Vulnerability database

15,923 results · page 134 of 319

• Apr 1, 2025mFolio Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31847 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelooks mFolio Lite mfolio-lite allows DOM-Based XSS.This issue affects mFolio Lite: from n/a through <= 1.2.3.

  Product

  mFolio Lite

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update mFolio Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Theme Duplicator: Cross-Site Request Forgery (CSRF)CVE-2025-31845 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Rohit Choudhary Theme Duplicator theme-duplicator allows Cross Site Request Forgery.This issue affects Theme Duplicator: from n/a through <= 1.1.

  Product

  Theme Duplicator

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Theme Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Magical Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31844 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Blocks magical-blocks allows Stored XSS.This issue affects Magical Blocks: from n/a through <= 1.0.12.

  Product

  Magical Blocks

  Affected

  up to 1.0.12

  What to do

  Affects up to 1.0.12. Update Magical Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Simple Fixed Notice: Cross-Site Request Forgery (CSRF)CVE-2025-31840 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in digireturn Simple Fixed Notice dn-cookie-notice allows Cross Site Request Forgery.This issue affects Simple Fixed Notice: from n/a through <= 1.6.

  Product

  Simple Fixed Notice

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Simple Fixed Notice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025DN Footer Contacts: Cross-Site Request Forgery (CSRF)CVE-2025-31839 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in digireturn DN Footer Contacts dn-footer-contacts allows Cross Site Request Forgery.This issue affects DN Footer Contacts: from n/a through <= 1.8.1.

  Product

  DN Footer Contacts

  Affected

  up to 1.8.1

  What to do

  Affects up to 1.8.1. Update DN Footer Contacts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Eventbee RSVP Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31838 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eventbee Eventbee RSVP Widget eventbee-rsvp-widget allows DOM-Based XSS.This issue affects Eventbee RSVP Widget: from n/a through <= 1.0.

  Product

  Eventbee RSVP Widget

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Eventbee RSVP Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Proposals: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31837 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Codeus WP Proposals allows Stored XSS. This issue affects WP Proposals: from n/a through 2.3.

  Product

  WP Proposals

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update WP Proposals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Plugin Info Card: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31835 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brice Capobianco WP Plugin Info Card wp-plugin-info-card allows DOM-Based XSS.This issue affects WP Plugin Info Card: from n/a through <= 5.3.0.

  Product

  WP Plugin Info Card

  Affected

  up to 5.3.0

  What to do

  Affects up to 5.3.0. Update WP Plugin Info Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025ShopCred: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31829 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devscred ShopCred shopcred allows DOM-Based XSS.This issue affects ShopCred: from n/a through <= 1.3.0.

  Product

  ShopCred

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update ShopCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Easy!Appointments: Cross-Site Request Forgery (CSRF)CVE-2025-31828 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in alextselegidis Easy!Appointments easyappointments allows Cross Site Request Forgery.This issue affects Easy!Appointments: from n/a through <= 1.4.2.

  Product

  Easy!Appointments

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update Easy!Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WPoperation Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31823 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpoperations WPoperation Elementor Addons wpop-elementor-addons allows Stored XSS.This issue affects WPoperation Elementor Addons: from n/a through <= 1.1.9.

  Product

  WPoperation Elementor Addons

  Affected

  up to 1.1.9

  What to do

  Affects up to 1.1.9. Update WPoperation Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025ContentBot AI Writer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31818 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ContentBot.ai ContentBot AI Writer content-bot allows Stored XSS.This issue affects ContentBot AI Writer: from n/a through <= 1.2.4.

  Product

  ContentBot AI Writer

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update ContentBot AI Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025BlockWheels: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31817 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPWheels BlockWheels blockwheels allows DOM-Based XSS.This issue affects BlockWheels: from n/a through <= 1.0.2.

  Product

  BlockWheels

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update BlockWheels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Design Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31815 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devscred Design Blocks exclusive-blocks allows Stored XSS.This issue affects Design Blocks: from n/a through <= 1.2.5.

  Product

  Design Blocks

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Design Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025OwnerRez API: Cross-Site Request Forgery (CSRF)CVE-2025-31814 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in OwnerRez OwnerRez API ownerrez allows Cross Site Request Forgery.This issue affects OwnerRez API: from n/a through <= 1.2.0.

  Product

  OwnerRez API

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update OwnerRez API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WPSHARE247 Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31813 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Website366.com WPSHARE247 Elementor Addons wpshare247-elementor-addons allows Stored XSS.This issue affects WPSHARE247 Elementor Addons: from n/a through <= 2.5.

  Product

  WPSHARE247 Elementor Addons

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update WPSHARE247 Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025BuddyPress Members Only: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31812 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomas BuddyPress Members Only buddypress-members-only allows Stored XSS.This issue affects BuddyPress Members Only: from n/a through <= 3.5.3.

  Product

  BuddyPress Members Only

  Affected

  up to 3.5.3

  What to do

  Affects up to 3.5.3. Update BuddyPress Members Only to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Planyo online reservation system: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31811 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtreeme Planyo online reservation system planyo-online-reservation-system allows Stored XSS.This issue affects Planyo online reservation system: from n/a through <= 3.1.

  Product

  Planyo online reservation system

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update Planyo online reservation system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Labinator Content Types Duplicator: Cross-Site Request Forgery (CSRF)CVE-2025-31809 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Labinator Labinator Content Types Duplicator labinator-content-types-duplicator allows Cross Site Request Forgery.This issue affects Labinator Content Types Duplicator: from n/a through <= 1.1.3.

  Product

  Labinator Content Types Duplicator

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Labinator Content Types Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025SCSS WP Editor: Cross-Site Request Forgery (CSRF)CVE-2025-31808 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in IT Path Solutions SCSS WP Editor scss-wp-editor allows Cross Site Request Forgery.This issue affects SCSS WP Editor: from n/a through <= 1.2.1.

  Product

  SCSS WP Editor

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update SCSS WP Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Product Notices for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-31807 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in CloudRedux Product Notices for WooCommerce product-notices-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Notices for WooCommerce: from n/a through <= 1.3.4.

  Product

  Product Notices for WooCommerce

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update Product Notices for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Webling: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31806 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uSystems Webling webling allows Stored XSS.This issue affects Webling: from n/a through <= 3.9.0.

  Product

  Webling

  Affected

  up to 3.9.0

  What to do

  Affects up to 3.9.0. Update Webling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Gutena Kit – Gutenberg Blocks and Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31805 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal Gutena Kit – Gutenberg Blocks and Templates gutena-kit allows Stored XSS.This issue affects Gutena Kit – Gutenberg Blocks and Templates: from n/a through <= 2.0.7.

  Product

  Gutena Kit – Gutenberg Blocks and Templates

  Affected

  up to 2.0.7

  What to do

  Affects up to 2.0.7. Update Gutena Kit – Gutenberg Blocks and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Follow Us Badges: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31804 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DraftPress Team Follow Us Badges wpsite-follow-us-badges allows Stored XSS.This issue affects Follow Us Badges: from n/a through <= 3.1.11.

  Product

  Follow Us Badges

  Affected

  up to 3.1.11

  What to do

  Affects up to 3.1.11. Update Follow Us Badges to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Turisbook Booking System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31803 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Neteuro Turisbook Booking System turisbook-booking-system allows Stored XSS.This issue affects Turisbook Booking System: from n/a through <= 1.3.8.

  Product

  Turisbook Booking System

  Affected

  up to 1.3.8

  What to do

  Affects up to 1.3.8. Update Turisbook Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025MX Time Zone Clocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31801 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maksym Marko MX Time Zone Clocks mx-time-zone-clocks allows Reflected XSS.This issue affects MX Time Zone Clocks: from n/a through <= 5.1.1.

  Product

  MX Time Zone Clocks

  Affected

  up to 5.1.1

  What to do

  Affects up to 5.1.1. Update MX Time Zone Clocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Sprout Clients: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31797 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Stored XSS.This issue affects Sprout Clients: from n/a through <= 3.2.

  Product

  Sprout Clients

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update Sprout Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Piotnet Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31793 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Forms piotnetforms allows Stored XSS.This issue affects Piotnet Forms: from n/a through <= 1.0.30.

  Product

  Piotnet Forms

  Affected

  up to 1.0.30

  What to do

  Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Piotnet Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31792 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Forms piotnetforms allows Stored XSS.This issue affects Piotnet Forms: from n/a through <= 1.0.30.

  Product

  Piotnet Forms

  Affected

  up to 1.0.30

  What to do

  Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Posten: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31790 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Binsaifullah Posten posten-post-blocks allows DOM-Based XSS.This issue affects Posten: from n/a through <= 0.0.1.

  Product

  Posten

  Affected

  up to 0.0.1

  What to do

  Affects up to 0.0.1. Update Posten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Clearbit Reveal: Cross-Site Request Forgery (CSRF)CVE-2025-31785 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Clearbit Clearbit Reveal clearbit allows Cross Site Request Forgery.This issue affects Clearbit Reveal: from n/a through <= 1.0.6.

  Product

  Clearbit Reveal

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Clearbit Reveal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Embed Extended: Cross-Site Request Forgery (CSRF)CVE-2025-31784 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Rudy Susanto Embed Extended embed-extended allows Cross Site Request Forgery.This issue affects Embed Extended: from n/a through <= 1.4.0.

  Product

  Embed Extended

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Embed Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Leartes TRY Exchange Rates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31783 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leartes.NET Leartes TRY Exchange Rates leartes-try-exchange-rates allows Stored XSS.This issue affects Leartes TRY Exchange Rates: from n/a through <= 2.1.

  Product

  Leartes TRY Exchange Rates

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Leartes TRY Exchange Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Query Wrangler: Cross-Site Request Forgery (CSRF)CVE-2025-31779 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Jonathan Daggerhart Query Wrangler query-wrangler allows Cross Site Request Forgery.This issue affects Query Wrangler: from n/a through <= 1.5.54.

  Product

  Query Wrangler

  Affected

  up to 1.5.54

  What to do

  Affects up to 1.5.54. Update Query Wrangler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Donate Me: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31778 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in raphaelheide Donate Me donate-me allows Reflected XSS.This issue affects Donate Me: from n/a through <= 1.2.5.

  Product

  Donate Me

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Donate Me to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Uptime Robot Plugin for: Cross-Site Request Forgery (CSRF)CVE-2025-31776 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Aphotrax Uptime Robot Plugin for WordPress uptime-robot-monitor allows Cross Site Request Forgery.This issue affects Uptime Robot Plugin for WordPress: from n/a through <= 2.3.

  Product

  Uptime Robot Plugin for

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Uptime Robot Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Google SEO Pressor Snippet: Cross-Site Request Forgery (CSRF)CVE-2025-31775 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Smackcoders Inc., Google SEO Pressor Snippet google-seo-author-snippets allows Cross Site Request Forgery.This issue affects Google SEO Pressor Snippet: from n/a through <= 2.0.

  Product

  Google SEO Pressor Snippet

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Google SEO Pressor Snippet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Modal Popup with Cookie Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31772 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify WP Modal Popup with Cookie Integration wp-modal-popup-with-cookie-integration allows Stored XSS.This issue affects WP Modal Popup with Cookie Integration: from n/a through <= 2.4.

  Product

  WP Modal Popup with Cookie Integration

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update WP Modal Popup with Cookie Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Team Members for Elementor Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31771 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sultan Nasir Uddin Team Members for Elementor Page Builder team-members-for-elementor allows Stored XSS.This issue affects Team Members for Elementor Page Builder: from n/a through <= 1.0.4.

  Product

  Team Members for Elementor Page Builder

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Team Members for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Content Manager Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31770 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Content Manager Light content-manager-light allows Stored XSS.This issue affects Content Manager Light: from n/a through <= 3.2.

  Product

  Content Manager Light

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update Content Manager Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025CLP – Custom Login Page by NiteoThemes: Cross-Site Request Forgery (CSRF)CVE-2025-31769 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in NiteoThemes CLP – Custom Login Page by NiteoThemes clp-custom-login-page allows Cross Site Request Forgery.This issue affects CLP – Custom Login Page by NiteoThemes: from n/a through <= 1.5.5.

  Product

  CLP – Custom Login Page by NiteoThemes

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update CLP – Custom Login Page by NiteoThemes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Post Custom Templates Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31767 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Post Custom Templates Lite post-custom-templates-lite allows Stored XSS.This issue affects Post Custom Templates Lite: from n/a through <= 1.14.

  Product

  Post Custom Templates Lite

  Affected

  up to 1.14

  What to do

  Affects up to 1.14. Update Post Custom Templates Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025PhotoShelter for Photographers Blog Feed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31766 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PhotoShelter PhotoShelter for Photographers Blog Feed Plugin photoshelter-official-plugin allows Stored XSS.This issue affects PhotoShelter for Photographers Blog Feed Plugin: from n/a through <= 1.5.7.

  Product

  PhotoShelter for Photographers Blog Feed

  Affected

  up to 1.5.7

  What to do

  Affects up to 1.5.7. Update PhotoShelter for Photographers Blog Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Cache control by Cacholong: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31764 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Preliot Cache control by Cacholong cache-control-by-cacholong allows Stored XSS.This issue affects Cache control by Cacholong: from n/a through <= 5.4.1.

  Product

  Cache control by Cacholong

  Affected

  up to 5.4.1

  What to do

  Affects up to 5.4.1. Update Cache control by Cacholong to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Cache control by Cacholong: Cross-Site Request Forgery (CSRF)CVE-2025-31763 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Preliot Cache control by Cacholong cache-control-by-cacholong allows Cross Site Request Forgery.This issue affects Cache control by Cacholong: from n/a through <= 5.4.1.

  Product

  Cache control by Cacholong

  Affected

  up to 5.4.1

  What to do

  Affects up to 5.4.1. Update Cache control by Cacholong to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Sheet2Site: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31762 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andreyazimov Sheet2Site sheet2site allows Stored XSS.This issue affects Sheet2Site: from n/a through <= 1.0.18.

  Product

  Sheet2Site

  Affected

  up to 1.0.18

  What to do

  Affects up to 1.0.18. Update Sheet2Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Hypotext: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31761 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DEJAN Hypotext hypotext allows Stored XSS.This issue affects Hypotext: from n/a through <= 1.0.1.

  Product

  Hypotext

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Hypotext to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025SnapWidget Social Photo Feed Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31760 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snapwidget SnapWidget Social Photo Feed Widget snapwidget-wp-instagram-widget allows DOM-Based XSS.This issue affects SnapWidget Social Photo Feed Widget: from n/a through <= 1.1.0.

  Product

  SnapWidget Social Photo Feed Widget

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update SnapWidget Social Photo Feed Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Boo Recipes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31759 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BooSpot Boo Recipes boo-recipes allows Stored XSS.This issue affects Boo Recipes: from n/a through <= 2.4.1.

  Product

  Boo Recipes

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update Boo Recipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025TZ PlusGallery: Cross-Site Request Forgery (CSRF)CVE-2025-31756 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in tuyennv TZ PlusGallery tz-plus-gallery allows Cross Site Request Forgery.This issue affects TZ PlusGallery: from n/a through <= 1.5.5.

  Product

  TZ PlusGallery

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update TZ PlusGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.