Vulnerability database

11,289 results · page 104 of 226

• Apr 15, 2025Tainá: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26919 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tainacan Tainá taina allows Stored XSS.This issue affects Tainá: from n/a through < 0.2.5.

  Product

  Tainá

  What to do

  Update Tainá to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025Kargo Entegratör: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26908 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gurmehub Kargo Entegratör kargo-entegrator allows SQL Injection.This issue affects Kargo Entegratör: from n/a through <= 1.1.14.

  Product

  Kargo Entegratör

  Affected

  up to 1.1.14

  What to do

  Affects up to 1.1.14. Update Kargo Entegratör to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025WP Delete User Accounts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26906 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ren Ventura WP Delete User Accounts wp-delete-user-accounts allows DOM-Based XSS.This issue affects WP Delete User Accounts: from n/a through <= 1.2.3.

  Product

  WP Delete User Accounts

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update WP Delete User Accounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025SKT Skill Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26880 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar skt-skill-bar allows Stored XSS.This issue affects SKT Skill Bar: from n/a through <= 2.3.

  Product

  SKT Skill Bar

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update SKT Skill Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26870 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through <= 3.6.4.1.

  Product

  JetEngine

  Affected

  up to 3.6.4.1

  What to do

  Affects up to 3.6.4.1. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025Additional Custom Product Tabs for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26749 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce product-tabs-for-woocommerce allows Stored XSS.This issue affects Additional Custom Product Tabs for WooCommerce: from n/a through <= 1.7.0.

  Product

  Additional Custom Product Tabs for WooCommerce

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update Additional Custom Product Tabs for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025Advanced Custom Fields: Link Picker Field: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26746 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in caalami Advanced Custom Fields: Link Picker Field acf-link-picker-field allows Reflected XSS.This issue affects Advanced Custom Fields: Link Picker Field: from n/a through <= 1.2.8.

  Product

  Advanced Custom Fields: Link Picker Field

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update Advanced Custom Fields: Link Picker Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025SpaBiz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26740 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burgersoftware SpaBiz spabiz allows DOM-Based XSS.This issue affects SpaBiz: from n/a through <= 1.0.18.

  Product

  SpaBiz

  Affected

  up to 1.0.18

  What to do

  Affects up to 1.0.18. Update SpaBiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025Real Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22269 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Stored XSS.This issue affects Real Testimonials: from n/a through <= 3.1.6.

  Product

  Real Testimonials

  Affected

  up to 3.1.6

  What to do

  Affects up to 3.1.6. Update Real Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025Uncanny Toolkit for LearnDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22268 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.1.

  Product

  Uncanny Toolkit for LearnDash

  Affected

  up to 3.7.0.1

  What to do

  Affects up to 3.7.0.1. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025Global Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22263 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Global Gallery allows Reflected XSS. This issue affects Global Gallery: from n/a through 8.8.0.

  Product

  Global Gallery

  Affected

  up to 8.8.0

  What to do

  Affects up to 8.8.0. Update Global Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025SimplyRETS Real Estate IDX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31011 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through <= 3.2.2.

  Product

  SimplyRETS Real Estate IDX

  Affected

  up to 3.2.2

  What to do

  Affects up to 3.2.2. Update SimplyRETS Real Estate IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025FS Poster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30962 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fs-code FS Poster fs-poster allows Reflected XSS.This issue affects FS Poster: from n/a through <= 6.5.8.

  Product

  FS Poster

  Affected

  up to 6.5.8

  What to do

  Affects up to 6.5.8. Update FS Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025Landing Page Cat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26992 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Landing Page Cat landing-page-cat allows Reflected XSS.This issue affects Landing Page Cat: from n/a through <= 1.7.8.

  Product

  Landing Page Cat

  Affected

  up to 1.7.8

  What to do

  Affects up to 1.7.8. Update Landing Page Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025DSGVO Youtube: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26982 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric-Oliver Mächler DSGVO Youtube dsgvo-youtube allows DOM-Based XSS.This issue affects DSGVO Youtube: from n/a through <= 1.5.1.

  Product

  DSGVO Youtube

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update DSGVO Youtube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025ZooEffect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26954 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 1pluginjquery ZooEffect 1-jquery-photo-gallery-slideshow-flash allows Reflected XSS.This issue affects ZooEffect: from n/a through <= 1.11.

  Product

  ZooEffect

  Affected

  up to 1.11

  What to do

  Affects up to 1.11. Update ZooEffect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025Coming Soon, Maintenance Mode: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26894 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mobeen Abdullah Coming Soon, Maintenance Mode site-mode allows PHP Local File Inclusion.This issue affects Coming Soon, Maintenance Mode: from n/a through <= 1.1.1.

  Product

  Coming Soon, Maintenance Mode

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Coming Soon, Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025hockeydata LOS: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26889 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hockeydata hockeydata LOS hockeydata-los allows PHP Local File Inclusion.This issue affects hockeydata LOS: from n/a through <= 1.2.4.

  Product

  hockeydata LOS

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update hockeydata LOS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025RS Elements Elementor Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26745 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RSTheme RS Elements Elementor Addon rselements-lite allows Stored XSS.This issue affects RS Elements Elementor Addon: from n/a through <= 1.1.5.

  Product

  RS Elements Elementor Addon

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update RS Elements Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025JetBlog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26744 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows DOM-Based XSS.This issue affects JetBlog: from n/a through <= 2.4.3.

  Product

  JetBlog

  Affected

  up to 2.4.3

  What to do

  Affects up to 2.4.3. Update JetBlog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2025Advance WP Query Search Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26743 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TC.K Advance WP Query Search Filter advance-wp-query-search-filter allows Reflected XSS.This issue affects Advance WP Query Search Filter: from n/a through <= 1.0.10.

  Product

  Advance WP Query Search Filter

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update Advance WP Query Search Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 12, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Insecure Direct Object ReferenceCVE-2025-3292 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to update other user's passwords, if they have access to the user ID and email.

  Product

  User Registration & Membership – Custom Registration Form, Login Form, and User Profile

  Affected

  up to 4.1.3

  What to do

  Affects up to 4.1.3. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 12, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Insecure Direct Object ReferenceCVE-2025-3282 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_membership_register_member() due to missing validation on the 'membership_id' user controlled key. This makes it possible for unauthenticated attackers to update any user's membership to any other active or non-active membership type.

  Product

  User Registration & Membership – Custom Registration Form, Login Form, and User Profile

  Affected

  up to 4.1.3

  What to do

  Affects up to 4.1.3. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Apr 11, 2025WP Project Manager: Stored Cross-Site ScriptingCVE-2025-2541 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The WP Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

  Product

  WP Project Manager

  Affected

  up to 2.6.22

  What to do

  Affects up to 2.6.22. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 11, 2025Error Log Viewer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32681 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Guru Error Log Viewer error-log-viewer-wp allows Blind SQL Injection.This issue affects Error Log Viewer: from n/a through <= 1.0.5.

  Product

  Error Log Viewer

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Error Log Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Ultimate Bootstrap Elements for Elementor: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32672 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Ultimate Bootstrap Elements for Elementor ultimate-bootstrap-elements-for-elementor allows PHP Local File Inclusion.This issue affects Ultimate Bootstrap Elements for Elementor: from n/a through <= 1.4.9.

  Product

  Ultimate Bootstrap Elements for Elementor

  Affected

  up to 1.4.9

  What to do

  Affects up to 1.4.9. Update Ultimate Bootstrap Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Print Science Designer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32671 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in John Weissberg Print Science Designer print-science-designer allows Path Traversal.This issue affects Print Science Designer: from n/a through <= 1.3.155.

  Product

  Print Science Designer

  Affected

  up to 1.3.155

  What to do

  Affects up to 1.3.155. Update Print Science Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025FAT Cooming Soon: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32663 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in roninwp FAT Cooming Soon fat-coming-soon allows PHP Local File Inclusion.This issue affects FAT Cooming Soon: from n/a through <= 1.1.

  Product

  FAT Cooming Soon

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update FAT Cooming Soon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Testimonial Slider And Showcase Pro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32656 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Testimonial Slider And Showcase Pro testimonial-slider-showcase-pro allows PHP Local File Inclusion.This issue affects Testimonial Slider And Showcase Pro: from n/a through <= 2.3.15.

  Product

  Testimonial Slider And Showcase Pro

  Affected

  up to 2.3.15

  What to do

  Affects up to 2.3.15. Update Testimonial Slider And Showcase Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Motors: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32654 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Stylemix Motors motors-car-dealership-classified-listings allows PHP Local File Inclusion.This issue affects Motors: from n/a through <= 1.4.71.

  Product

  Motors

  Affected

  up to 1.4.71

  What to do

  Affects up to 1.4.71. Update Motors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Accessibility Suite: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32650 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ability, Inc Accessibility Suite online-accessibility allows SQL Injection.This issue affects Accessibility Suite: from n/a through <= 4.18.

  Product

  Accessibility Suite

  Affected

  up to 4.18

  What to do

  Affects up to 4.18. Update Accessibility Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Database Toolset: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32633 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in neoslab Database Toolset database-toolset allows Path Traversal.This issue affects Database Toolset: from n/a through <= 1.8.4.

  Product

  Database Toolset

  Affected

  up to 1.8.4

  What to do

  Affects up to 1.8.4. Update Database Toolset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Automatic Ban IP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32632 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders Automatic Ban IP automatic-ban-ip allows Reflected XSS.This issue affects Automatic Ban IP: from n/a through <= 1.0.7.

  Product

  Automatic Ban IP

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Automatic Ban IP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Oxygen MyData for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32631 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in oxygensuite Oxygen MyData for WooCommerce oxygen-mydata allows Path Traversal.This issue affects Oxygen MyData for WooCommerce: from n/a through <= 1.0.64.

  Product

  Oxygen MyData for WooCommerce

  Affected

  up to 1.0.64

  What to do

  Affects up to 1.0.64. Update Oxygen MyData for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025WP-BusinessDirectory: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32629 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Path Traversal.This issue affects WP-BusinessDirectory: from n/a through <= 3.1.2.

  Product

  WP-BusinessDirectory

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update WP-BusinessDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025JS Job Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32627 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Job Manager js-jobs allows PHP Local File Inclusion.This issue affects JS Job Manager: from n/a through <= 2.0.2.

  Product

  JS Job Manager

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update JS Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Wishlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32618 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This issue affects Wishlist: from n/a through <= 1.0.46.

  Product

  Wishlist

  Affected

  up to 1.0.46

  What to do

  Affects up to 1.0.46. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025EventON: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32614 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashan Perera EventON eventon-lite allows PHP Local File Inclusion.This issue affects EventON: from n/a through <= 2.4.

  Product

  EventON

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025WP Online Users Stats: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32603 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HK WP Online Users Stats wp-online-users-stats allows Blind SQL Injection.This issue affects WP Online Users Stats: from n/a through <= 1.0.0.

  Product

  WP Online Users Stats

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update WP Online Users Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Twispay Credit Card Payments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32601 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in twispay Twispay Credit Card Payments twispay allows Reflected XSS.This issue affects Twispay Credit Card Payments: from n/a through <= 2.1.2.

  Product

  Twispay Credit Card Payments

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Twispay Credit Card Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Tournamatch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32600 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tournamatch Tournamatch tournamatch allows Reflected XSS.This issue affects Tournamatch: from n/a through <= 4.7.0.

  Product

  Tournamatch

  Affected

  up to 4.7.0

  What to do

  Affects up to 4.7.0. Update Tournamatch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Task Scheduler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32599 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in miunosoft Task Scheduler task-scheduler allows Reflected XSS.This issue affects Task Scheduler: from n/a through <= 1.6.3.

  Product

  Task Scheduler

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update Task Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025WP Table Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32598 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Reflected XSS.This issue affects WP Table Builder: from n/a through <= 2.0.5.

  Product

  WP Table Builder

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update WP Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Flexi – Guest Submit: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32589 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in odude Flexi – Guest Submit flexi allows PHP Local File Inclusion.This issue affects Flexi – Guest Submit: from n/a through <= 4.28.

  Product

  Flexi – Guest Submit

  Affected

  up to 4.28

  What to do

  Affects up to 4.28. Update Flexi – Guest Submit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025WooCommerce Pickupp: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32587 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pickupp WooCommerce Pickupp wc-pickupp allows PHP Local File Inclusion.This issue affects WooCommerce Pickupp: from n/a through <= 2.4.3.

  Product

  WooCommerce Pickupp

  Affected

  up to 2.4.3

  What to do

  Affects up to 2.4.3. Update WooCommerce Pickupp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025ABA PayWay Payment Gateway for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32586 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABA Bank ABA PayWay Payment Gateway for WooCommerce aba-payway-woocommerce-payment-gateway allows Reflected XSS.This issue affects ABA PayWay Payment Gateway for WooCommerce: from n/a through <= 2.1.4.

  Product

  ABA PayWay Payment Gateway for WooCommerce

  Affected

  up to 2.1.4

  What to do

  Affects up to 2.1.4. Update ABA PayWay Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Shop Products Filter: Path Traversal: '.../...//'CVE-2025-32585 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Path Traversal: '.../...//' vulnerability in Trusty Plugins Shop Products Filter trusty-woo-products-filter allows PHP Local File Inclusion.This issue affects Shop Products Filter: from n/a through <= 1.2.

  Product

  Shop Products Filter

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Shop Products Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Build App Online: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32577 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-online allows PHP Local File Inclusion.This issue affects Build App Online: from n/a through <= 1.0.23.

  Product

  Build App Online

  Affected

  up to 1.0.23

  What to do

  Affects up to 1.0.23. Update Build App Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Easy Post Duplicator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32567 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in dev02ali Easy Post Duplicator easy-post-duplicator allows SQL Injection.This issue affects Easy Post Duplicator: from n/a through <= 1.0.1.

  Product

  Easy Post Duplicator

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Easy Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Neon Product Designer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32565 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vertim Neon Product Designer neon-product-designer-for-woocommerce allows SQL Injection.This issue affects Neon Product Designer: from n/a through <= 2.2.0.

  Product

  Neon Product Designer

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update Neon Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.