Updated 14 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

366new WordPress flaws this week

393,576entries in the database

15,418 results · page 116 of 309

May 16, 2025MapSVG: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47557 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg allows Stored XSS.This issue affects MapSVG: from n/a through <= 8.5.31.
Product
MapSVG
Affected
up to 8.5.31
What to do
Affects up to 8.5.31. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Ads Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46464 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Stored XSS.This issue affects Ads Pro: from n/a through <= 5.0.
Product
Ads Pro
Affected
up to 5.0
What to do
Affects up to 5.0. Update Ads Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Better Customer List for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39537 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blaze Concepts Better Customer List for WooCommerce woo-better-customer-list allows Reflected XSS.This issue affects Better Customer List for WooCommerce: from n/a through <= 1.2.3.
Product
Better Customer List for WooCommerce
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Better Customer List for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025TNC FlipBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39509 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode TNC FlipBook pdf-viewer-for-wordpress allows Stored XSS.This issue affects TNC FlipBook: from n/a through <= 12.1.0.
Product
TNC FlipBook
Affected
up to 12.1.0
What to do
Affects up to 12.1.0. Update TNC FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Product Carousel For WooCommerce – WoorouSell: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32180 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojofywp Product Carousel For WooCommerce – WoorouSell woorousell allows Stored XSS.This issue affects Product Carousel For WooCommerce – WoorouSell: from n/a through <= 1.1.0.
Product
Product Carousel For WooCommerce – WoorouSell
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Product Carousel For WooCommerce – WoorouSell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Simple Lightbox: Does not validate and escape some of its attributes before outputting them back in a page/postCVE-2025-3516 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Simple Lightbox
Fixed in
2.9.4
What to do
Update Simple Lightbox to 2.9.4 or newer.
Full record and what to do →NVD record wpscan.com
May 16, 2025Contact Form builder with drag & drop for WordPress: Does not sanitise and escape some of its settingsCVE-2025-3201 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Contact Form builder with drag & drop for WordPress WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.
Product
Contact Form builder with drag & drop for WordPress
Fixed in
2.4.3
What to do
Update Contact Form builder with drag & drop for WordPress to 2.4.3 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Posts per Cat [Unmaintained: Stored Cross-Site ScriptingCVE-2025-4169 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Posts per Cat [Unmaintained plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppc' shortcode in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Posts per Cat [Unmaintained
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Posts per Cat [Unmaintained to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 15, 2025Ninja Pages: Does not sanitise and escape some of its settingsCVE-2025-1454 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ninja Pages
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Ninja Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025Plugin Oficial: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-1303 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
Product
Plugin Oficial
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Plugin Oficial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Plugin Oficial: Does not sanitise and escape some of its settingsCVE-2025-1289 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Plugin Oficial
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Plugin Oficial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Download HTML TinyMCE Button: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-1286 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Download HTML TinyMCE Button WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Download HTML TinyMCE Button
Affected
up to 1.2
What to do
Affects up to 1.2. Update Download HTML TinyMCE Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Badgearoo: Does not sanitise and escape some of its settingsCVE-2025-1033 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Badgearoo
Affected
up to 1.0.14
What to do
Affects up to 1.0.14. Update Badgearoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Spiritual Gifts Survey (and optional S.H.A.P.E survey): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-0688 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
Product
Spiritual Gifts Survey (and optional S.H.A.P.E survey)
Affected
up to 0.9.10
What to do
Affects up to 0.9.10. Update Spiritual Gifts Survey (and optional S.H.A.P.E survey) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Spiritual Gifts Survey (and optional S.H.A.P.E survey): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-0687 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
Product
Spiritual Gifts Survey (and optional S.H.A.P.E survey)
Affected
up to 0.9.10
What to do
Affects up to 0.9.10. Update Spiritual Gifts Survey (and optional S.H.A.P.E survey) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025AI ChatBot for WordPress: Does not sanitise and escape some of its settingsCVE-2025-0329 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
AI ChatBot for WordPress
Fixed in
6.2.4
What to do
Update AI ChatBot for WordPress to 6.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses: Does not sanitise and escape some of its settingsCVE-2024-9882 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses
Fixed in
1.9.4
What to do
Update Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses to 1.9.4 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025CYAN Backup: Does not sanitise and escape some of its settingsCVE-2024-9663 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
CYAN Backup
Fixed in
2.5.3
What to do
Update CYAN Backup to 2.5.3 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025CYAN Backup: Does not sanitise and escape some of its settingsCVE-2024-9662 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
CYAN Backup
Fixed in
2.5.3
What to do
Update CYAN Backup to 2.5.3 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-9645 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry
Fixed in
2.2.93
What to do
Update Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry to 2.2.93 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Popup Box: Does not sanitise and escape some of its settingsCVE-2024-9599 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Popup Box
Fixed in
4.7.8
What to do
Update Popup Box to 4.7.8 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025RegistrationMagic: Does not sanitise and escape some of its settingsCVE-2024-9390 · WordPress plugins & themes · reported by WPScanMedium 4.8
The RegistrationMagic WordPress plugin before 6.0.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
RegistrationMagic
Fixed in
6.0.2.1
What to do
Update RegistrationMagic to 6.0.2.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Team: Does not sanitise and escape some of its settingsCVE-2024-9236 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Team WordPress plugin before 4.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Team
Fixed in
4.4.2
What to do
Update Team to 4.4.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025PowerPress Podcasting plugin by Blubrry: Does not sanitise and escape some of its settingsCVE-2024-9227 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow admin users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
PowerPress Podcasting plugin by Blubrry
Fixed in
11.9.18
What to do
Update PowerPress Podcasting plugin by Blubrry to 11.9.18 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Maspik: Does not sanitise and escape some of its settingsCVE-2024-9182 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Maspik WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Product
Maspik
Fixed in
2.1.3
What to do
Update Maspik to 2.1.3 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Polls CP: Does not sanitise and escape some of its poll settingsCVE-2024-8854 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multi site setup).
Product
Polls CP
Fixed in
1.0.77
What to do
Update Polls CP to 1.0.77 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Polls CP: Does not sanitise and escape some of its poll settingsCVE-2024-8851 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multi site setup).
Product
Polls CP
Fixed in
1.0.77
What to do
Update Polls CP to 1.0.77 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Nested Pages: Does not sanitise and escape some of its settingsCVE-2024-8759 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Nested Pages
Fixed in
3.2.9
What to do
Update Nested Pages to 3.2.9 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Backup Database: Does not sanitise and escape some of its settingsCVE-2024-8702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Backup Database
Affected
up to 4.9
What to do
Affects up to 4.9. Update Backup Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025events-calendar: Does not sanitise and escape some of its settingsCVE-2024-8701 · WordPress plugins & themes · reported by WPScanMedium 4.8
The events-calendar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
events-calendar
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update events-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-8670 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery by 10Web
Fixed in
1.8.29
What to do
Update Photo Gallery by 10Web to 1.8.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025MapPress Maps for: Does not sanitise and escape some of its settingsCVE-2024-8620 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
MapPress Maps for
Fixed in
2.93
What to do
Update MapPress Maps for to 2.93 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Ajax Search Lite: Does not sanitise and escape some of its settingsCVE-2024-8619 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ajax Search Lite
Fixed in
4.12.3
What to do
Update Ajax Search Lite to 4.12.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2024-8618 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Page Builder: Pagelayer
Fixed in
1.9.0
What to do
Update Page Builder: Pagelayer to 1.9.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Quiz Maker: Does not sanitize and escape some of its settingsCVE-2024-8617 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Quiz Maker
Fixed in
6.5.9.9
What to do
Update Quiz Maker to 6.5.9.9 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Everest Forms: Does not sanitise and escape some of its settingsCVE-2024-8542 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Everest Forms
Fixed in
3.0.3.1
What to do
Update Everest Forms to 3.0.3.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Events Calendar: Does not sanitise and escape some of its settingsCVE-2024-8493 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Events Calendar
Fixed in
6.6.4
What to do
Update Events Calendar to 6.6.4 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Hustle: Does not sanitise and escape some of its settingsCVE-2024-8492 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Hustle
Affected
up to 7.8.5
What to do
Affects up to 7.8.5. Update Hustle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2024-8426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Page Builder: Pagelayer
Fixed in
1.8.8
What to do
Update Page Builder: Pagelayer to 1.8.8 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Download Manager: Does not sanitise and escape some of its settingsCVE-2024-8284 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Download Manager
Fixed in
3.2.99
What to do
Update Download Manager to 3.2.99 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Smart Post Show: Does not sanitise and escape some of its settingsCVE-2024-8187 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Smart Post Show
Fixed in
3.0.1
What to do
Update Smart Post Show to 3.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025ClickSold IDX: Does not sanitise and escape some of its settingsCVE-2024-7769 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
ClickSold IDX
Affected
up to 1.90
What to do
Affects up to 1.90. Update ClickSold IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of thCVE-2024-7761 · WordPress plugins & themes · reported by WPScanMedium 6.1
In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor
Product
process of testing the Simple Job Board
Fixed in
2.12.2
What to do
Update process of testing the Simple Job Board to 2.12.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025PWA for WP: Does not sanitise and escape some of its settingsCVE-2024-7759 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
PWA for WP
Fixed in
1.7.72
What to do
Update PWA for WP to 1.7.72 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Stylish Price List: Does not sanitise and escape some of its settingsCVE-2024-7758 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Stylish Price List
Fixed in
7.1.8
What to do
Update Stylish Price List to 7.1.8 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Simple Share: Does not sanitise and escape some of its settingsCVE-2024-7556 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Simple Share
Affected
up to 0.5.3
What to do
Affects up to 0.5.3. Update Simple Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025DL Verification: Does not sanitise and escape some of its settingsCVE-2024-6798 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
DL Verification
Affected
up to 1.2
What to do
Affects up to 1.2. Update DL Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025DL Robots.txt: Does not sanitise and escape some of its settingsCVE-2024-6797 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
DL Robots.txt
Affected
up to 1.2
What to do
Affects up to 1.2. Update DL Robots.txt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025PVN Auth Popup: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-6718 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PVN Auth Popup WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
PVN Auth Popup
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update PVN Auth Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025PVN Auth Popup: Does not sanitise and escape some of its settingsCVE-2024-6713 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
PVN Auth Popup
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update PVN Auth Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.