Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,918 results · page 111 of 319
Jun 9, 2025History Log by click5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47598 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in click5 History Log by click5 history-log-by-click5 allows Stored XSS.This issue affects History Log by click5: from n/a through <= 1.0.13.
- Product
- History Log by click5
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update History Log by click5 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025MC Woocommerce Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47487 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Reflected XSS.This issue affects MC Woocommerce Wishlist: from n/a through <= 1.9.1.
- Product
- MC Woocommerce Wishlist
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update MC Woocommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Backup and Staging by WP Time Capsule: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47477 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Reflected XSS.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.23.
- Product
- Backup and Staging by WP Time Capsule
- Affected
- up to 1.22.23
- What to do
- Affects up to 1.22.23. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025WP Email Delivery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39539 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brewlabs WP Email Delivery wp-email-delivery allows Reflected XSS.This issue affects WP Email Delivery: from n/a through <= 1.20.11.23.
- Product
- WP Email Delivery
- Affected
- up to 1.20.11.23
- What to do
- Affects up to 1.20.11.23. Update WP Email Delivery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025WordPress FlatNews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32305 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sneeit WordPress FlatNews Theme flatnews allows Reflected XSS.This issue affects WordPress FlatNews Theme: from n/a through <= 5.8.
- Product
- WordPress FlatNews
- Affected
- up to 5.8
- What to do
- Affects up to 5.8. Update WordPress FlatNews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025SHOUT: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31925 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup SHOUT lbg-audio8-html5-radio_ads allows Reflected XSS.This issue affects SHOUT: from n/a through <= 3.5.3.
- Product
- SHOUT
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update SHOUT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Universal Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31917 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player universal_video_player allows Reflected XSS.This issue affects Universal Video Player: from n/a through <= 3.8.3.
- Product
- Universal Video Player
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update Universal Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Spare: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31638 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeton Spare allows Reflected XSS. This issue affects Spare: from n/a through 1.7.
- Product
- Spare
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Spare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Sticky Radio Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31426 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutcast_sticky allows Reflected XSS.This issue affects Sticky Radio Player: from n/a through <= 3.4.
- Product
- Sticky Radio Player
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update Sticky Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31061 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redqteam Wishlist wishlist allows Reflected XSS.This issue affects Wishlist: from n/a through <= 2.1.0.
- Product
- Wishlist
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Revolution Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31058 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Revolution Video Player revolution_video_player allows Reflected XSS.This issue affects Revolution Video Player: from n/a through <= 2.9.2.
- Product
- Revolution Video Player
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update Revolution Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Universal Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31057 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player elementor_widget_universal_video_player allows Reflected XSS.This issue affects Universal Video Player: from n/a through <= 1.4.0.
- Product
- Universal Video Player
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Universal Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 7, 2025WpEvently: Stored Cross-Site ScriptingCVE-2025-5568 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WpEvently plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WpEvently
- Affected
- up to 4.4.2
- What to do
- Affects up to 4.4.2. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jun 7, 2025Social Sharing Plugin – Sassy Social Share: Reflected Cross-Site ScriptingCVE-2025-5528 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in all versions up to, and including, 3.3.75 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action, such as clicking on a link.
- Product
- Social Sharing Plugin – Sassy Social Share
- Affected
- up to 3.3.75
- What to do
- Affects up to 3.3.75. Update Social Sharing Plugin – Sassy Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 7, 2025Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site ScriptingCVE-2024-9994 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_pricing_item_tooltip_content parameter of the Pricing Table Widget in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders
- Affected
- up to 6.1.12
- What to do
- Affects up to 6.1.12. Update Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 7, 2025Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site ScriptingCVE-2024-9993 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_event_details_text parameter of Event Calendar Widget in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders
- Affected
- up to 6.1.12
- What to do
- Affects up to 6.1.12. Update Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 7, 2025The LTL Freight Quotes – Freightview Edition, LTL Freight Quotes – Daylight Edition and LTL Freight Quotes – Day & Ross Edition plugins for WordPress are vulnerCVE-2025-5303 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The LTL Freight Quotes – Freightview Edition, LTL Freight Quotes – Daylight Edition and LTL Freight Quotes – Day & Ross Edition plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the expiry_date parameter in all versions up to, and including, 1.0.11, 2.2.6 and 2.1.10 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 6, 2025BP Profile as Homepage: Cross-Site Request Forgery (CSRF)CVE-2025-49453 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Jatinder Pal Singh BP Profile as Homepage bp-profile-as-homepage allows Stored XSS.This issue affects BP Profile as Homepage: from n/a through <= 1.1.
- Product
- BP Profile as Homepage
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update BP Profile as Homepage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025SEPA Girocode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49450 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mhallmann SEPA Girocode sepa-girocode allows Stored XSS.This issue affects SEPA Girocode: from n/a through <= 0.5.1.
- Product
- SEPA Girocode
- Affected
- up to 0.5.1
- What to do
- Affects up to 0.5.1. Update SEPA Girocode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Interactive Regional Map of Africa: Cross-Site Request Forgery (CSRF)CVE-2025-49449 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive Regional Map of Africa interactive-map-of-africa allows Cross Site Request Forgery.This issue affects Interactive Regional Map of Africa: from n/a through <= 1.0.
- Product
- Interactive Regional Map of Africa
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Interactive Regional Map of Africa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Admin Notes: Cross-Site Request Forgery (CSRF)CVE-2025-49446 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in minhlaobao Admin Notes admin-note allows Cross Site Request Forgery.This issue affects Admin Notes: from n/a through <= 1.1.
- Product
- Admin Notes
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Admin Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Interactive UK Regional Map: Cross-Site Request Forgery (CSRF)CVE-2025-49445 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive UK Regional Map interactive-uk-regional-map allows Cross Site Request Forgery.This issue affects Interactive UK Regional Map: from n/a through <= 2.0.
- Product
- Interactive UK Regional Map
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Interactive UK Regional Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Bacon Ipsum: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49443 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris McCoy Bacon Ipsum bacon-ipsum allows Stored XSS.This issue affects Bacon Ipsum: from n/a through <= 2.4.
- Product
- Bacon Ipsum
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Bacon Ipsum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Simple Nested Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49442 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mostafa Shahiri Simple Nested Menu simple-nested-menu allows Stored XSS.This issue affects Simple Nested Menu: from n/a through <= 1.0.
- Product
- Simple Nested Menu
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Simple Nested Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Security Master: Cross-Site Request Forgery (CSRF)CVE-2025-49440 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Vuong Nguyen WP Security Master wp-security-master allows Cross Site Request Forgery.This issue affects WP Security Master: from n/a through <= 1.0.2.
- Product
- WP Security Master
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WP Security Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Atelier Create CV: Cross-Site Request Forgery (CSRF)CVE-2025-49439 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in mariusz88atelierweb Atelier Create CV atelier-create-cv allows Cross Site Request Forgery.This issue affects Atelier Create CV: from n/a through <= 1.1.5.
- Product
- Atelier Create CV
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Atelier Create CV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Wp Easy Allopass: Cross-Site Request Forgery (CSRF)CVE-2025-49435 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hasina77 Wp Easy Allopass wordpress-easy-allopass allows Cross Site Request Forgery.This issue affects Wp Easy Allopass: from n/a through <= 4.1.1.
- Product
- Wp Easy Allopass
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update Wp Easy Allopass to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Video Embeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49429 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Burnette Video Embeds video-embeds allows Stored XSS.This issue affects Video Embeds: from n/a through <= 0.1.1.
- Product
- Video Embeds
- Affected
- up to 0.1.1
- What to do
- Affects up to 0.1.1. Update Video Embeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Abbie Expander: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49427 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Burnette Abbie Expander abbie-expander allows Stored XSS.This issue affects Abbie Expander: from n/a through <= 1.0.1.
- Product
- Abbie Expander
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Abbie Expander to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Konami Easter Egg: Cross-Site Request Forgery (CSRF)CVE-2025-49425 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Adrian Hanft Konami Easter Egg konami-easter-egg allows Stored XSS.This issue affects Konami Easter Egg: from n/a through <= v0.4.
- Product
- Konami Easter Egg
- Affected
- up to 0.4
- What to do
- Affects up to 0.4. Update Konami Easter Egg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Simple Membership: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49333 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership simple-membership allows Stored XSS.This issue affects Simple Membership: from n/a through <= 4.6.3.
- Product
- Simple Membership
- Affected
- up to 4.6.3
- What to do
- Affects up to 4.6.3. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Time Slots Booking Form: Cross-Site Request Forgery (CSRF)CVE-2025-49332 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Cross Site Request Forgery.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.30.
- Product
- WP Time Slots Booking Form
- Affected
- up to 1.2.30
- What to do
- Affects up to 1.2.30. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025404 Page by SeedProd: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49322 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeedProd 404 Page by SeedProd allows Stored XSS. This issue affects 404 Page by SeedProd: from n/a through n/a.
- Product
- 404 Page by SeedProd
- What to do
- Update 404 Page by SeedProd to the newest version.
Jun 6, 2025WPtouch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49318 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPtouch WPtouch wptouch allows Stored XSS.This issue affects WPtouch: from n/a through <= 4.3.60.
- Product
- WPtouch
- Affected
- up to 4.3.60
- What to do
- Affects up to 4.3.60. Update WPtouch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Page Loading: Cross-Site Request Forgery (CSRF)CVE-2025-49317 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in NTC WP Page Loading wp-page-loading allows Cross Site Request Forgery.This issue affects WP Page Loading: from n/a through <= 1.0.6.
- Product
- WP Page Loading
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update WP Page Loading to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025BRW: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49314 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ovatheme BRW ova-brw allows Stored XSS.This issue affects BRW: from n/a through <= 1.8.6.
- Product
- BRW
- Affected
- up to 1.8.6
- What to do
- Affects up to 1.8.6. Update BRW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025The Events Calendar Countdown Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49311 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CoolHappy The Events Calendar Countdown Addon countdown-for-the-events-calendar allows Stored XSS.This issue affects The Events Calendar Countdown Addon: from n/a through <= 1.4.9.
- Product
- The Events Calendar Countdown Addon
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update The Events Calendar Countdown Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Frontend Dashboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Stored XSS.This issue affects Frontend Dashboard: from n/a through <= 2.2.8.
- Product
- Frontend Dashboard
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025HT Team Member: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49309 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Team Member ht-team-member allows Stored XSS.This issue affects HT Team Member: from n/a through <= 1.1.7.
- Product
- HT Team Member
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update HT Team Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Social Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49306 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through <= 2.3.
- Product
- WP Social Widget
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update WP Social Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Product Catalog Simple: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49305 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode Product Catalog Simple post-type-x allows Stored XSS.This issue affects Product Catalog Simple: from n/a through <= 1.8.1.
- Product
- Product Catalog Simple
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update Product Catalog Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Search with Typesense: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49304 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeManas Search with Typesense search-with-typesense allows Stored XSS.This issue affects Search with Typesense: from n/a through <= 2.0.10.
- Product
- Search with Typesense
- Affected
- up to 2.0.10
- What to do
- Affects up to 2.0.10. Update Search with Typesense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Greenshift: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49301 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows DOM-Based XSS.This issue affects Greenshift: from n/a through <= 11.5.5.
- Product
- Greenshift
- Affected
- up to 11.5.5
- What to do
- Affects up to 11.5.5. Update Greenshift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WebHotelier: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49299 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPlugged.com WebHotelier webhotelier allows Stored XSS.This issue affects WebHotelier: from n/a through <= 1.9.2.
- Product
- WebHotelier
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update WebHotelier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49298 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This issue affects Event post: from n/a through <= 5.10.1.
- Product
- Event post
- Affected
- up to 5.10.1
- What to do
- Affects up to 5.10.1. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Calculated Fields Form: Cross-Site Request Forgery (CSRF)CVE-2025-49291 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affects Calculated Fields Form: from n/a through <= 5.3.58.
- Product
- Calculated Fields Form
- Affected
- up to 5.3.58
- What to do
- Affects up to 5.3.58. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Table Builder: Cross-Site Request Forgery (CSRF)CVE-2025-49286 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Cross Site Request Forgery.This issue affects WP Table Builder: from n/a through <= 2.0.6.
- Product
- WP Table Builder
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update WP Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Cross-Site Request Forgery (CSRF)CVE-2025-49285 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Cross Site Request Forgery.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 3.8.0.
- Product
- WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
- Affected
- up to 3.8.0
- What to do
- Affects up to 3.8.0. Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Maintenance Mode & Site Under Construction: Cross-Site Request Forgery (CSRF)CVE-2025-49284 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cross Site Request Forgery.This issue affects WP Maintenance Mode & Site Under Construction: from n/a through <= 4.3.
- Product
- WP Maintenance Mode & Site Under Construction
- Affected
- up to 4.3
- What to do
- Affects up to 4.3. Update WP Maintenance Mode & Site Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant: Cross-Site Request Forgery (CSRF)CVE-2025-49283 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Matthias Nordwig Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant gdpr-compliant-recaptcha-for-all-forms allows Cross Site Request Forgery.This issue affects Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant: from n/a through <= 4.1.1.
- Product
- Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.