Vulnerability database

12,417 results · page 111 of 249

• Apr 3, 2025Modula Image Gallery: Stored Cross-Site ScriptingCVE-2024-9416 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Modula Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions <= 5.0.36) due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Modula Image Gallery

  Affected

  up to 5.0.36

  What to do

  Affects up to 5.0.36. Update Modula Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Apr 3, 2025User Submitted Posts – Enable Users to Submit Posts from the Front End: Stored Cross-Site ScriptingCVE-2025-2874 · WordPress plugins & themes · reported by WordfenceMedium 4.4

  The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 20240319 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

  Product

  User Submitted Posts – Enable Users to Submit Posts from the Front End

  Affected

  up to 20240319

  What to do

  Affects up to 20240319. Update User Submitted Posts – Enable Users to Submit Posts from the Front End to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Apr 3, 2025Unlimited Elements For Elementor: Stored Cross-Site ScriptingCVE-2025-1663 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.142 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Unlimited Elements For Elementor

  Affected

  up to 1.5.142

  What to do

  Affects up to 1.5.142. Update Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Apr 3, 2025Big Boom Directory: Stored Cross-Site ScriptingCVE-2024-13673 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Big Boom Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bbd-search' shortcode in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Big Boom Directory

  Affected

  up to 2.5.0

  What to do

  Affects up to 2.5.0. Update Big Boom Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 2, 2025Video Url: Reflected Cross-Site ScriptingCVE-2025-3098 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Video Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.0.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  Video Url

  Affected

  up to 1.0.0.3

  What to do

  Affects up to 1.0.0.3. Update Video Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 2, 2025Smart Icons For: Stored Cross-Site ScriptingCVE-2025-2513 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Smart Icons For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

  Product

  Smart Icons For

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Smart Icons For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 2, 2025Gift Certificate Creator: Reflected Cross-Site ScriptingCVE-2025-2483 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Gift Certificate Creator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘receip_address’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  Gift Certificate Creator

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Gift Certificate Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Apr 1, 2025Insert Headers and Footers Code – HT Script: Unauthorized modification of dataCVE-2025-2779 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 1/true on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny access to legitimate users or be used to set some values to true, such as registration.

  Product

  Insert Headers and Footers Code – HT Script

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Insert Headers and Footers Code – HT Script to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Apr 1, 2025Extensions for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31889 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in petesheppard84 Extensions for Elementor. This issue affects Extensions for Elementor: from n/a through 2.0.40.

  Product

  Extensions for Elementor

  Affected

  up to 2.0.40

  What to do

  Affects up to 2.0.40. Update Extensions for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Nova Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31819 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks.This issue affects Nova Blocks: from n/a through <= 2.1.8.

  Product

  Nova Blocks

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update Nova Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Auto scroll for reading: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31594 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPglob Auto scroll for reading auto-scroll-for-reading allows Reflected XSS.This issue affects Auto scroll for reading: from n/a through <= 1.1.4.

  Product

  Auto scroll for reading

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Auto scroll for reading to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Fonts Manager | Custom Fonts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31578 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wisdomlogix Solutions Pvt. Ltd. Fonts Manager | Custom Fonts fonts-manager-custom-fonts allows Reflected XSS.This issue affects Fonts Manager | Custom Fonts: from n/a through <= 1.2.

  Product

  Fonts Manager | Custom Fonts

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Fonts Manager | Custom Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025The Logo Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31571 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cynob IT Consultancy The Logo Slider the-logo-slider allows Reflected XSS.This issue affects The Logo Slider: from n/a through <= 1.0.0.

  Product

  The Logo Slider

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update The Logo Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025LeadLab by wiredminds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31568 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wiredmindshelp LeadLab by wiredminds wiredminds-leadlab allows Reflected XSS.This issue affects LeadLab by wiredminds: from n/a through <= 1.3.

  Product

  LeadLab by wiredminds

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update LeadLab by wiredminds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025AI Search Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31563 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vimal Kava AI Search Bar open-ai-search-bar allows Stored XSS.This issue affects AI Search Bar: from n/a through <= 2.1.

  Product

  AI Search Bar

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update AI Search Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Ultimate Push Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31548 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Reflected XSS.This issue affects Ultimate Push Notifications: from n/a through <= 1.2.0.

  Product

  Ultimate Push Notifications

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Ultimate Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Bulk NoIndex & NoFollow Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31537 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madfishdigital Bulk NoIndex & NoFollow Toolkit bulk-noindex-nofollow-toolkit-by-mad-fish allows Reflected XSS.This issue affects Bulk NoIndex & NoFollow Toolkit: from n/a through <= 2.16.

  Product

  Bulk NoIndex & NoFollow Toolkit

  Affected

  up to 2.16

  What to do

  Affects up to 2.16. Update Bulk NoIndex & NoFollow Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025CGM Event Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31462 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rzfarrell CGM Event Calendar cgm-event-calendar allows Reflected XSS.This issue affects CGM Event Calendar: from n/a through <= 0.8.5.

  Product

  CGM Event Calendar

  Affected

  up to 0.8.5

  What to do

  Affects up to 0.8.5. Update CGM Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025NanoSupport: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31461 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mayeenul Islam NanoSupport nanosupport allows Reflected XSS.This issue affects NanoSupport: from n/a through <= 0.6.0.

  Product

  NanoSupport

  Affected

  up to 0.6.0

  What to do

  Affects up to 0.6.0. Update NanoSupport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Limit Max IPs Per User: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31455 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ralxz Limit Max IPs Per User limit-max-ips-per-user allows DOM-Based XSS.This issue affects Limit Max IPs Per User: from n/a through <= 1.5.

  Product

  Limit Max IPs Per User

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Limit Max IPs Per User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Delete Post Revision: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31454 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly Delete Post Revision delete-post-revision allows Reflected XSS.This issue affects Delete Post Revision: from n/a through <= 1.1.

  Product

  Delete Post Revision

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Delete Post Revision to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Cleaner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31446 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jiangmiao WP Cleaner wpcleaner allows Reflected XSS.This issue affects WP Cleaner: from n/a through <= 1.1.5.

  Product

  WP Cleaner

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update WP Cleaner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Pages Order: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31445 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sed Lex Pages Order pages-order allows Reflected XSS.This issue affects Pages Order: from n/a through <= 1.1.3.

  Product

  Pages Order

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Pages Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WordPress Galleria: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31441 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in S WordPress Galleria wp-galleria allows Reflected XSS.This issue affects WordPress Galleria: from n/a through <= 1.4.

  Product

  WordPress Galleria

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update WordPress Galleria to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Bookmarks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31431 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in conlabz GmbH WP Bookmarks wp-bookmarks allows Reflected XSS.This issue affects WP Bookmarks: from n/a through <= 1.1.

  Product

  WP Bookmarks

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update WP Bookmarks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Product Table by WBW: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31086 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WBW Plugins Product Table by WBW woo-product-tables allows Reflected XSS.This issue affects Product Table by WBW: from n/a through <= 2.1.4.

  Product

  Product Table by WBW

  Affected

  up to 2.1.4

  What to do

  Affects up to 2.1.4. Update Product Table by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025xili-language: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31085 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-language xili-language allows Reflected XSS.This issue affects xili-language: from n/a through <= 2.21.2.

  Product

  xili-language

  Affected

  up to 2.21.2

  What to do

  Affects up to 2.21.2. Update xili-language to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Enable Media Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31081 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace enable-media-replace allows Reflected XSS.This issue affects Enable Media Replace: from n/a through <= 4.1.5.

  Product

  Enable Media Replace

  Affected

  up to 4.1.5

  What to do

  Affects up to 4.1.5. Update Enable Media Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025HTML Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31080 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms html-forms allows Stored XSS.This issue affects HTML Forms: from n/a through <= 1.5.1.

  Product

  HTML Forms

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update HTML Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Small Package Quotes – Worldwide Express Edition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31078 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows Reflected XSS.This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through <= 5.2.18.

  Product

  Small Package Quotes – Worldwide Express Edition

  Affected

  up to 5.2.18

  What to do

  Affects up to 5.2.18. Update Small Package Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Access Areas: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30913 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in podpirate Access Areas wp-access-areas allows Reflected XSS.This issue affects Access Areas: from n/a through <= 1.5.19.

  Product

  Access Areas

  Affected

  up to 1.5.19

  What to do

  Affects up to 1.5.19. Update Access Areas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Plugin Oficial – Getnet para WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30906 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lisandragetnet Plugin Oficial – Getnet para WooCommerce wc-checkout-getnet allows Reflected XSS.This issue affects Plugin Oficial – Getnet para WooCommerce: from n/a through <= 1.7.3.

  Product

  Plugin Oficial – Getnet para WooCommerce

  Affected

  up to 1.7.3

  What to do

  Affects up to 1.7.3. Update Plugin Oficial – Getnet para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Secure Copy Content Protection and Content Locking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30905 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Stored XSS.This issue affects Secure Copy Content Protection and Content Locking: from n/a through <= 4.4.3.

  Product

  Secure Copy Content Protection and Content Locking

  Affected

  up to 4.4.3

  What to do

  Affects up to 4.4.3. Update Secure Copy Content Protection and Content Locking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Oracle Cards Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30852 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emotionalonlinestorytelling Oracle Cards Lite oracle-cards allows Reflected XSS.This issue affects Oracle Cards Lite: from n/a through <= 1.2.1.

  Product

  Oracle Cards Lite

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Oracle Cards Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Watu Quiz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30844 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Watu Quiz watu allows Reflected XSS.This issue affects Watu Quiz: from n/a through <= 3.4.2.

  Product

  Watu Quiz

  Affected

  up to 3.4.2

  What to do

  Affects up to 3.4.2. Update Watu Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025VPSUForm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30778 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Ratudi VPSUForm v-form allows Reflected XSS.This issue affects VPSUForm: from n/a through <= 3.1.9.

  Product

  VPSUForm

  Affected

  up to 3.1.9

  What to do

  Affects up to 3.1.9. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Frizzly: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30554 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abhishek Kumar Frizzly frizzly allows Reflected XSS.This issue affects Frizzly: from n/a through <= 1.1.0.

  Product

  Frizzly

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Frizzly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Arrow Custom Feed for Twitter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31897 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arrow Plugins Arrow Custom Feed for Twitter arrow-twitter-feed allows Stored XSS.This issue affects Arrow Custom Feed for Twitter: from n/a through <= 1.5.3.

  Product

  Arrow Custom Feed for Twitter

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update Arrow Custom Feed for Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025ABC Notation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31895 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in paulrosen ABC Notation abc-notation allows Stored XSS.This issue affects ABC Notation: from n/a through <= 6.1.3.

  Product

  ABC Notation

  Affected

  up to 6.1.3

  What to do

  Affects up to 6.1.3. Update ABC Notation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Ebook Downloader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31894 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infoway LLC Ebook Downloader ebook-downloader allows Stored XSS.This issue affects Ebook Downloader: from n/a through <= 1.0.

  Product

  Ebook Downloader

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Ebook Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Crowdfunding: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31892 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding wp-crowdfunding allows Stored XSS.This issue affects WP Crowdfunding: from n/a through <= 2.1.15.

  Product

  WP Crowdfunding

  Affected

  up to 2.1.15

  What to do

  Affects up to 2.1.15. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Gosign – Posts Slider Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31891 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gosign Gosign – Posts Slider Block gosign-posts-slider-block allows Stored XSS.This issue affects Gosign – Posts Slider Block: from n/a through <= 1.1.0.

  Product

  Gosign – Posts Slider Block

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Gosign – Posts Slider Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Simple Map No Api: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31890 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mashi Simple Map No Api simple-map-no-api allows Stored XSS.This issue affects Simple Map No Api: from n/a through <= 1.9.

  Product

  Simple Map No Api

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update Simple Map No Api to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Hyperlink Group Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31885 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Floeter Hyperlink Group Block hyperlink-group-block allows DOM-Based XSS.This issue affects Hyperlink Group Block: from n/a through <= 2.0.1.

  Product

  Hyperlink Group Block

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Hyperlink Group Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Norse Rune Oracle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31884 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CMS Ninja Norse Rune Oracle Plugin norse-runes-oracle allows Stored XSS.This issue affects Norse Rune Oracle Plugin: from n/a through <= 1.4.3.

  Product

  Norse Rune Oracle

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update Norse Rune Oracle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WebinarPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31883 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Stored XSS.This issue affects WebinarPress: from n/a through <= 1.33.28.

  Product

  WebinarPress

  Affected

  up to 1.33.28

  What to do

  Affects up to 1.33.28. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025FancyPost: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31875 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluginic FancyPost post-block allows DOM-Based XSS.This issue affects FancyPost: from n/a through <= 6.0.1.

  Product

  FancyPost

  Affected

  up to 6.0.1

  What to do

  Affects up to 6.0.1. Update FancyPost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WebberZone Snippetz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31874 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay WebberZone Snippetz add-to-all allows Stored XSS.This issue affects WebberZone Snippetz: from n/a through <= 2.1.1.

  Product

  WebberZone Snippetz

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update WebberZone Snippetz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025SheetDB: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31873 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sheetdb SheetDB sheetdb allows Stored XSS.This issue affects SheetDB: from n/a through <= 1.3.4.

  Product

  SheetDB

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update SheetDB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Black Widgets For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31869 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor black-widgets allows Stored XSS.This issue affects Black Widgets For Elementor: from n/a through <= 1.3.9.

  Product

  Black Widgets For Elementor

  Affected

  up to 1.3.9

  What to do

  Affects up to 1.3.9. Update Black Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.