# CVEs published 2025-12-21 30 CVEs were published on December 21, 2025: 0 critical, 11 high. Days are UTC. - [CVE-2025-15003](https://cve.now/CVE-2025-15003.md): SeaCMS admin\_video.php sql injection (CVSS 5.1, SeaCMS) - [CVE-2025-15002](https://cve.now/CVE-2025-15002.md): SeaCMS mysqli.class.php sql injection (CVSS 6.9, SeaCMS) - [CVE-2025-62901](https://cve.now/CVE-2025-62901.md): WordPress WP Microdata plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, tormorten WP Microdata) - [CVE-2025-62926](https://cve.now/CVE-2025-62926.md): WordPress TempTool \[Show Current Template Info\] plugin \<= 1.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, HappyDevs TempTool \[Show Current Template Info\]) - [CVE-2025-62955](https://cve.now/CVE-2025-62955.md): WordPress TempTool \[Show Current Template Info\] plugin \<= 1.3.1 - Sensitive Data Exposure vulnerability (CVSS 4.3, HappyDevs TempTool \[Show Current Template Info\]) - [CVE-2025-14995](https://cve.now/CVE-2025-14995.md): Tenda FH1201 SetIpBind sprintf stack-based overflow (CVSS 8.7, Tenda FH1201) - [CVE-2025-14994](https://cve.now/CVE-2025-14994.md): Tenda FH1201/FH1206 HTTP Request webtypelibrary strcat stack-based overflow (CVSS 8.7, Tenda FH1201 · Tenda FH1206) - [CVE-2025-14800](https://cve.now/CVE-2025-14800.md): Redirection for Contact Form 7 \<= 3.2.7 - Unauthenticated Arbitrary File Copy via move\_file\_to\_upload (CVSS 8.1, themeisle Redirection for Contact Form) - [CVE-2025-14855](https://cve.now/CVE-2025-14855.md): SureForms \<= 2.2.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, brainstormforce SureForms – Contact Form, Payment Form & Ot…) - [CVE-2025-14993](https://cve.now/CVE-2025-14993.md): Tenda AC18 HTTP Request SetDlnaCfg sprintf stack-based overflow (CVSS 8.7, Tenda AC18) - [CVE-2025-14992](https://cve.now/CVE-2025-14992.md): Tenda AC18 HTTP Request GetParentControlInfo strcpy stack-based overflow (CVSS 8.7, Tenda AC18) - [CVE-2025-14991](https://cve.now/CVE-2025-14991.md): Campcodes Complete Online Beauty Parlor Management System bwdates-reports-details.php cross site scripting (CVSS 4.8, Campcodes Complete Online Beauty Parlor Management System) - [CVE-2025-13361](https://cve.now/CVE-2025-13361.md): Web to SugarCRM Lead \<= 1.0.0 - Cross-Site Request Forgery to Custom Field Deletion (CVSS 4.3, dipesh\_patel Web to SugarCRM Lead) - [CVE-2025-13220](https://cve.now/CVE-2025-13220.md): Ultimate Member \<= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, ultimatemember Ultimate Member – User Profile, Registration…) - [CVE-2025-12654](https://cve.now/CVE-2025-12654.md): Migration, Backup, Staging – WPvivid Backup & Migration \<= 0.9.120 - Authenticated (Admin+) Arbitrary Directory Creation (CVSS 2.7, wpvividplugins WPvivid — Backup, Migration & Staging) - [CVE-2025-13693](https://cve.now/CVE-2025-13693.md): Image Photo Gallery Final Tiles Grid \<= 3.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'Custom Scripts' Setting (CVSS 6.4, wpchill Image Photo Gallery Final Tiles Grid) - [CVE-2025-12398](https://cve.now/CVE-2025-12398.md): Product Table for WooCommerce \<= 5.0.8 - Reflected Cross-Site Scripting (CVSS 6.1, codersaiful Product Table for WooCommerce) - [CVE-2025-9343](https://cve.now/CVE-2025-9343.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.4 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, elextensions ELEX WordPress HelpDesk & Customer Ticketing S…) - [CVE-2025-14990](https://cve.now/CVE-2025-14990.md): Campcodes Complete Online Beauty Parlor Management System view-appointment.php sql injection (CVSS 6.9, Campcodes Complete Online Beauty Parlor Management System) - [CVE-2025-68644](https://cve.now/CVE-2025-68644.md): Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. (CVSS 7.4, Yealink RPS) - [CVE-2025-12980](https://cve.now/CVE-2025-12980.md): Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX \<= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 7.5, wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog…) - [CVE-2025-14043](https://cve.now/CVE-2025-14043.md): Tainacan \<= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Metadata Section Creation (CVSS 5.3, Tainacan) - [CVE-2025-14054](https://cve.now/CVE-2025-14054.md): WC Builder \<= 1.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'heading\_color' Shortcode Attribute (CVSS 4.4, hasthemes WC Builder – WooCommerce Page Builder for WPBakery) - [CVE-2025-13838](https://cve.now/CVE-2025-13838.md): WishSuite \<= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button\_text' Shortcode Attribute (CVSS 6.4, htplugins WishSuite – Wishlist for WooCommerce) - [CVE-2025-14071](https://cve.now/CVE-2025-14071.md): Live Composer – Free WordPress Website Builder \<= 2.0.2 - Authenticated (Contributor+) PHP Object Injection via dslc\_module\_posts\_output Shortcode (CVSS 7.5, livecomposer Live Composer – Free WordPress Website Builder) - [CVE-2025-14080](https://cve.now/CVE-2025-14080.md): Frontend Post Submission Manager Lite \<= 1.2.5 - Missing Authorization to Unauthenticated Arbitrary Post Modification (CVSS 5.3, wpshuffle Frontend Post Submission Manager Lite – Frontend…) - [CVE-2025-11496](https://cve.now/CVE-2025-11496.md): Five Star Restaurant Reservations – WordPress Booking Plugin \<= 2.7.5 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1, rustaurius Five Star Restaurant Reservations – WordPress Bo…) - [CVE-2023-47232](https://cve.now/CVE-2023-47232.md): WordPress WP Affiliate Disclosure plugin \<= 1.2.6 - Broken Access Control + CSRF vulnerability (CVSS 4.3, mojofywp WP Affiliate Disclosure) - [CVE-2023-25446](https://cve.now/CVE-2023-25446.md): WordPress HappyFiles Pro plugin \<= 1.8.1 - Broken Access Control vulnerability (CVSS 7.7, HappyFiles Pro) - [CVE-2023-25445](https://cve.now/CVE-2023-25445.md): WordPress HappyFiles Pro plugin \<= 1.8.1 - Broken Access Control vulnerability (CVSS 5.4, HappyFiles Pro) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-12-21 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.