Vulnerability database

11,311 results · page 127 of 227

• Feb 7, 2025Optimate Ads: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25136 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shujahat21 Optimate Ads optimate-ads allows Stored XSS.This issue affects Optimate Ads: from n/a through <= 1.0.3.

  Product

  Optimate Ads

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Optimate Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Smart Countdown FX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25117 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Polonski Smart Countdown FX smart-countdown-fx allows Stored XSS.This issue affects Smart Countdown FX: from n/a through <= 1.5.5.

  Product

  Smart Countdown FX

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update Smart Countdown FX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Link to URL / Post: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-25116 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sudipto Link to URL / Post link-to-url-post allows Blind SQL Injection.This issue affects Link to URL / Post: from n/a through <= 1.3.

  Product

  Link to URL / Post

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Link to URL / Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Pop Up: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25105 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in coffeestudios Pop Up popup-seo-optimized allows Stored XSS.This issue affects Pop Up: from n/a through <= 0.1.

  Product

  Pop Up

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Pop Up to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Links in Captions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25098 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz Links in Captions links-in-captions allows Stored XSS.This issue affects Links in Captions: from n/a through <= 1.2.

  Product

  Links in Captions

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Links in Captions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025External Video For Everybody: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25097 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kwiliarty External Video For Everybody external-video-for-everybody allows Stored XSS.This issue affects External Video For Everybody: from n/a through <= 2.1.1.

  Product

  External Video For Everybody

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update External Video For Everybody to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025RSS in Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25096 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in titusbicknell RSS in Page rss-in-page allows Stored XSS.This issue affects RSS in Page: from n/a through <= 2.9.1.

  Product

  RSS in Page

  Affected

  up to 2.9.1

  What to do

  Affects up to 2.9.1. Update RSS in Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025ReverbNation Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25095 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reverbnationdev ReverbNation Widgets reverbnation-widgets allows Stored XSS.This issue affects ReverbNation Widgets: from n/a through <= 2.1.

  Product

  ReverbNation Widgets

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update ReverbNation Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Breaking News Ticker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25094 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amitythemes.com Breaking News Ticker breaking-news-ticker allows Stored XSS.This issue affects Breaking News Ticker: from n/a through <= 2.4.4.

  Product

  Breaking News Ticker

  Affected

  up to 2.4.4

  What to do

  Affects up to 2.4.4. Update Breaking News Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025NextGen Cooliris Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25091 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zackdesign NextGen Cooliris Gallery nextgen-cooliris-gallery allows Stored XSS.This issue affects NextGen Cooliris Gallery: from n/a through <= 0.7.

  Product

  NextGen Cooliris Gallery

  Affected

  up to 0.7

  What to do

  Affects up to 0.7. Update NextGen Cooliris Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025WP SimpleWeather: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25085 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matt_mcbrien WP SimpleWeather wp-simpleweather allows Stored XSS.This issue affects WP SimpleWeather: from n/a through <= 0.2.5.

  Product

  WP SimpleWeather

  Affected

  up to 0.2.5

  What to do

  Affects up to 0.2.5. Update WP SimpleWeather to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025FlexIDX Home Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25082 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Chirkov FlexIDX Home Search flexidx-home-search allows Stored XSS.This issue affects FlexIDX Home Search: from n/a through <= 2.1.2.

  Product

  FlexIDX Home Search

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update FlexIDX Home Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Kona Gallery Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25080 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gubbigubbi Kona Gallery Block kona-instagram-feed-for-gutenberg allows Stored XSS.This issue affects Kona Gallery Block: from n/a through <= 1.7.

  Product

  Kona Gallery Block

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Kona Gallery Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Simple Select All Text Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25079 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Garrett Grimm Simple Select All Text Box simple-select-all-text-box allows Stored XSS.This issue affects Simple Select All Text Box: from n/a through <= 3.2.

  Product

  Simple Select All Text Box

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update Simple Select All Text Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Google Earth Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25078 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrew Norcross Google Earth Embed google-earth-tours allows Stored XSS.This issue affects Google Earth Embed: from n/a through <= 1.0.

  Product

  Google Earth Embed

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Google Earth Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Easy Chart Builder for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25077 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dugbug Easy Chart Builder for WordPress easy-chart-builder allows Stored XSS.This issue affects Easy Chart Builder for WordPress: from n/a through <= 1.3.

  Product

  Easy Chart Builder for

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Easy Chart Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Graceful Email Obfuscation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25076 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicholaswilson Graceful Email Obfuscation graceful-email-obfuscation allows Stored XSS.This issue affects Graceful Email Obfuscation: from n/a through <= 0.2.2.

  Product

  Graceful Email Obfuscation

  Affected

  up to 0.2.2

  What to do

  Affects up to 0.2.2. Update Graceful Email Obfuscation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Easy WP Tiles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25073 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vasilis Triantafyllou Easy WP Tiles easy-wp-tiles allows Stored XSS.This issue affects Easy WP Tiles: from n/a through <= 1.

  Product

  Easy WP Tiles

  Affected

  up to 1

  What to do

  Affects up to 1. Update Easy WP Tiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 6, 2025Nextend Social Login Pro: Authentication bypassCVE-2025-1061 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.16. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.

  Product

  Nextend Social Login Pro

  Affected

  up to 3.1.16

  What to do

  Affects up to 3.1.16. Update Nextend Social Login Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordnextendweb.comnextendweb.com

• Feb 4, 2025Post/Page Copying Tool: Improper Control of Generation of Code ('Code Injection')CVE-2025-24677 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Improper Control of Generation of Code ('Code Injection') vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies allows Remote Code Inclusion.This issue affects Post/Page Copying Tool: from n/a through <= 2.0.3.

  Product

  Post/Page Copying Tool

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update Post/Page Copying Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025WP24 Domain Check: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24602 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP24 WP24 Domain Check wp24-domain-check allows Reflected XSS.This issue affects WP24 Domain Check: from n/a through <= 1.10.14.

  Product

  WP24 Domain Check

  Affected

  up to 1.10.14

  What to do

  Affects up to 1.10.14. Update WP24 Domain Check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025Newsletters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24599 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through <= 4.9.9.6.

  Product

  Newsletters

  Affected

  up to 4.9.9.6

  What to do

  Affects up to 4.9.9.6. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025WP Mailster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24598 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.This issue affects WP Mailster: from n/a through <= 1.8.17.0.

  Product

  WP Mailster

  Affected

  up to 1.8.17.0

  What to do

  Affects up to 1.8.17.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025Find Content IDs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23645 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Optimize Worldwide Find Content IDs find-content-ids allows Reflected XSS.This issue affects Find Content IDs: from n/a through <= 1.0.

  Product

  Find Content IDs

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Find Content IDs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025World Cup Predictor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22794 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ianhaycox World Cup Predictor world-cup-predictor allows Reflected XSS.This issue affects World Cup Predictor: from n/a through <= 1.9.8.

  Product

  World Cup Predictor

  Affected

  up to 1.9.8

  What to do

  Affects up to 1.9.8. Update World Cup Predictor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025Traveler Code: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22700 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects Traveler Code: from n/a through < 3.1.3.

  Product

  Traveler Code

  What to do

  Update Traveler Code to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025Traveler Code: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22699 · WordPress plugins & themes · reported by PatchstackCritical 9

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects Traveler Code: from n/a through < 3.1.2.

  Product

  Traveler Code

  What to do

  Update Traveler Code to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025Responsive Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22697 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Reflected XSS.This issue affects Responsive Blocks: from n/a through <= 1.9.9.

  Product

  Responsive Blocks

  Affected

  up to 1.9.9

  What to do

  Affects up to 1.9.9. Update Responsive Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025Alert Box Block – Display notice/alerts in the front end: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22675 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Alert Box Block – Display notice/alerts in the front end alert-box-block allows Stored XSS.This issue affects Alert Box Block – Display notice/alerts in the front end: from n/a through <= 1.1.0.

  Product

  Alert Box Block – Display notice/alerts in the front end

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Alert Box Block – Display notice/alerts in the front end to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025Product Blocks for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22674 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Product Blocks for WooCommerce product-blocks-for-woocommerce allows Stored XSS.This issue affects Product Blocks for WooCommerce: from n/a through <= 1.9.1.

  Product

  Product Blocks for WooCommerce

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update Product Blocks for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025Survey Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22664 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.3.5.

  Product

  Survey Maker

  Affected

  up to 5.1.3.5

  What to do

  Affects up to 5.1.3.5. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025SendPulse Email Marketing Newsletter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22662 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Stored XSS.This issue affects SendPulse Email Marketing Newsletter: from n/a through <= 2.1.5.

  Product

  SendPulse Email Marketing Newsletter

  Affected

  up to 2.1.5

  What to do

  Affects up to 2.1.5. Update SendPulse Email Marketing Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025Music Press Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22653 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tuyennv Music Press Pro music-press-pro allows Stored XSS.This issue affects Music Press Pro: from n/a through <= 1.4.6.

  Product

  Music Press Pro

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update Music Press Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025Dynamic Conditions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22642 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtowebsites Dynamic Conditions dynamicconditions allows Stored XSS.This issue affects Dynamic Conditions: from n/a through <= 1.7.4.

  Product

  Dynamic Conditions

  Affected

  up to 1.7.4

  What to do

  Affects up to 1.7.4. Update Dynamic Conditions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025FM Notification Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22641 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prem Tiwari FM Notification Bar fm-notification-bar allows Stored XSS.This issue affects FM Notification Bar: from n/a through <= 1.0.4.

  Product

  FM Notification Bar

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update FM Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025Sensei LMS: Does not properly protect some its REST API routesCVE-2025-0466 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Sensei LMS WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak sensei_email and sensei_message Information.

  Product

  Sensei LMS

  Fixed in

  4.24.4

  What to do

  Update Sensei LMS to 4.24.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Feb 4, 2025WP Projects Portfolio with Client Testimonials: Does not have CSRF check in some placesCVE-2024-13115 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

  Product

  WP Projects Portfolio with Client Testimonials

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update WP Projects Portfolio with Client Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Feb 4, 2025WP Projects Portfolio with Client Testimonials: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13114 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

  Product

  WP Projects Portfolio with Client Testimonials

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update WP Projects Portfolio with Client Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Feb 3, 2025WPJobBoard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24781 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WPJobBoard allows Reflected XSS. This issue affects WPJobBoard: from n/a through 5.10.1.

  Product

  WPJobBoard

  Affected

  up to 5.10.1

  What to do

  Affects up to 5.10.1. Update WPJobBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24707 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Reflected XSS.This issue affects Photo Gallery: from n/a through <= 2.7.7.24.

  Product

  Photo Gallery

  Affected

  up to 2.7.7.24

  What to do

  Affects up to 2.7.7.24. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Media Downloader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24684 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ederson Peka Media Downloader media-downloader allows Reflected XSS.This issue affects Media Downloader: from n/a through <= 0.4.7.5.

  Product

  Media Downloader

  Affected

  up to 0.4.7.5

  What to do

  Affects up to 0.4.7.5. Update Media Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Custom WP Store Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24676 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in umangmetatagg Custom WP Store Locator custom-store-locator allows Reflected XSS.This issue affects Custom WP Store Locator: from n/a through <= 1.4.7.

  Product

  Custom WP Store Locator

  Affected

  up to 1.4.7

  What to do

  Affects up to 1.4.7. Update Custom WP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Simple Membership Custom Messages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24660 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership Custom Messages simple-membership-custom-messages allows Reflected XSS.This issue affects Simple Membership Custom Messages: from n/a through <= 2.4.

  Product

  Simple Membership Custom Messages

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update Simple Membership Custom Messages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Realtyna Provisioning: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24656 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Realtyna Realtyna Provisioning realtyna-provisioning allows Reflected XSS.This issue affects Realtyna Provisioning: from n/a through <= 1.2.2.

  Product

  Realtyna Provisioning

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Realtyna Provisioning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025XML for Avito: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24646 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc XML for Avito xml-for-avito allows Reflected XSS.This issue affects XML for Avito: from n/a through <= 2.5.2.

  Product

  XML for Avito

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update XML for Avito to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025BP Email Assign Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24631 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Reflected XSS.This issue affects BP Email Assign Templates: from n/a through <= 1.5.

  Product

  BP Email Assign Templates

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update BP Email Assign Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Sikshya LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24630 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MantraBrain Sikshya LMS sikshya allows Reflected XSS.This issue affects Sikshya LMS: from n/a through <= 0.0.21.

  Product

  Sikshya LMS

  Affected

  up to 0.0.21

  What to do

  Affects up to 0.0.21. Update Sikshya LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Import Excel to Gravity Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24629 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpgear Import Excel to Gravity Forms gf-excel-import allows Reflected XSS.This issue affects Import Excel to Gravity Forms: from n/a through <= 1.18.

  Product

  Import Excel to Gravity Forms

  Affected

  up to 1.18

  What to do

  Affects up to 1.18. Update Import Excel to Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025AIO Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24620 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hkharpreetkumar1 AIO Shortcodes aio-shortcodes allows Stored XSS.This issue affects AIO Shortcodes: from n/a through <= 1.3.

  Product

  AIO Shortcodes

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update AIO Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025WOLF: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-24605 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RealMag777 WOLF bulk-editor allows Path Traversal.This issue affects WOLF: from n/a through <= 1.0.8.5.

  Product

  WOLF

  Affected

  up to 1.0.8.5

  What to do

  Affects up to 1.0.8.5. Update WOLF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.