# CVEs published 2025-12-20

24 CVEs were published on December 20, 2025: 2 critical, 5 high. Days are UTC.

- [CVE-2023-25068](https://cve.now/CVE-2023-25068.md): WordPress Magazine Edge theme \<= 1.13 - Authenticated Arbitrary Plugin Activation (CVSS 4.3, Mapro Collins Magazine Edge)
- [CVE-2025-14989](https://cve.now/CVE-2025-14989.md): Campcodes Complete Online Beauty Parlor Management System search-invoices.php sql injection (CVSS 6.9, Campcodes Complete Online Beauty Parlor Management System)
- [CVE-2025-34290](https://cve.now/CVE-2025-34290.md): Versa SASE Client for Windows \< 7.9.5 Arbitrary Folder Deletion Leading to Local Privilege Escalation (CVSS 8.5, Versa Networks SASE Client for Windows)
- [CVE-2025-7782](https://cve.now/CVE-2025-7782.md): WP JobHunt \<= 7.7 - Missing Authorization to Authenticated (Candidate+) Stored Cross-Site Scripting via 'status' (CVSS 7.6, WP JobHunt)
- [CVE-2025-7733](https://cve.now/CVE-2025-7733.md): WP JobHunt \<= 7.7 - Authenticated (Candidate+) Insecure Direct Object Reference (CVSS 4.3, WP JobHunt)
- [CVE-2025-14298](https://cve.now/CVE-2025-14298.md): FiboSearch – Ajax Search for WooCommerce \<= 1.32.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via thegem\_te\_search Shortcode (CVSS 5.4, damian-gora FiboSearch – Ajax Search for WooCommerce)
- [CVE-2025-12492](https://cve.now/CVE-2025-12492.md): Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin \<= 2.11.0 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2025-13619](https://cve.now/CVE-2025-13619.md): Flex Store Users \<= 1.1.0 - Unauthenticated Privilege Escalation (CVSS 9.8, CMSSuperHeroes Flex Store Users)
- [CVE-2025-12820](https://cve.now/CVE-2025-12820.md): Pure WC Variation Swatches \<= 1.1.7 - Unauthenticated Settings Update (CVSS 5.3, Pure WC Variation Swatches)
- [CVE-2025-13365](https://cve.now/CVE-2025-13365.md): WP Hallo Welt \<= 1.4. - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, tikolan WP Hallo Welt)
- [CVE-2025-12581](https://cve.now/CVE-2025-12581.md): Attachments Handler \<= 1.1.7 - Reflected Cross-Site Scripting (CVSS 6.1, kaizencoders Attachments Handler)
- [CVE-2025-13329](https://cve.now/CVE-2025-13329.md): File Uploader for WooCommerce \<= 1.0.3 - Unauthenticated Arbitrary File Upload via add-image-data (CVSS 9.8, snowray File Uploader for WooCommerce)
- [CVE-2025-14168](https://cve.now/CVE-2025-14168.md): WP DB Booster \<= 1.0.1 - Cross-Site Request Forgery to Database Cleanup (CVSS 4.3, wpmaniax WP DB Booster)
- [CVE-2025-13624](https://cve.now/CVE-2025-13624.md): Overstock Affiliate Links \<= 1.1 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 6.1, travishoki Overstock Affiliate Links)
- [CVE-2025-14633](https://cve.now/CVE-2025-14633.md): F70 Lead Document Download \<= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Media File Download (CVSS 5.3, niao70 F70 Lead Document Download)
- [CVE-2025-14721](https://cve.now/CVE-2025-14721.md): Responsive and Swipe slider \<= 1.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.5, mansoormunib RESPONSIVE AND SWIPE SLIDER!)
- [CVE-2025-12898](https://cve.now/CVE-2025-12898.md): Pretty Google Calendar \<= 2.0.0 - Missing Authorization to Unauthenticated Google API Key Exposure (CVSS 5.3, lbell Pretty Google Calendar)
- [CVE-2025-14734](https://cve.now/CVE-2025-14734.md): Amazon affiliate lite Plugin \<= 1.0.0 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 5.4, nestornoe Amazon affiliate lite Plugin)
- [CVE-2025-14164](https://cve.now/CVE-2025-14164.md): Quran Gateway \<= 1.5 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, edckwt Quran Gateway)
- [CVE-2025-14735](https://cve.now/CVE-2025-14735.md): Amazon affiliate lite Plugin \<= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, nestornoe Amazon affiliate lite Plugin)
- [CVE-2025-14591](https://cve.now/CVE-2025-14591.md): PII Leak Due to Change in EOR Handling (CVSS 5.3, Perforce Delphix Continuous Compliance)
- [CVE-2025-14300](https://cve.now/CVE-2025-14300.md): Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425 (CVSS 8.7, TP-Link Systems Tapo C200 · TP Link Systems Tapo C100 +1)
- [CVE-2025-14299](https://cve.now/CVE-2025-14299.md): Improper Content-Length Validation in HTTPS Requests on Tapo C200 (CVSS 7.1, TP-Link Systems Tapo C200)
- [CVE-2025-8065](https://cve.now/CVE-2025-8065.md): Remote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WS (CVSS 8.7, TP-Link Systems Tapo C200 · TP-Link Systems Tapo C520WS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.