CVEs published December 21, 2025
30 CVEs were published on December 21, 2025: 0 critical, 11 high.
- Published
- 30
- Critical
- 0
- High
- 11
- Medium
- 18
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Campcodes Complete Online Beauty Parlor Management System
- 2
- HappyDevs TempTool [Show Current Template Info]
- 2
- HappyFiles Pro
- 2
- SeaCMS
- 2
- Tenda AC18
- 2
- brainstormforce SureForms – Contact Form, Payment Form & Ot…
- 1
- codersaiful Product Table for WooCommerce
- 1
- dipesh_patel Web to SugarCRM Lead
- 1
- elextensions ELEX WordPress HelpDesk & Customer Ticketing S…
- 1
- hasthemes WC Builder – WooCommerce Page Builder for WPBakery
- 1
High 11
- CVE-2025-14995Tenda FH1201 SetIpBind sprintf stack-based overflowTenda FH1201
- CVE-2025-14994Tenda FH1201/FH1206 HTTP Request webtypelibrary strcat stack-based overflowTenda FH1201 · Tenda FH1206
- CVE-2025-14800Redirection for Contact Form 7 <= 3.2.7 - Unauthenticated Arbitrary File Copy via move_file_to_uploadthemeisle Redirection for Contact Form
- CVE-2025-14855SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scriptingbrainstormforce SureForms – Contact Form, Payment Form & Ot…
- CVE-2025-14993Tenda AC18 HTTP Request SetDlnaCfg sprintf stack-based overflowTenda AC18
- CVE-2025-14992Tenda AC18 HTTP Request GetParentControlInfo strcpy stack-based overflowTenda AC18
- CVE-2025-9343ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.4 - Unauthenticated Stored Cross-Site Scriptingelextensions ELEX WordPress HelpDesk & Customer Ticketing S…
- CVE-2025-68644Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses.Yealink RPS
- CVE-2025-12980Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposurewpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog…
- CVE-2025-14071Live Composer – Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) PHP Object Injection via dslc_module_posts_output Shortcodelivecomposer Live Composer – Free WordPress Website Builder
- CVE-2023-25446WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerabilityHappyFiles Pro
Medium, low and unrated 19
- CVE-2025-15003SeaCMS admin_video.php sql injectionSeaCMS
- CVE-2025-15002SeaCMS mysqli.class.php sql injectionSeaCMS
- CVE-2025-62901WordPress WP Microdata plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilitytormorten WP Microdata
- CVE-2025-62926WordPress TempTool [Show Current Template Info] plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerabilityHappyDevs TempTool [Show Current Template Info]
- CVE-2025-62955WordPress TempTool [Show Current Template Info] plugin <= 1.3.1 - Sensitive Data Exposure vulnerabilityHappyDevs TempTool [Show Current Template Info]
- CVE-2025-14991Campcodes Complete Online Beauty Parlor Management System bwdates-reports-details.php cross site scriptingCampcodes Complete Online Beauty Parlor Management System
- CVE-2025-13361Web to SugarCRM Lead <= 1.0.0 - Cross-Site Request Forgery to Custom Field Deletiondipesh_patel Web to SugarCRM Lead
- CVE-2025-13220Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesultimatemember Ultimate Member – User Profile, Registration…
- CVE-2025-12654Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.120 - Authenticated (Admin+) Arbitrary Directory Creationwpvividplugins WPvivid — Backup, Migration & Staging
- CVE-2025-13693Image Photo Gallery Final Tiles Grid <= 3.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'Custom Scripts' Settingwpchill Image Photo Gallery Final Tiles Grid
- CVE-2025-12398Product Table for WooCommerce <= 5.0.8 - Reflected Cross-Site Scriptingcodersaiful Product Table for WooCommerce
- CVE-2025-14990Campcodes Complete Online Beauty Parlor Management System view-appointment.php sql injectionCampcodes Complete Online Beauty Parlor Management System
- CVE-2025-14043Tainacan <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Metadata Section CreationTainacan
- CVE-2025-14054WC Builder <= 1.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'heading_color' Shortcode Attributehasthemes WC Builder – WooCommerce Page Builder for WPBakery
- CVE-2025-13838WishSuite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attributehtplugins WishSuite – Wishlist for WooCommerce
- CVE-2025-14080Frontend Post Submission Manager Lite <= 1.2.5 - Missing Authorization to Unauthenticated Arbitrary Post Modificationwpshuffle Frontend Post Submission Manager Lite – Frontend…
- CVE-2025-11496Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.5 - Unauthenticated Stored Cross-Site Scriptingrustaurius Five Star Restaurant Reservations – WordPress Bo…
- CVE-2023-47232WordPress WP Affiliate Disclosure plugin <= 1.2.6 - Broken Access Control + CSRF vulnerabilitymojofywp WP Affiliate Disclosure
- CVE-2023-25445WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerabilityHappyFiles Pro