Vulnerability database

11,289 results · page 105 of 226

• Apr 11, 2025Duplicate Title Checker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32558 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ketanajani Duplicate Title Checker duplicate-title-checker allows Blind SQL Injection.This issue affects Duplicate Title Checker: from n/a through <= 1.2.

  Product

  Duplicate Title Checker

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Duplicate Title Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025RestroPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32553 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Reflected XSS.This issue affects RestroPress: from n/a through <= 3.2.8.4.

  Product

  RestroPress

  Affected

  up to 3.2.8.4

  What to do

  Affects up to 3.2.8.4. Update RestroPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Connector to CiviCRM with CiviMcRestFace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32551 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jaap Jansma Connector to CiviCRM with CiviMcRestFace connector-civicrm-mcrestface allows Reflected XSS.This issue affects Connector to CiviCRM with CiviMcRestFace: from n/a through <= 1.0.8.

  Product

  Connector to CiviCRM with CiviMcRestFace

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Connector to CiviCRM with CiviMcRestFace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025WooCommerce Sales MIS Report: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32541 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in infosoftplugin WooCommerce Sales MIS Report woocommerce-mis-report allows Reflected XSS.This issue affects WooCommerce Sales MIS Report: from n/a through <= 4.0.3.

  Product

  WooCommerce Sales MIS Report

  Affected

  up to 4.0.3

  What to do

  Affects up to 4.0.3. Update WooCommerce Sales MIS Report to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Store Exporter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32539 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Kohlbach Store Exporter woocommerce-exporter allows Reflected XSS.This issue affects Store Exporter: from n/a through <= 2.7.4.

  Product

  Store Exporter

  Affected

  up to 2.7.4

  What to do

  Affects up to 2.7.4. Update Store Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Easy Post Duplicator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32538 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dev02ali Easy Post Duplicator easy-post-duplicator allows Reflected XSS.This issue affects Easy Post Duplicator: from n/a through <= 1.0.1.

  Product

  Easy Post Duplicator

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Easy Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Lock Your Updates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32537 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry Lock Your Updates lock-your-updates allows Reflected XSS.This issue affects Lock Your Updates: from n/a through <= 1.1.

  Product

  Lock Your Updates

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Lock Your Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025HTML5 Video Player with Playlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32536 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sandeep Verma HTML5 Video Player with Playlist html5-video-player-with-playlist allows Reflected XSS.This issue affects HTML5 Video Player with Playlist: from n/a through <= 2.50.

  Product

  HTML5 Video Player with Playlist

  Affected

  up to 2.50

  What to do

  Affects up to 2.50. Update HTML5 Video Player with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Workbox Video from Vimeo & Youtube: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32534 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Workbox Workbox Video from Vimeo & Youtube workbox-video-from-vimeo-youtube-plugin allows Reflected XSS.This issue affects Workbox Video from Vimeo & Youtube: from n/a through <= 3.2.2.

  Product

  Workbox Video from Vimeo & Youtube

  Affected

  up to 3.2.2

  What to do

  Affects up to 3.2.2. Update Workbox Video from Vimeo & Youtube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Interactive Geo Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32525 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MapGeo Interactive Geo Maps interactive-geo-maps allows Reflected XSS.This issue affects Interactive Geo Maps: from n/a through <= 1.6.24.

  Product

  Interactive Geo Maps

  Affected

  up to 1.6.24

  What to do

  Affects up to 1.6.24. Update Interactive Geo Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025MyWorks WooCommerce Sync for QuickBooks Online: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32524 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyWorks MyWorks WooCommerce Sync for QuickBooks Online myworks-woo-sync-for-quickbooks-online allows Reflected XSS.This issue affects MyWorks WooCommerce Sync for QuickBooks Online: from n/a through <= 2.9.1.

  Product

  MyWorks WooCommerce Sync for QuickBooks Online

  Affected

  up to 2.9.1

  What to do

  Affects up to 2.9.1. Update MyWorks WooCommerce Sync for QuickBooks Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025WooCommerce – Payphone Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32523 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in payphone WooCommerce – Payphone Gateway wc-payphone-gateway allows Reflected XSS.This issue affects WooCommerce – Payphone Gateway: from n/a through <= 3.2.0.

  Product

  WooCommerce – Payphone Gateway

  Affected

  up to 3.2.0

  What to do

  Affects up to 3.2.0. Update WooCommerce – Payphone Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025IDonate: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32519 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Foysal Imran IDonate idonate allows PHP Local File Inclusion.This issue affects IDonate: from n/a through <= 2.1.18.

  Product

  IDonate

  Affected

  up to 2.1.18

  What to do

  Affects up to 2.1.18. Update IDonate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025MultiMailer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32517 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SCAND MultiMailer scand-multi-mailer allows Reflected XSS.This issue affects MultiMailer: from n/a through <= 1.0.3.

  Product

  MultiMailer

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update MultiMailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Simple WP Events: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32509 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMinds Simple WP Events simple-wp-events allows Path Traversal.This issue affects Simple WP Events: from n/a through <= 1.8.17.

  Product

  Simple WP Events

  Affected

  up to 1.8.17

  What to do

  Affects up to 1.8.17. Update Simple WP Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Bulk Product Sync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31599 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N-Media Bulk Product Sync sync-wc-google allows SQL Injection.This issue affects Bulk Product Sync: from n/a through <= 8.6.

  Product

  Bulk Product Sync

  Affected

  up to 8.6

  What to do

  Affects up to 8.6. Update Bulk Product Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025WPSmartContracts: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31565 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lisandro Martinez WPSmartContracts wp-smart-contracts allows Blind SQL Injection.This issue affects WPSmartContracts: from n/a through <= 2.0.12.

  Product

  WPSmartContracts

  Affected

  up to 2.0.12

  What to do

  Affects up to 2.0.12. Update WPSmartContracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Insert HTML Here: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31379 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in programphases Insert HTML Here insert-html-here allows Reflected XSS.This issue affects Insert HTML Here: from n/a through <= 1.0.

  Product

  Insert HTML Here

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Insert HTML Here to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Oppso Unit Converter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31378 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in danbwb Oppso Unit Converter oppso-unit-converter allows Reflected XSS.This issue affects Oppso Unit Converter: from n/a through <= 1.1.1.

  Product

  Oppso Unit Converter

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Oppso Unit Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025WP Food ordering and Restaurant Menu: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31040 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Exthemes WP Food ordering and Restaurant Menu wp-food allows PHP Local File Inclusion.This issue affects WP Food ordering and Restaurant Menu: from n/a through <= 2.7.

  Product

  WP Food ordering and Restaurant Menu

  Affected

  up to 2.7

  What to do

  Affects up to 2.7. Update WP Food ordering and Restaurant Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025WP Hide Categories: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31028 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Huseyin Berberoglu WP Hide Categories wp-hide-categories allows Reflected XSS.This issue affects WP Hide Categories: from n/a through <= 1.0.

  Product

  WP Hide Categories

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP Hide Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Mobile Smart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31021 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dolby_uk Mobile Smart mobile-smart allows Reflected XSS.This issue affects Mobile Smart: from n/a through <= v1.3.16.

  Product

  Mobile Smart

  Affected

  up to 1.3.16

  What to do

  Affects up to 1.3.16. Update Mobile Smart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025WordPress SMTP Service, Email Delivery Solved! — MailHawk: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31015 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Adrian Tobey WordPress SMTP Service, Email Delivery Solved! — MailHawk mailhawk allows PHP Local File Inclusion.This issue affects WordPress SMTP Service, Email Delivery Solved! — MailHawk: from n/a through <= 1.3.1.

  Product

  WordPress SMTP Service, Email Delivery Solved! — MailHawk

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update WordPress SMTP Service, Email Delivery Solved! — MailHawk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 11, 2025Material Dashboard: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31014 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hossein Material Dashboard material-dashboard allows PHP Local File Inclusion.This issue affects Material Dashboard: from n/a through <= 1.4.5.

  Product

  Material Dashboard

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025Linet ERP-Woocommerce Integration: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31411 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerce-integration allows Path Traversal.This issue affects Linet ERP-Woocommerce Integration: from n/a through <= 3.5.12.

  Product

  Linet ERP-Woocommerce Integration

  Affected

  up to 3.5.12

  What to do

  Affects up to 3.5.12. Update Linet ERP-Woocommerce Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025Vice Versa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27350 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hugh Mungus Vice Versa vice-versa allows Reflected XSS.This issue affects Vice Versa: from n/a through <= 2.2.3.

  Product

  Vice Versa

  Affected

  up to 2.2.3

  What to do

  Affects up to 2.2.3. Update Vice Versa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025JetCompareWishlist: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22279 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetCompareWishlist jet-compare-wishlist allows PHP Local File Inclusion.This issue affects JetCompareWishlist: from n/a through <= 1.5.9.

  Product

  JetCompareWishlist

  Affected

  up to 1.5.9

  What to do

  Affects up to 1.5.9. Update JetCompareWishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025Review Stars Count For WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32687 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Magnigenie Review Stars Count For WooCommerce review-stars-count-for-woocommerce allows SQL Injection.This issue affects Review Stars Count For WooCommerce: from n/a through <= 2.0.

  Product

  Review Stars Count For WooCommerce

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Review Stars Count For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025Real Estate Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32668 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows PHP Local File Inclusion.This issue affects Real Estate Manager: from n/a through <= 7.3.

  Product

  Real Estate Manager

  Affected

  up to 7.3

  What to do

  Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic: Missing AuthorizationCVE-2025-32236 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Vagonic Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic vagonic-sortable.This issue affects Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic: from n/a through <= 1.9.

  Product

  Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025Tutor LMS: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-32230 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Tutor LMS tutor.This issue affects Tutor LMS: from n/a through <= 3.4.0.

  Product

  Tutor LMS

  Affected

  up to 3.4.0

  What to do

  Affects up to 3.4.0. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025Hive Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32214 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hive Support Hive Support hive-support allows Stored XSS.This issue affects Hive Support: from n/a through <= 1.2.11.

  Product

  Hive Support

  Affected

  up to 1.2.11

  What to do

  Affects up to 1.2.11. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025Nomupay Payment Processing Gateway: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32209 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocessing-card-payments allows Path Traversal.This issue affects Nomupay Payment Processing Gateway: from n/a through <= 7.1.5.

  Product

  Nomupay Payment Processing Gateway

  Affected

  up to 7.1.5

  What to do

  Affects up to 7.1.5. Update Nomupay Payment Processing Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025Processing Projects: Unrestricted Upload of File with Dangerous TypeCVE-2025-32206 · WordPress plugins & themes · reported by PatchstackCritical 9.1

  Unrestricted Upload of File with Dangerous Type vulnerability in LABCAT Processing Projects processing-projects allows Upload a Web Shell to a Web Server.This issue affects Processing Projects: from n/a through <= 1.0.2.

  Product

  Processing Projects

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Processing Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025Piotnet Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32205 · WordPress plugins & themes · reported by PatchstackLow 2.7

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in piotnetdotcom Piotnet Forms piotnetforms.This issue affects Piotnet Forms: from n/a through <= 1.0.30.

  Product

  Piotnet Forms

  Affected

  up to 1.0.30

  What to do

  Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025Contact Form Builder by vcita: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32199 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyale-vc Contact Form Builder by vcita contact-form-with-a-meeting-scheduler-by-vcita allows DOM-Based XSS.This issue affects Contact Form Builder by vcita: from n/a through <= 4.10.2.

  Product

  Contact Form Builder by vcita

  Affected

  up to 4.10.2

  What to do

  Affects up to 4.10.2. Update Contact Form Builder by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025Brizy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32198 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themefusecom Brizy brizy.This issue affects Brizy: from n/a through <= 2.7.7.

  Product

  Brizy

  Affected

  up to 2.7.7

  What to do

  Affects up to 2.7.7. Update Brizy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025EventON: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32160 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashan Perera EventON eventon-lite.This issue affects EventON: from n/a through <= 2.4.1.

  Product

  EventON

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025aThemes Addons for Elementor: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32158 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite.This issue affects aThemes Addons for Elementor: from n/a through <= 1.1.3.

  Product

  aThemes Addons for Elementor

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update aThemes Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025FooBox Image Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32139 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FooPlugins FooBox Image Lightbox foobox-image-lightbox.This issue affects FooBox Image Lightbox : from n/a through <= 2.7.33.

  Product

  FooBox Image Lightbox

  Affected

  up to 2.7.33

  What to do

  Affects up to 2.7.33. Update FooBox Image Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025Nearby Locations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32128 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in aaronfrey Nearby Locations nearby-locations allows SQL Injection.This issue affects Nearby Locations: from n/a through <= 1.1.1.

  Product

  Nearby Locations

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Nearby Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025CardGate Payments for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32119 · WordPress plugins & themes · reported by PatchstackHigh 8.2

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CardGate CardGate Payments for WooCommerce cardgate allows Blind SQL Injection.This issue affects CardGate Payments for WooCommerce: from n/a through <= 3.2.1.

  Product

  CardGate Payments for WooCommerce

  Affected

  up to 3.2.1

  What to do

  Affects up to 3.2.1. Update CardGate Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025QR Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32116 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Studi7 QR Master qr-master allows Reflected XSS.This issue affects QR Master: from n/a through <= 1.0.5.

  Product

  QR Master

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update QR Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025Popping Content Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32115 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Content Light popping-content-light allows Reflected XSS.This issue affects Popping Content Light: from n/a through <= 2.4.

  Product

  Popping Content Light

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update Popping Content Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025WordPress 5sterrenspecialist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32114 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 5sterrenspecialist WordPress 5sterrenspecialist Plugin 5-sterrenspecialist allows Reflected XSS.This issue affects WordPress 5sterrenspecialist Plugin: from n/a through <= 1.4.

  Product

  WordPress 5sterrenspecialist

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update WordPress 5sterrenspecialist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025WP User Profiles: Incorrect Privilege AssignmentCVE-2025-31524 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Incorrect Privilege Assignment vulnerability in John James Jacoby WP User Profiles wp-users-profiles allows Privilege Escalation.This issue affects WP User Profiles: from n/a through <= 2.6.2.

  Product

  WP User Profiles

  Affected

  up to 2.6.2

  What to do

  Affects up to 2.6.2. Update WP User Profiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025DyaPress ERP/CRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30582 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aytechnet DyaPress ERP/CRM dyapress allows PHP Local File Inclusion.This issue affects DyaPress ERP/CRM: from n/a through <= 18.0.2.0.

  Product

  DyaPress ERP/CRM

  Affected

  up to 18.0.2.0

  What to do

  Affects up to 18.0.2.0. Update DyaPress ERP/CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2025The Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) plugin for WordPress is vulnerableCVE-2025-2719 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in versions 1.2.8 to 1.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 1/true on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny access to legitimate users or be used to set some values to true, such as registration.

  Affected

  1.2.8 to 1.4.0

  What to do

  Affects 1.2.8 to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Apr 10, 2025WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages: Processes user-supplied inputCVE-2024-13896 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages WordPress plugin through 1.4.3 processes user-supplied input as a regular expression via the wp_geshi_filter_replace_code() function, which could lead to Regular Expression Denial of Service (ReDoS) issue

  Product

  WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 9, 2025Brizy Pro: Cross-Site Request Forgery (CSRF)CVE-2025-26902 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Brizy Brizy Pro allows Cross Site Request Forgery.This issue affects Brizy Pro: from n/a through 2.6.1.

  Product

  Brizy Pro

  Affected

  up to 2.6.1

  What to do

  Affects up to 2.6.1. Update Brizy Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.