate lite Plugin
- CVE-2025-14164Quran Gateway <= 1.5 - Cross-Site Request Forgery to Settings Updateedckwt Quran Gateway
- CVE-2025-14735Amazon affiliate lite Plugin <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scriptingnestornoe Amazon affiliate lite Plugin
- CVE-2025-14591PII Leak Due to Change in EOR HandlingPerforce Delphix Continuous Compliance