Vulnerability database

11,294 results · page 109 of 226

• Apr 1, 2025Nova Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31819 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks.This issue affects Nova Blocks: from n/a through <= 2.1.8.

  Product

  Nova Blocks

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update Nova Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Actionwear products sync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31619 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in marcoingraiti Actionwear products sync actionwear-products-sync allows SQL Injection.This issue affects Actionwear products sync: from n/a through <= 2.3.3.

  Product

  Actionwear products sync

  Affected

  up to 2.3.3

  What to do

  Affects up to 2.3.3. Update Actionwear products sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Auto scroll for reading: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31594 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPglob Auto scroll for reading auto-scroll-for-reading allows Reflected XSS.This issue affects Auto scroll for reading: from n/a through <= 1.1.4.

  Product

  Auto scroll for reading

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Auto scroll for reading to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Ni WooCommerce Product Enquiry: Missing AuthorizationCVE-2025-31580 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Product Enquiry ni-woocommerce-product-enquiry allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ni WooCommerce Product Enquiry: from n/a through <= 4.1.8.

  Product

  Ni WooCommerce Product Enquiry

  Affected

  up to 4.1.8

  What to do

  Affects up to 4.1.8. Update Ni WooCommerce Product Enquiry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP AutoKeyword: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31579 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in EXEIdeas International WP AutoKeyword wp-autokeyword allows SQL Injection.This issue affects WP AutoKeyword: from n/a through <= 1.0.

  Product

  WP AutoKeyword

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP AutoKeyword to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Fonts Manager | Custom Fonts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31578 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wisdomlogix Solutions Pvt. Ltd. Fonts Manager | Custom Fonts fonts-manager-custom-fonts allows Reflected XSS.This issue affects Fonts Manager | Custom Fonts: from n/a through <= 1.2.

  Product

  Fonts Manager | Custom Fonts

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Fonts Manager | Custom Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025The Logo Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31571 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cynob IT Consultancy The Logo Slider the-logo-slider allows Reflected XSS.This issue affects The Logo Slider: from n/a through <= 1.0.0.

  Product

  The Logo Slider

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update The Logo Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025LeadLab by wiredminds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31568 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wiredmindshelp LeadLab by wiredminds wiredminds-leadlab allows Reflected XSS.This issue affects LeadLab by wiredminds: from n/a through <= 1.3.

  Product

  LeadLab by wiredminds

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update LeadLab by wiredminds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31564 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Blind SQL Injection.This issue affects Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: from n/a through <= 2.2.6.

  Product

  Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One

  Affected

  up to 2.2.6

  What to do

  Affects up to 2.2.6. Update Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025AI Search Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31563 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vimal Kava AI Search Bar open-ai-search-bar allows Stored XSS.This issue affects AI Search Bar: from n/a through <= 2.1.

  Product

  AI Search Bar

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update AI Search Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Ultimate Push Notifications: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31561 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows SQL Injection.This issue affects Ultimate Push Notifications: from n/a through <= 1.2.0.

  Product

  Ultimate Push Notifications

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Ultimate Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Advanced WooCommerce Product Sales Reporting: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31553 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows SQL Injection.This issue affects Advanced WooCommerce Product Sales Reporting: from n/a through <= 4.1.1.

  Product

  Advanced WooCommerce Product Sales Reporting

  Affected

  up to 4.1.1

  What to do

  Affects up to 4.1.1. Update Advanced WooCommerce Product Sales Reporting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025RSVPMarker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31552 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in davidfcarr RSVPMarker rsvpmaker allows SQL Injection.This issue affects RSVPMarker : from n/a through <= 11.6.7.

  Product

  RSVPMarker

  Affected

  up to 11.6.7

  What to do

  Affects up to 11.6.7. Update RSVPMarker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Salesmate Add-On for Gravity Forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31551 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Salesmate.io Salesmate Add-On for Gravity Forms gf-salesmate-add-on allows SQL Injection.This issue affects Salesmate Add-On for Gravity Forms: from n/a through <= 2.0.3.

  Product

  Salesmate Add-On for Gravity Forms

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update Salesmate Add-On for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Ultimate Push Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31548 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Reflected XSS.This issue affects Ultimate Push Notifications: from n/a through <= 1.2.0.

  Product

  Ultimate Push Notifications

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Ultimate Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Bulk NoIndex & NoFollow Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31537 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madfishdigital Bulk NoIndex & NoFollow Toolkit bulk-noindex-nofollow-toolkit-by-mad-fish allows Reflected XSS.This issue affects Bulk NoIndex & NoFollow Toolkit: from n/a through <= 2.16.

  Product

  Bulk NoIndex & NoFollow Toolkit

  Affected

  up to 2.16

  What to do

  Affects up to 2.16. Update Bulk NoIndex & NoFollow Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Shopper: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31534 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shopperdotcom Shopper shopper allows SQL Injection.This issue affects Shopper: from n/a through <= 3.2.5.

  Product

  Shopper

  Affected

  up to 3.2.5

  What to do

  Affects up to 3.2.5. Update Shopper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025History Log by click5: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31531 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in click5 History Log by click5 history-log-by-click5 allows SQL Injection.This issue affects History Log by click5: from n/a through <= 1.0.13.

  Product

  History Log by click5

  Affected

  up to 1.0.13

  What to do

  Affects up to 1.0.13. Update History Log by click5 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025CGM Event Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31462 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rzfarrell CGM Event Calendar cgm-event-calendar allows Reflected XSS.This issue affects CGM Event Calendar: from n/a through <= 0.8.5.

  Product

  CGM Event Calendar

  Affected

  up to 0.8.5

  What to do

  Affects up to 0.8.5. Update CGM Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025NanoSupport: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31461 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mayeenul Islam NanoSupport nanosupport allows Reflected XSS.This issue affects NanoSupport: from n/a through <= 0.6.0.

  Product

  NanoSupport

  Affected

  up to 0.6.0

  What to do

  Affects up to 0.6.0. Update NanoSupport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Limit Max IPs Per User: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31455 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ralxz Limit Max IPs Per User limit-max-ips-per-user allows DOM-Based XSS.This issue affects Limit Max IPs Per User: from n/a through <= 1.5.

  Product

  Limit Max IPs Per User

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Limit Max IPs Per User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Delete Post Revision: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31454 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly Delete Post Revision delete-post-revision allows Reflected XSS.This issue affects Delete Post Revision: from n/a through <= 1.1.

  Product

  Delete Post Revision

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Delete Post Revision to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Cleaner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31446 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jiangmiao WP Cleaner wpcleaner allows Reflected XSS.This issue affects WP Cleaner: from n/a through <= 1.1.5.

  Product

  WP Cleaner

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update WP Cleaner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Pages Order: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31445 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sed Lex Pages Order pages-order allows Reflected XSS.This issue affects Pages Order: from n/a through <= 1.1.3.

  Product

  Pages Order

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Pages Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WordPress Galleria: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31441 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in S WordPress Galleria wp-galleria allows Reflected XSS.This issue affects WordPress Galleria: from n/a through <= 1.4.

  Product

  WordPress Galleria

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update WordPress Galleria to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Bookmarks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31431 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in conlabz GmbH WP Bookmarks wp-bookmarks allows Reflected XSS.This issue affects WP Bookmarks: from n/a through <= 1.1.

  Product

  WP Bookmarks

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update WP Bookmarks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Material Dashboard: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31097 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hossein Material Dashboard material-dashboard allows PHP Local File Inclusion.This issue affects Material Dashboard: from n/a through <= 1.4.5.

  Product

  Material Dashboard

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Order Splitter for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31089 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Fahad Mahmood Order Splitter for WooCommerce woo-order-splitter allows SQL Injection.This issue affects Order Splitter for WooCommerce: from n/a through <= 5.3.0.

  Product

  Order Splitter for WooCommerce

  Affected

  up to 5.3.0

  What to do

  Affects up to 5.3.0. Update Order Splitter for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Product Table by WBW: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31086 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WBW Plugins Product Table by WBW woo-product-tables allows Reflected XSS.This issue affects Product Table by WBW: from n/a through <= 2.1.4.

  Product

  Product Table by WBW

  Affected

  up to 2.1.4

  What to do

  Affects up to 2.1.4. Update Product Table by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025xili-language: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31085 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-language xili-language allows Reflected XSS.This issue affects xili-language: from n/a through <= 2.21.2.

  Product

  xili-language

  Affected

  up to 2.21.2

  What to do

  Affects up to 2.21.2. Update xili-language to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025News & Blog Designer Pack: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31082 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in InfornWeb News & Blog Designer Pack blog-designer-pack allows PHP Local File Inclusion.This issue affects News & Blog Designer Pack: from n/a through <= 4.0.

  Product

  News & Blog Designer Pack

  Affected

  up to 4.0

  What to do

  Affects up to 4.0. Update News & Blog Designer Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Enable Media Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31081 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace enable-media-replace allows Reflected XSS.This issue affects Enable Media Replace: from n/a through <= 4.1.5.

  Product

  Enable Media Replace

  Affected

  up to 4.1.5

  What to do

  Affects up to 4.1.5. Update Enable Media Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025HTML Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31080 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms html-forms allows Stored XSS.This issue affects HTML Forms: from n/a through <= 1.5.1.

  Product

  HTML Forms

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update HTML Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Small Package Quotes – Worldwide Express Edition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31078 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows Reflected XSS.This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through <= 5.2.18.

  Product

  Small Package Quotes – Worldwide Express Edition

  Affected

  up to 5.2.18

  What to do

  Affects up to 5.2.18. Update Small Package Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Access Areas: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30913 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in podpirate Access Areas wp-access-areas allows Reflected XSS.This issue affects Access Areas: from n/a through <= 1.5.19.

  Product

  Access Areas

  Affected

  up to 1.5.19

  What to do

  Affects up to 1.5.19. Update Access Areas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Plugin Oficial – Getnet para WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30906 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lisandragetnet Plugin Oficial – Getnet para WooCommerce wc-checkout-getnet allows Reflected XSS.This issue affects Plugin Oficial – Getnet para WooCommerce: from n/a through <= 1.7.3.

  Product

  Plugin Oficial – Getnet para WooCommerce

  Affected

  up to 1.7.3

  What to do

  Affects up to 1.7.3. Update Plugin Oficial – Getnet para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Secure Copy Content Protection and Content Locking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30905 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Stored XSS.This issue affects Secure Copy Content Protection and Content Locking: from n/a through <= 4.4.3.

  Product

  Secure Copy Content Protection and Content Locking

  Affected

  up to 4.4.3

  What to do

  Affects up to 4.4.3. Update Secure Copy Content Protection and Content Locking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Oracle Cards Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30852 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emotionalonlinestorytelling Oracle Cards Lite oracle-cards allows Reflected XSS.This issue affects Oracle Cards Lite: from n/a through <= 1.2.1.

  Product

  Oracle Cards Lite

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Oracle Cards Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Watu Quiz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30844 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Watu Quiz watu allows Reflected XSS.This issue affects Watu Quiz: from n/a through <= 3.4.2.

  Product

  Watu Quiz

  Affected

  up to 3.4.2

  What to do

  Affects up to 3.4.2. Update Watu Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Countdown & Clock: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30841 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in adamskaat Countdown & Clock countdown-builder allows Remote Code Inclusion.This issue affects Countdown & Clock: from n/a through <= 2.8.8.

  Product

  Countdown & Clock

  Affected

  up to 2.8.8

  What to do

  Affects up to 2.8.8. Update Countdown & Clock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: Missing AuthorizationCVE-2025-30825 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Missing Authorization vulnerability in WPClever WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce wpc-smart-linked-products allows Privilege Escalation.This issue affects WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: from n/a through <= 1.3.5.

  Product

  WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Next-Cart Store to WooCommerce Migration: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30807 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martin Nguyen Next-Cart Store to WooCommerce Migration nextcart-woocommerce-migration allows SQL Injection.This issue affects Next-Cart Store to WooCommerce Migration: from n/a through <= 3.9.4.

  Product

  Next-Cart Store to WooCommerce Migration

  Affected

  up to 3.9.4

  What to do

  Affects up to 3.9.4. Update Next-Cart Store to WooCommerce Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025VPSUForm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30778 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Ratudi VPSUForm v-form allows Reflected XSS.This issue affects VPSUForm: from n/a through <= 3.1.9.

  Product

  VPSUForm

  Affected

  up to 3.1.9

  What to do

  Affects up to 3.1.9. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025DigiWidgets Image Editor: Improper Control of Generation of Code ('Code Injection')CVE-2025-30580 · WordPress plugins & themes · reported by PatchstackCritical 10

  Improper Control of Generation of Code ('Code Injection') vulnerability in kellydiek DigiWidgets Image Editor digiwidgets-image-editor allows Remote Code Inclusion.This issue affects DigiWidgets Image Editor: from n/a through <= 1.10.

  Product

  DigiWidgets Image Editor

  Affected

  up to 1.10

  What to do

  Affects up to 1.10. Update DigiWidgets Image Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Frizzly: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30554 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abhishek Kumar Frizzly frizzly allows Reflected XSS.This issue affects Frizzly: from n/a through <= 1.1.0.

  Product

  Frizzly

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Frizzly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025BookingPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31910 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems BookingPress bookingpress-appointment-booking allows SQL Injection.This issue affects BookingPress: from n/a through <= 1.1.28.

  Product

  BookingPress

  Affected

  up to 1.1.28

  What to do

  Affects up to 1.1.28. Update BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Profitshare: Cross-Site Request Forgery (CSRF)CVE-2025-31906 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ProfitShare.ro WP Profitshare wp-profitshare allows Stored XSS.This issue affects WP Profitshare: from n/a through <= 1.4.9.

  Product

  WP Profitshare

  Affected

  up to 1.4.9

  What to do

  Affects up to 1.4.9. Update WP Profitshare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Arrow Custom Feed for Twitter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31897 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arrow Plugins Arrow Custom Feed for Twitter arrow-twitter-feed allows Stored XSS.This issue affects Arrow Custom Feed for Twitter: from n/a through <= 1.5.3.

  Product

  Arrow Custom Feed for Twitter

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update Arrow Custom Feed for Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025ABC Notation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31895 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in paulrosen ABC Notation abc-notation allows Stored XSS.This issue affects ABC Notation: from n/a through <= 6.1.3.

  Product

  ABC Notation

  Affected

  up to 6.1.3

  What to do

  Affects up to 6.1.3. Update ABC Notation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Ebook Downloader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31894 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infoway LLC Ebook Downloader ebook-downloader allows Stored XSS.This issue affects Ebook Downloader: from n/a through <= 1.0.

  Product

  Ebook Downloader

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Ebook Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.