Vulnerability database

12,427 results · page 133 of 249

• Jan 24, 2025Create with Code: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24638 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pddring Create with Code create-with-code allows DOM-Based XSS.This issue affects Create with Code: from n/a through <= 1.4.

  Product

  Create with Code

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Create with Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Orbisius Simple Notice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24634 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Svetoslav Marinov Orbisius Simple Notice orbisius-simple-notice allows Stored XSS.This issue affects Orbisius Simple Notice: from n/a through <= 1.1.3.

  Product

  Orbisius Simple Notice

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Orbisius Simple Notice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Blur Text: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24627 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linnea Huxford Blur Text blur-text allows Stored XSS.This issue affects Blur Text: from n/a through <= 1.0.0.

  Product

  Blur Text

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Blur Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Restrict Anonymous Access: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24610 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christian Leuenberg Restrict Anonymous Access restrict-anonymous-access allows Stored XSS.This issue affects Restrict Anonymous Access: from n/a through <= 1.2.

  Product

  Restrict Anonymous Access

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Restrict Anonymous Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025All Embed – Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24595 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins All Embed – Elementor Addons all-embed-addons-for-elementor allows Stored XSS.This issue affects All Embed – Elementor Addons: from n/a through <= 1.1.3.

  Product

  All Embed – Elementor Addons

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update All Embed – Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Email Subscription Popup: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24587 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nks Email Subscription Popup email-subscribe allows Blind SQL Injection.This issue affects Email Subscription Popup: from n/a through <= 1.2.23.

  Product

  Email Subscription Popup

  Affected

  up to 1.2.23

  What to do

  Affects up to 1.2.23. Update Email Subscription Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24585 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This issue affects Event post: from n/a through <= 5.9.7.

  Product

  Event post

  Affected

  up to 5.9.7

  What to do

  Affects up to 5.9.7. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Nested Pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24579 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Nested Pages wp-nested-pages allows Stored XSS.This issue affects Nested Pages: from n/a through <= 3.2.9.

  Product

  Nested Pages

  Affected

  up to 3.2.9

  What to do

  Affects up to 3.2.9. Update Nested Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025ElementInvader Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24578 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows DOM-Based XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.0.

  Product

  ElementInvader Addons for Elementor

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025HelloAsso: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24575 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso HelloAsso helloasso allows Stored XSS.This issue affects HelloAsso: from n/a through <= 1.1.11.

  Product

  HelloAsso

  Affected

  up to 1.1.11

  What to do

  Affects up to 1.1.11. Update HelloAsso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025PageLayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24573 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softaculous PageLayer pagelayer allows DOM-Based XSS.This issue affects PageLayer: from n/a through <= 1.9.4.

  Product

  PageLayer

  Affected

  up to 1.9.4

  What to do

  Affects up to 1.9.4. Update PageLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Atarim: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24570 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Stored XSS.This issue affects Atarim: from n/a through <= 4.0.8.

  Product

  Atarim

  Affected

  up to 4.0.8

  What to do

  Affects up to 4.0.8. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Subscription DNA: Cross-Site Request Forgery (CSRF)CVE-2025-24555 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in subscriptiondna Subscription DNA subscriptiondna allows Stored XSS.This issue affects Subscription DNA: from n/a through <= 2.1.

  Product

  Subscription DNA

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Subscription DNA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Caching Compatible Cookie Opt-In and JavaScript: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24547 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthias.wagner Caching Compatible Cookie Opt-In and JavaScript caching-compatible-cookie-optin-and-javascript allows Stored XSS.This issue affects Caching Compatible Cookie Opt-In and JavaScript: from n/a through <= 0.0.10.

  Product

  Caching Compatible Cookie Opt-In and JavaScript

  Affected

  up to 0.0.10

  What to do

  Affects up to 0.0.10. Update Caching Compatible Cookie Opt-In and JavaScript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Icegram: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24542 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram icegram allows Stored XSS.This issue affects Icegram: from n/a through <= 3.1.31.

  Product

  Icegram

  Affected

  up to 3.1.31

  What to do

  Affects up to 3.1.31. Update Icegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025FooGallery Captions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23889 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tormorten FooGallery Captions foogallery-captions allows Reflected XSS.This issue affects FooGallery Captions: from n/a through <= 1.0.2.

  Product

  FooGallery Captions

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update FooGallery Captions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Custom Page Extensions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23888 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GrandSlambert Custom Page Extensions custom-page-extensions allows Reflected XSS.This issue affects Custom Page Extensions: from n/a through <= 0.6.

  Product

  Custom Page Extensions

  Affected

  up to 0.6

  What to do

  Affects up to 0.6. Update Custom Page Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025MJ Contact us: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23885 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anildhiman MJ Contact us mj-contact-us allows Reflected XSS.This issue affects MJ Contact us: from n/a through <= 5.2.3.

  Product

  MJ Contact us

  Affected

  up to 5.2.3

  What to do

  Affects up to 5.2.3. Update MJ Contact us to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Sticky Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23839 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asif Shakeel Sticky Button sticky-chat-button allows Stored XSS.This issue affects Sticky Button: from n/a through <= 1.0.

  Product

  Sticky Button

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Sticky Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Bauernregeln: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23838 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rally Vincent Bauernregeln bauernregeln allows Reflected XSS.This issue affects Bauernregeln: from n/a through <= 1.0.1.

  Product

  Bauernregeln

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Bauernregeln to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025One Backend Language: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23837 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in martinjuhasz One Backend Language one-backend-language allows Reflected XSS.This issue affects One Backend Language: from n/a through <= 1.0.

  Product

  One Backend Language

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update One Backend Language to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Network-Favorites: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23737 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thobian Network-Favorites network-favorites allows Reflected XSS.This issue affects Network-Favorites: from n/a through <= 1.1.

  Product

  Network-Favorites

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Network-Favorites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Gigaom Sphinx: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23734 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Casey Bisson Gigaom Sphinx go-sphinx allows Reflected XSS.This issue affects Gigaom Sphinx: from n/a through <= 0.1.

  Product

  Gigaom Sphinx

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Gigaom Sphinx to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Quote me: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23711 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Quincy Kwende Quote me quote-me allows Reflected XSS.This issue affects Quote me: from n/a through <= 1.0.

  Product

  Quote me

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Quote me to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025CBX Accounting & Bookkeeping: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23622 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sabuj Kundu CBX Accounting & Bookkeeping cbxwpsimpleaccounting allows Reflected XSS.This issue affects CBX Accounting & Bookkeeping: from n/a through <= 1.3.14.

  Product

  CBX Accounting & Bookkeeping

  Affected

  up to 1.3.14

  What to do

  Affects up to 1.3.14. Update CBX Accounting & Bookkeeping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Causes – Donation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23621 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in algothemes Causes – Donation Plugin causes allows Reflected XSS.This issue affects Causes – Donation Plugin: from n/a through <= 1.0.01.

  Product

  Causes – Donation

  Affected

  up to 1.0.01

  What to do

  Affects up to 1.0.01. Update Causes – Donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025HM Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23522 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthew Haines-Young HM Portfolio hm-portfolio allows Reflected XSS.This issue affects HM Portfolio: from n/a through <= 1.1.1.

  Product

  HM Portfolio

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update HM Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Redux Converter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23427 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson / Team Updraft Redux Converter redux-converter allows Reflected XSS.This issue affects Redux Converter: from n/a through <= 1.1.3.1.

  Product

  Redux Converter

  Affected

  up to 1.1.3.1

  What to do

  Affects up to 1.1.3.1. Update Redux Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Mobile DJ Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22714 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Reflected XSS.This issue affects Mobile DJ Manager: from n/a through <= 1.7.5.6.

  Product

  Mobile DJ Manager

  Affected

  up to 1.7.5.6

  What to do

  Affects up to 1.7.5.6. Update Mobile DJ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Precious Metals Charts and Widgets for: Stored Cross-Site ScriptingCVE-2024-13572 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Precious Metals Charts and Widgets for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nfusion-widget' shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Precious Metals Charts and Widgets for

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update Precious Metals Charts and Widgets for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 24, 2025WP Google Street View (with 360° virtual tour) & Google maps + Local SEO: Stored Cross-Site ScriptingCVE-2024-13542 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgsv' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  WP Google Street View (with 360° virtual tour) & Google maps + Local SEO

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update WP Google Street View (with 360° virtual tour) & Google maps + Local SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 24, 2025Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates: Stored Cross-Site ScriptingCVE-2024-13354 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags in several widgets in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates

  Affected

  up to 1.6.4

  What to do

  Affects up to 1.6.4. Update Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 24, 2025Simple Gallery with Filter: Stored Cross-Site ScriptingCVE-2024-13583 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Simple Gallery with Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'c2tw_sgwf' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Simple Gallery with Filter

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Simple Gallery with Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 24, 2025BMLT Meeting Map: Stored Cross-Site ScriptingCVE-2024-12494 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The BMLT Meeting Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bmlt_meeting_map' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  BMLT Meeting Map

  Affected

  up to 2.6.1

  What to do

  Affects up to 2.6.1. Update BMLT Meeting Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 24, 2025Listamester: Stored Cross-Site ScriptingCVE-2024-13659 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Listamester plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'listamester' shortcode in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2025-24678 is a duplicate of this.

  Product

  Listamester

  Affected

  up to 2.3.4

  What to do

  Affects up to 2.3.4. Update Listamester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 23, 2025Save & Import Image from URL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23960 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in basteln3rk Save & Import Image from URL save-import-image-from-url allows Reflected XSS.This issue affects Save & Import Image from URL: from n/a through <= 0.7.

  Product

  Save & Import Image from URL

  Affected

  up to 0.7

  What to do

  Affects up to 0.7. Update Save & Import Image from URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2025wp-flickr-press: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23894 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tatsuya wp-flickr-press wp-flickr-press allows Reflected XSS.This issue affects wp-flickr-press: from n/a through <= 2.6.4.

  Product

  wp-flickr-press

  Affected

  up to 2.6.4

  What to do

  Affects up to 2.6.4. Update wp-flickr-press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2025Custom Coming Soon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23836 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SuryaBhan Custom Coming Soon custom-coming-soon allows Reflected XSS.This issue affects Custom Coming Soon: from n/a through <= 2.2.

  Product

  Custom Coming Soon

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Custom Coming Soon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2025Legal +: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23835 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jmraya Legal + legal-plus allows Reflected XSS.This issue affects Legal +: from n/a through <= 1.0.

  Product

  Legal +

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Legal + to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2025Links/Problem Reporter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23834 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RaminMT Links/Problem Reporter report-broken-links allows Reflected XSS.This issue affects Links/Problem Reporter: from n/a through <= 2.6.0.

  Product

  Links/Problem Reporter

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update Links/Problem Reporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2025SC Simple Zazzle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23733 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sayoko SC Simple Zazzle sc-simple-zazzle allows Reflected XSS.This issue affects SC Simple Zazzle: from n/a through <= 1.1.6.

  Product

  SC Simple Zazzle

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update SC Simple Zazzle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2025FLX Dashboard Groups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23730 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flx0 FLX Dashboard Groups flx-dashboard-groups allows Reflected XSS.This issue affects FLX Dashboard Groups: from n/a through <= 0.0.7.

  Product

  FLX Dashboard Groups

  Affected

  up to 0.0.7

  What to do

  Affects up to 0.0.7. Update FLX Dashboard Groups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2025XTRA Settings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23729 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fures XTRA Settings xtra-settings allows Reflected XSS.This issue affects XTRA Settings: from n/a through <= 2.1.8.

  Product

  XTRA Settings

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update XTRA Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2025AZ Content Finder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23727 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antonzaroutski AZ Content Finder az-content-finder allows Reflected XSS.This issue affects AZ Content Finder: from n/a through <= 0.1.

  Product

  AZ Content Finder

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update AZ Content Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2025Accessibility Task Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23725 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pshikli Accessibility Task Manager accessibility-task-manager allows Reflected XSS.This issue affects Accessibility Task Manager: from n/a through <= 1.2.1.

  Product

  Accessibility Task Manager

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Accessibility Task Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2025University Quizzes Online: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23724 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oleksandr87 University Quizzes Online university-quizzes-online allows Reflected XSS.This issue affects University Quizzes Online: from n/a through <= 1.4.

  Product

  University Quizzes Online

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update University Quizzes Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2025Plestar Directory Listing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23723 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hdw player Plestar Directory Listing plestar-directory-listing allows Reflected XSS.This issue affects Plestar Directory Listing: from n/a through <= 1.0.

  Product

  Plestar Directory Listing

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Plestar Directory Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2025Mind3doM RyeBread Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23722 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mind3dom Mind3doM RyeBread Widgets mind3dom-ryebread-widgets allows Reflected XSS.This issue affects Mind3doM RyeBread Widgets: from n/a through <= 1.0.

  Product

  Mind3doM RyeBread Widgets

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Mind3doM RyeBread Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2025My Favorite Car: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23636 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitar A. My Favorite Car my-favorite-cars allows Reflected XSS.This issue affects My Favorite Car: from n/a through <= 1.0.

  Product

  My Favorite Car

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update My Favorite Car to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2025Youtube Video Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23634 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codehandling Youtube Video Grid youmax-channel-embeds-for-youtube-businesses allows Reflected XSS.This issue affects Youtube Video Grid: from n/a through <= 1.9.

  Product

  Youtube Video Grid

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update Youtube Video Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.