Vulnerability database

15,918 results · page 108 of 319

• Jun 25, 2025Tournament Bracket Generator: Stored Cross-Site ScriptingCVE-2025-6290 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Tournament Bracket Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Tournament Bracket Generator

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Tournament Bracket Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordpress.orgwordfence.com

• Jun 25, 2025WP SoundSystem: Stored Cross-Site ScriptingCVE-2025-6258 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The WP SoundSystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsstm-track shortcode in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  WP SoundSystem

  Affected

  up to 3.4.2

  What to do

  Affects up to 3.4.2. Update WP SoundSystem to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordpress.orgwordfence.com

• Jun 25, 2025Image Editor by Pixo: Stored Cross-Site ScriptingCVE-2025-5588 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Image Editor by Pixo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘download’ parameter in all versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Image Editor by Pixo

  Affected

  up to 2.3.6

  What to do

  Affects up to 2.3.6. Update Image Editor by Pixo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jun 25, 2025GC Social Wall: Stored Cross-Site ScriptingCVE-2025-5564 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The GC Social Wall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gc_social_wall' shortcode in all versions up to, and including, 1.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  GC Social Wall

  Affected

  up to 1.15

  What to do

  Affects up to 1.15. Update GC Social Wall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.svn.wordpress.orgwordfence.com

• Jun 25, 2025TimeZoneCalculator: Stored Cross-Site ScriptingCVE-2025-5559 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The TimeZoneCalculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'timezonecalculator_output' shortcode in all versions up to, and including, 3.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  TimeZoneCalculator

  Affected

  up to 3.37

  What to do

  Affects up to 3.37. Update TimeZoneCalculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordpress.orgwordfence.com

• Jun 25, 2025Event RSVP and Simple Event Management: Stored Cross-Site ScriptingCVE-2025-5540 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Event RSVP and Simple Event Management

  Affected

  up to 4.1.0

  What to do

  Affects up to 4.1.0. Update Event RSVP and Simple Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Jun 25, 2025e.nigma buttons: Stored Cross-Site ScriptingCVE-2025-5535 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The e.nigma buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  e.nigma buttons

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update e.nigma buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.svn.wordpress.orgwordfence.com

• Jun 25, 2025WP Masonry & Infinite Scroll: Stored Cross-Site ScriptingCVE-2025-5488 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The WP Masonry & Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wmis' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  WP Masonry & Infinite Scroll

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update WP Masonry & Infinite Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jun 24, 2025SiteOrigin Widgets Bundle: Stored Cross-Site ScriptingCVE-2025-5585 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-url` DOM Element Attribute in all versions up to, and including, 1.68.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  SiteOrigin Widgets Bundle

  Affected

  up to 1.68.4

  What to do

  Affects up to 1.68.4. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.svn.wordpress.orgwordfence.com

• Jun 24, 2025Conference Scheduler: Stored Cross-Site ScriptingCVE-2025-5258 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Conference Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Conference Scheduler

  Affected

  up to 2.5.1

  What to do

  Affects up to 2.5.1. Update Conference Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jun 21, 20253D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery: Stored Cross-Site ScriptingCVE-2025-5289 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ and 'mode' parameters in all versions up to, and including, 1.16.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This issue affects only block-based themes.

  Product

  3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery

  Affected

  up to 1.16.15

  What to do

  Affects up to 1.16.15. Update 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jun 21, 2025TableOn – WordPress Posts Table Filterable: Stored Cross-Site ScriptingCVE-2025-5143 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tableon_popup_iframe_button shortcode in all versions up to, and including, 1.0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  TableOn – WordPress Posts Table Filterable

  Affected

  up to 1.0.4.1

  What to do

  Affects up to 1.0.4.1. Update TableOn – WordPress Posts Table Filterable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jun 20, 2025Real Estate Manager: Cross-Site Request Forgery (CSRF)CVE-2025-52825 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Privilege Escalation.This issue affects Real Estate Manager: from n/a through <= 7.3.

  Product

  Real Estate Manager

  Affected

  up to 7.3

  What to do

  Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP Front User Submit / Front Editor: Cross-Site Request Forgery (CSRF)CVE-2025-52795 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in aharonyan WP Front User Submit / Front Editor front-editor allows Cross Site Request Forgery.This issue affects WP Front User Submit / Front Editor: from n/a through <= 5.0.6.

  Product

  WP Front User Submit / Front Editor

  Affected

  up to 5.0.6

  What to do

  Affects up to 5.0.6. Update WP Front User Submit / Front Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Creative Contact Form: Cross-Site Request Forgery (CSRF)CVE-2025-52794 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Creative-Solutions Creative Contact Form sexy-contact-form allows Stored XSS.This issue affects Creative Contact Form: from n/a through <= 1.0.0.

  Product

  Creative Contact Form

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Creative Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Esselink.nu Settings: Cross-Site Request Forgery (CSRF)CVE-2025-52793 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Esselink.nu Esselink.nu Settings esselinknu-settings allows Reflected XSS.This issue affects Esselink.nu Settings: from n/a through <= 4.5.

  Product

  Esselink.nu Settings

  Affected

  up to 4.5

  What to do

  Affects up to 4.5. Update Esselink.nu Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP User Stylesheet Switcher: Cross-Site Request Forgery (CSRF)CVE-2025-52792 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in vgstef WP User Stylesheet Switcher wp-user-stylesheet-switcher allows Stored XSS.This issue affects WP User Stylesheet Switcher: from n/a through <= v2.2.0.

  Product

  WP User Stylesheet Switcher

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update WP User Stylesheet Switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Knowledge Base – Knowledge Base Maker: Cross-Site Request Forgery (CSRF)CVE-2025-52791 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in devfelixmoira Knowledge Base – Knowledge Base Maker knowledge-base-maker allows Stored XSS.This issue affects Knowledge Base – Knowledge Base Maker: from n/a through <= 1.1.8.

  Product

  Knowledge Base – Knowledge Base Maker

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update Knowledge Base – Knowledge Base Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP-DownloadCounter: Cross-Site Request Forgery (CSRF)CVE-2025-52790 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in r-win WP-DownloadCounter wp-downloadcounter allows Stored XSS.This issue affects WP-DownloadCounter: from n/a through <= 1.01.

  Product

  WP-DownloadCounter

  Affected

  up to 1.01

  What to do

  Affects up to 1.01. Update WP-DownloadCounter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Lewe ChordPress: Cross-Site Request Forgery (CSRF)CVE-2025-52789 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in George Lewe Lewe ChordPress chordpress allows Stored XSS.This issue affects Lewe ChordPress: from n/a through <= 4.0.1.

  Product

  Lewe ChordPress

  Affected

  up to 4.0.1

  What to do

  Affects up to 4.0.1. Update Lewe ChordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Bluff Post: Cross-Site Request Forgery (CSRF)CVE-2025-52784 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in hideoguchi Bluff Post bluff-post allows Stored XSS.This issue affects Bluff Post: from n/a through <= 1.1.1.

  Product

  Bluff Post

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Bluff Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Change Cart button Colors WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-52783 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in themelocation Change Cart button Colors WooCommerce wc-style allows Stored XSS.This issue affects Change Cart button Colors WooCommerce: from n/a through <= 1.0.

  Product

  Change Cart button Colors WooCommerce

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Change Cart button Colors WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Scroll UP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52782 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in King Rayhan Scroll UP scroll-to-up allows Reflected XSS.This issue affects Scroll UP: from n/a through <= 2.0.

  Product

  Scroll UP

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Scroll UP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025TinyNav: Cross-Site Request Forgery (CSRF)CVE-2025-52781 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Beee TinyNav tinynav allows Stored XSS.This issue affects TinyNav: from n/a through <= 1.4.

  Product

  TinyNav

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update TinyNav to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Logo Manager For Samandehi: Cross-Site Request Forgery (CSRF)CVE-2025-52780 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Mohammad Parsa Logo Manager For Samandehi samandehi-logo-manager allows Stored XSS.This issue affects Logo Manager For Samandehi: from n/a through <= 0.5.

  Product

  Logo Manager For Samandehi

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update Logo Manager For Samandehi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Virtual Moderator: Cross-Site Request Forgery (CSRF)CVE-2025-52772 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Adnan Haque (a11n) Virtual Moderator allows Cross-Site Scripting (XSS). This issue affects Virtual Moderator: from n/a through 1.4.

  Product

  Virtual Moderator

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Virtual Moderator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025ANON::form embedded secure form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52733 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anonform Ab ANON::form embedded secure form anonform-embedded-secure-form allows DOM-Based XSS.This issue affects ANON::form embedded secure form: from n/a through <= 1.7.

  Product

  ANON::form embedded secure form

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update ANON::form embedded secure form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Post and Page Builder by BoldGrid: Cross-Site Request Forgery (CSRF)CVE-2025-52711 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Cross Site Request Forgery.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.8.

  Product

  Post and Page Builder by BoldGrid

  Affected

  up to 1.27.8

  What to do

  Affects up to 1.27.8. Update Post and Page Builder by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025File Manager Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52710 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team File Manager Pro filester allows Stored XSS.This issue affects File Manager Pro: from n/a through <= 1.8.8.

  Product

  File Manager Pro

  Affected

  up to 1.8.8

  What to do

  Affects up to 1.8.8. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Firelight Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52707 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored XSS.This issue affects Firelight Lightbox: from n/a through <= 2.3.16.

  Product

  Firelight Lightbox

  Affected

  up to 2.3.16

  What to do

  Affects up to 2.3.16. Update Firelight Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP-Members: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50051 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chad Butler WP-Members wp-members allows Stored XSS.This issue affects WP-Members: from n/a through <= 3.5.4.

  Product

  WP-Members

  Affected

  up to 3.5.4

  What to do

  Affects up to 3.5.4. Update WP-Members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Jobs for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50050 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Stored XSS.This issue affects Jobs for WordPress: from n/a through <= 2.7.14.

  Product

  Jobs for

  Affected

  up to 2.7.14

  What to do

  Affects up to 2.7.14. Update Jobs for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Modern Footnotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50049 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prismtechstudios Modern Footnotes modern-footnotes allows Stored XSS.This issue affects Modern Footnotes: from n/a through <= 1.4.19.

  Product

  Modern Footnotes

  Affected

  up to 1.4.19

  What to do

  Affects up to 1.4.19. Update Modern Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Automatically Hierarchic Categories in Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50048 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atakan Au Automatically Hierarchic Categories in Menu automatically-hierarchic-categories-in-menu allows Stored XSS.This issue affects Automatically Hierarchic Categories in Menu: from n/a through <= 2.0.9.

  Product

  Automatically Hierarchic Categories in Menu

  Affected

  up to 2.0.9

  What to do

  Affects up to 2.0.9. Update Automatically Hierarchic Categories in Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Sitekit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50047 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue affects Sitekit: from n/a through <= 1.9.

  Product

  Sitekit

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update Sitekit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WPComplete: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50046 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through <= 2.9.5.

  Product

  WPComplete

  Affected

  up to 2.9.5

  What to do

  Affects up to 2.9.5. Update WPComplete to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Related Products Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50045 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProWCPlugins Related Products Manager for WooCommerce related-products-manager-woocommerce allows DOM-Based XSS.This issue affects Related Products Manager for WooCommerce: from n/a through <= 1.6.2.

  Product

  Related Products Manager for WooCommerce

  Affected

  up to 1.6.2

  What to do

  Affects up to 1.6.2. Update Related Products Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Real Estate Manager: Cross-Site Request Forgery (CSRF)CVE-2025-50044 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Cross Site Request Forgery.This issue affects Real Estate Manager: from n/a through <= 7.3.

  Product

  Real Estate Manager

  Affected

  up to 7.3

  What to do

  Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Code Engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50043 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Code Engine code-engine allows Stored XSS.This issue affects Code Engine: from n/a through <= 0.3.2.

  Product

  Code Engine

  Affected

  up to 0.3.2

  What to do

  Affects up to 0.3.2. Update Code Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP Register Profile With Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50042 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com WP Register Profile With Shortcode wp-register-profile-with-shortcode allows Stored XSS.This issue affects WP Register Profile With Shortcode: from n/a through <= 3.6.3.

  Product

  WP Register Profile With Shortcode

  Affected

  up to 3.6.3

  What to do

  Affects up to 3.6.3. Update WP Register Profile With Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Gutenberg Blocks – ACF Blocks Suite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50041 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Engine Gutenberg Blocks – ACF Blocks Suite acf-blocks allows Stored XSS.This issue affects Gutenberg Blocks – ACF Blocks Suite: from n/a through <= 2.6.11.

  Product

  Gutenberg Blocks – ACF Blocks Suite

  Affected

  up to 2.6.11

  What to do

  Affects up to 2.6.11. Update Gutenberg Blocks – ACF Blocks Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Anant Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50038 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anantaddons Anant Addons for Elementor anant-addons-for-elementor allows Stored XSS.This issue affects Anant Addons for Elementor: from n/a through <= 1.2.8.

  Product

  Anant Addons for Elementor

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update Anant Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Buying Buddy IDX CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50037 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Buying Buddy Buying Buddy IDX CRM buying-buddy-idx-crm allows DOM-Based XSS.This issue affects Buying Buddy IDX CRM: from n/a through <= 2.3.0.

  Product

  Buying Buddy IDX CRM

  Affected

  up to 2.3.0

  What to do

  Affects up to 2.3.0. Update Buying Buddy IDX CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Mailing Group Listserv: Cross-Site Request Forgery (CSRF)CVE-2025-50036 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in Yamna Khawaja Mailing Group Listserv wp-mailing-group allows Cross Site Request Forgery.This issue affects Mailing Group Listserv: from n/a through <= 3.0.5.

  Product

  Mailing Group Listserv

  Affected

  up to 3.0.5

  What to do

  Affects up to 3.0.5. Update Mailing Group Listserv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Fyrebox Quizzes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50035 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a through <= 3.1.

  Product

  Fyrebox Quizzes

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update Fyrebox Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Fitness Park: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50033 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Fitness Park fitness-park allows DOM-Based XSS.This issue affects Fitness Park: from n/a through <= 1.1.1.

  Product

  Fitness Park

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Fitness Park to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Spark Multipurpose: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50030 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Spark Multipurpose spark-multipurpose allows DOM-Based XSS.This issue affects Spark Multipurpose: from n/a through <= 1.0.7.

  Product

  Spark Multipurpose

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Spark Multipurpose to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Login/Signup Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50027 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Login/Signup Popup easy-login-woocommerce allows Stored XSS.This issue affects Login/Signup Popup: from n/a through <= 2.9.4.

  Product

  Login/Signup Popup

  Affected

  up to 2.9.4

  What to do

  Affects up to 2.9.4. Update Login/Signup Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Spoki: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50026 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spoki Spoki spoki allows Stored XSS.This issue affects Spoki: from n/a through <= 2.17.0.

  Product

  Spoki

  Affected

  up to 2.17.0

  What to do

  Affects up to 2.17.0. Update Spoki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025CP Polls: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50025 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Polls cp-polls allows Stored XSS.This issue affects CP Polls: from n/a through <= 1.0.81.

  Product

  CP Polls

  Affected

  up to 1.0.81

  What to do

  Affects up to 1.0.81. Update CP Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.