Vulnerability database

15,923 results · page 136 of 319

• Mar 31, 2025Useinfluence: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31625 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ramanparashar Useinfluence useinfluence allows Stored XSS.This issue affects Useinfluence: from n/a through <= 1.0.8.

  Product

  Useinfluence

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Useinfluence to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Processing Projects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31624 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LABCAT Processing Projects processing-projects allows DOM-Based XSS.This issue affects Processing Projects: from n/a through <= 1.0.2.

  Product

  Processing Projects

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Processing Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Rich Text Editor: Cross-Site Request Forgery (CSRF)CVE-2025-31623 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in richtexteditor Rich Text Editor richtexteditor allows Stored XSS.This issue affects Rich Text Editor: from n/a through <= 1.0.1.

  Product

  Rich Text Editor

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Rich Text Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025byBrick Accordion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31621 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davidpaulsson byBrick Accordion bybrick-accordion allows Stored XSS.This issue affects byBrick Accordion: from n/a through <= 1.0.

  Product

  byBrick Accordion

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update byBrick Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025CoverManager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31620 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in carperfer CoverManager covermanager allows Stored XSS.This issue affects CoverManager: from n/a through <= 0.0.1.

  Product

  CoverManager

  Affected

  up to 0.0.1

  What to do

  Affects up to 0.0.1. Update CoverManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025PostmarkApp Email Integrator: Cross-Site Request Forgery (CSRF)CVE-2025-31617 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Gagan Deep Singh PostmarkApp Email Integrator postmarkapp-email-integrator allows Cross Site Request Forgery.This issue affects PostmarkApp Email Integrator: from n/a through <= 2.4.

  Product

  PostmarkApp Email Integrator

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update PostmarkApp Email Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Varnish: Cross-Site Request Forgery (CSRF)CVE-2025-31616 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in AdminGeekZ Varnish WordPress varnish-wp allows Cross Site Request Forgery.This issue affects Varnish WordPress: from n/a through <= 1.7.

  Product

  Varnish

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Varnish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Simple Contact Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31615 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in owenr88 Simple Contact Forms simple-contact-forms allows Stored XSS.This issue affects Simple Contact Forms: from n/a through <= 1.6.4.

  Product

  Simple Contact Forms

  Affected

  up to 1.6.4

  What to do

  Affects up to 1.6.4. Update Simple Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Terms Before Download: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31614 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hiroprot Terms Before Download terms-before-download allows Stored XSS.This issue affects Terms Before Download: from n/a through <= 1.0.5.

  Product

  Terms Before Download

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Terms Before Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025AB Google Map Travel: Cross-Site Request Forgery (CSRF)CVE-2025-31613 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Aboobacker. AB Google Map Travel ab-google-map-travel allows Cross Site Request Forgery.This issue affects AB Google Map Travel : from n/a through <= 4.6.

  Product

  AB Google Map Travel

  Affected

  up to 4.6

  What to do

  Affects up to 4.6. Update AB Google Map Travel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31610 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gingerplugins Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme gp-notification-bar allows Stored XSS.This issue affects Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme: from n/a through <= 1.1.

  Product

  Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025CookieHint WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31608 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reDim GmbH CookieHint WP cookiehint-wp allows Stored XSS.This issue affects CookieHint WP: from n/a through <= 1.0.0.

  Product

  CookieHint WP

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update CookieHint WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Simple-Audioplayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31607 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flomei Simple-Audioplayer simple-audioplayer allows Stored XSS.This issue affects Simple-Audioplayer: from n/a through <= 1.1.

  Product

  Simple-Audioplayer

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Simple-Audioplayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Welcome Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31605 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WeblineIndia Welcome Popup welcome-popup allows Stored XSS.This issue affects Welcome Popup: from n/a through <= 1.0.10.

  Product

  Welcome Popup

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update Welcome Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Apimo Connector: Cross-Site Request Forgery (CSRF)CVE-2025-31602 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Proptech Plugin Apimo Connector apimo allows Cross Site Request Forgery.This issue affects Apimo Connector: from n/a through <= 2.6.5.1.

  Product

  Apimo Connector

  Affected

  up to 2.6.5.1

  What to do

  Affects up to 2.6.5.1. Update Apimo Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Appointy Appointment Scheduler: Cross-Site Request Forgery (CSRF)CVE-2025-31601 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in appointy Appointy Appointment Scheduler appointy-appointment-scheduler allows Cross Site Request Forgery.This issue affects Appointy Appointment Scheduler: from n/a through <= 4.2.1.

  Product

  Appointy Appointment Scheduler

  Affected

  up to 4.2.1

  What to do

  Affects up to 4.2.1. Update Appointy Appointment Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025DesignO: Cross-Site Request Forgery (CSRF)CVE-2025-31600 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in designnbuy DesignO designo allows Cross Site Request Forgery.This issue affects DesignO: from n/a through <= 2.6.0.

  Product

  DesignO

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update DesignO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Quantity Dynamic Pricing & Bulk Discounts for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31598 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Quantity Dynamic Pricing & Bulk Discounts for WooCommerce wholesale-pricing-woocommerce allows Stored XSS.This issue affects Quantity Dynamic Pricing & Bulk Discounts for WooCommerce: from n/a through <= 4.0.3.

  Product

  Quantity Dynamic Pricing & Bulk Discounts for WooCommerce

  Affected

  up to 4.0.3

  What to do

  Affects up to 4.0.3. Update Quantity Dynamic Pricing & Bulk Discounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Ultimate Live Cricket WordPress Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31597 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crazycric Ultimate Live Cricket WordPress Lite ultimate-live-cricket-lite allows Stored XSS.This issue affects Ultimate Live Cricket WordPress Lite: from n/a through <= 1.4.2.

  Product

  Ultimate Live Cricket WordPress Lite

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update Ultimate Live Cricket WordPress Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Timeline Event History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31595 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Timeline Event History timeline-event-history allows Stored XSS.This issue affects Timeline Event History: from n/a through <= 3.2.

  Product

  Timeline Event History

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update Timeline Event History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025OpenMenu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31593 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OpenMenu OpenMenu allows Stored XSS. This issue affects OpenMenu: from n/a through 3.5.

  Product

  OpenMenu

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update OpenMenu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Send E-mail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31592 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo Melchiorre Send E-mail send-e-mail allows Stored XSS.This issue affects Send E-mail: from n/a through <= 1.3.

  Product

  Send E-mail

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Send E-mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Exit Popup Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31591 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in promoz73 Exit Popup Free exit-popup-free allows Stored XSS.This issue affects Exit Popup Free: from n/a through <= 1.0.

  Product

  Exit Popup Free

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Exit Popup Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025WP Date and Time Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31590 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denra.com WP Date and Time Shortcode wp-date-and-time-shortcode allows Stored XSS.This issue affects WP Date and Time Shortcode: from n/a through <= 2.6.7.

  Product

  WP Date and Time Shortcode

  Affected

  up to 2.6.7

  What to do

  Affects up to 2.6.7. Update WP Date and Time Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Ethiopian Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31589 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kibru Demeke Ethiopian Calendar ethiopian-calendar allows Stored XSS.This issue affects Ethiopian Calendar: from n/a through <= 1.1.1.

  Product

  Ethiopian Calendar

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Ethiopian Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Elfsight Testimonials Slider: Cross-Site Request Forgery (CSRF)CVE-2025-31588 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in elfsight Elfsight Testimonials Slider elfsight-testimonials-slider allows Cross Site Request Forgery.This issue affects Elfsight Testimonials Slider: from n/a through <= 1.0.1.

  Product

  Elfsight Testimonials Slider

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Elfsight Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Elfsight Testimonials Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31587 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elfsight Elfsight Testimonials Slider elfsight-testimonials-slider allows Stored XSS.This issue affects Elfsight Testimonials Slider: from n/a through <= 1.0.1.

  Product

  Elfsight Testimonials Slider

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Elfsight Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Gallery – Photo Albums: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31586 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery – Photo Albums Plugin easy-media-gallery allows Stored XSS.This issue affects Gallery – Photo Albums Plugin: from n/a through <= 1.3.170.

  Product

  Gallery – Photo Albums

  Affected

  up to 1.3.170

  What to do

  Affects up to 1.3.170. Update Gallery – Photo Albums to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Leadfox for: Cross-Site Request Forgery (CSRF)CVE-2025-31585 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in leadfox Leadfox for WordPress leadfox allows Cross Site Request Forgery.This issue affects Leadfox for WordPress: from n/a through <= 2.1.9.

  Product

  Leadfox for

  Affected

  up to 2.1.9

  What to do

  Affects up to 2.1.9. Update Leadfox for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025WP Copy Media URL: Cross-Site Request Forgery (CSRF)CVE-2025-31583 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Ashish Ajani WP Copy Media URL wp-copy-media-url allows Stored XSS.This issue affects WP Copy Media URL: from n/a through <= 2.1.

  Product

  WP Copy Media URL

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update WP Copy Media URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Custom Content Scrollbar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31574 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoftHopper Custom Content Scrollbar custom-content-scrollbar allows Stored XSS.This issue affects Custom Content Scrollbar: from n/a through <= 1.3.

  Product

  Custom Content Scrollbar

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Custom Content Scrollbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Multi Days Events and Multi Events in One Day Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-31572 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in v20202020 Multi Days Events and Multi Events in One Day Calendar dragon-calendar-free-version allows Cross Site Request Forgery.This issue affects Multi Days Events and Multi Events in One Day Calendar: from n/a through <= 1.1.3.

  Product

  Multi Days Events and Multi Events in One Day Calendar

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Multi Days Events and Multi Events in One Day Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Related Posts Widget with Thumbnails: Cross-Site Request Forgery (CSRF)CVE-2025-31570 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in wp-buy Related Posts Widget with Thumbnails advanced-css3-related-posts-widget allows Stored XSS.This issue affects Related Posts Widget with Thumbnails: from n/a through <= 1.2.

  Product

  Related Posts Widget with Thumbnails

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Related Posts Widget with Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025wordpress related Posts with thumbnails: Cross-Site Request Forgery (CSRF)CVE-2025-31569 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in wp-buy wordpress related Posts with thumbnails related-posts-list-grid-and-slider-all-in-one allows Stored XSS.This issue affects wordpress related Posts with thumbnails: from n/a through <= 3.0.0.1.

  Product

  wordpress related Posts with thumbnails

  Affected

  up to 3.0.0.1

  What to do

  Affects up to 3.0.0.1. Update wordpress related Posts with thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025themesflat-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31567 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows Stored XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.3.1.

  Product

  themesflat-addons-for-elementor

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update themesflat-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Rio Video Gallery: Cross-Site Request Forgery (CSRF)CVE-2025-31566 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in riosisgroup Rio Video Gallery rio-video-gallery allows Stored XSS.This issue affects Rio Video Gallery: from n/a through <= 2.3.6.

  Product

  Rio Video Gallery

  Affected

  up to 2.3.6

  What to do

  Affects up to 2.3.6. Update Rio Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Uptime Robot Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31562 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aphotrax Uptime Robot Plugin for WordPress uptime-robot-monitor allows DOM-Based XSS.This issue affects Uptime Robot Plugin for WordPress: from n/a through <= 2.3.

  Product

  Uptime Robot Plugin for

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Uptime Robot Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Custom Database Applications by Caspio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31559 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caspio Bridge Custom Database Applications by Caspio custom-database-applications-by-caspio allows DOM-Based XSS.This issue affects Custom Database Applications by Caspio: from n/a through <= 2.1.

  Product

  Custom Database Applications by Caspio

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Custom Database Applications by Caspio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025OSM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31557 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MiKa OSM osm allows DOM-Based XSS.This issue affects OSM: from n/a through <= 6.1.13.

  Product

  OSM

  Affected

  up to 6.1.13

  What to do

  Affects up to 6.1.13. Update OSM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025IMPress for IDX Broker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31556 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through <= 3.2.3.

  Product

  IMPress for IDX Broker

  Affected

  up to 3.2.3

  What to do

  Affects up to 3.2.3. Update IMPress for IDX Broker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Fusion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31549 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agency Dominion Inc. Fusion fusion allows DOM-Based XSS.This issue affects Fusion: from n/a through <= 1.6.4.

  Product

  Fusion

  Affected

  up to 1.6.4

  What to do

  Affects up to 1.6.4. Update Fusion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Twice Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31543 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twice Commerce Twice Commerce embed-rentle allows DOM-Based XSS.This issue affects Twice Commerce: from n/a through <= 1.3.1.

  Product

  Twice Commerce

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Twice Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Checklist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31538 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in checklistcom Checklist checklist allows Stored XSS.This issue affects Checklist: from n/a through <= 1.1.9.

  Product

  Checklist

  Affected

  up to 1.1.9

  What to do

  Affects up to 1.1.9. Update Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Simple Owl Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31535 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Owl Carousel simple-owl-carousel allows DOM-Based XSS.This issue affects Simple Owl Carousel: from n/a through <= 1.1.1.

  Product

  Simple Owl Carousel

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Simple Owl Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025AtomChat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31532 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team AtomChat AtomChat atomchat allows Stored XSS.This issue affects AtomChat: from n/a through <= 1.1.8.

  Product

  AtomChat

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update AtomChat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Churel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31419 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeix Churel allows DOM-Based XSS.This issue affects Churel: from n/a through 1.0.8.

  Product

  Churel

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Churel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025JetSmartFilters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30963 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows DOM-Based XSS.This issue affects JetSmartFilters: from n/a through <= 3.6.3.

  Product

  JetSmartFilters

  Affected

  up to 3.6.3

  What to do

  Affects up to 3.6.3. Update JetSmartFilters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Tantyyellow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23995 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ta2g Tantyyellow allows Reflected XSS.This issue affects Tantyyellow: from n/a through 1.0.0.5.

  Product

  Tantyyellow

  Affected

  up to 1.0.0.5

  What to do

  Affects up to 1.0.0.5. Update Tantyyellow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025WP Church Donation: Cross-Site Request Forgery (CSRF)CVE-2025-31410 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Ashish Ajani WP Church Donation wp-church-donation allows Cross Site Request Forgery.This issue affects WP Church Donation: from n/a through <= 1.7.

  Product

  WP Church Donation

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update WP Church Donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Trackserver: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30961 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tinuzz Trackserver trackserver allows DOM-Based XSS.This issue affects Trackserver: from n/a through <= 5.1.0.

  Product

  Trackserver

  Affected

  up to 5.1.0

  What to do

  Affects up to 5.1.0. Update Trackserver to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.