Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

296new WordPress flaws this week

393,915entries in the database

15,428 results · page 137 of 309

Mar 26, 2025Site Editor Google Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23466 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsiteeditor Site Editor Google Map site-editor-google-map allows Reflected XSS.This issue affects Site Editor Google Map: from n/a through <= 1.0.1.
Product
Site Editor Google Map
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Site Editor Google Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025RWS Enquiry And Lead Follow-up: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23460 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rhizomaticweb RWS Enquiry And Lead Follow-up rws-enquiry allows Reflected XSS.This issue affects RWS Enquiry And Lead Follow-up: from n/a through <= 1.0.
Product
RWS Enquiry And Lead Follow-up
Affected
up to 1.0
What to do
Affects up to 1.0. Update RWS Enquiry And Lead Follow-up to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025NS Simple Intro Loader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23459 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NsThemes NS Simple Intro Loader ns-simple-intro-loader allows Reflected XSS.This issue affects NS Simple Intro Loader: from n/a through <= 2.2.3.
Product
NS Simple Intro Loader
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update NS Simple Intro Loader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025GetSocial: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22283 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Riyaz GetSocial getsocial allows Reflected XSS.This issue affects GetSocial: from n/a through <= 2.0.1.
Product
GetSocial
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update GetSocial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Ultimate Blocks – WordPress Blocks: Stored Cross-Site ScriptingCVE-2025-1312 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttonTextColor’ parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ultimate Blocks – WordPress Blocks
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update Ultimate Blocks – WordPress Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025Ultimate Blocks: Stored Cross-Site ScriptingCVE-2025-1703 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ultimate Blocks
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update Ultimate Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025Advanced iFrame: Stored Cross-Site ScriptingCVE-2025-1439 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2024.5 due to insufficient input sanitization and output escaping on user supplied attributes through the 'src' attribute when the src supplied returns a header with an injected value . This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced iFrame
Affected
up to 2024.5
What to do
Affects up to 2024.5. Update Advanced iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 26, 2025Advanced iFrame: Stored Cross-Site ScriptingCVE-2025-1437 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2025.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 2024.5, and later improved in version 2025.3.
Product
Advanced iFrame
Affected
up to 2025.2
What to do
Affects up to 2025.2. Update Advanced iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025Event post: Stored Cross-Site ScriptingCVE-2025-2167 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list' shortcodes in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Event post
Affected
up to 5.9.9
What to do
Affects up to 5.9.9. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 26, 2025Newsletters: Stored Cross-Site ScriptingCVE-2025-2009 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logging functionality in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Newsletters
Affected
up to 4.9.9.7
What to do
Affects up to 4.9.9.7. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025CRM and Lead Management by vcita: Stored Cross-Site ScriptingCVE-2024-13702 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler' and 'vCitaSchedulingCalendar' shortcodes in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CRM and Lead Management by vcita
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update CRM and Lead Management by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 26, 2025Spectra – WordPress Gutenberg Blocks: Stored Cross-Site ScriptingCVE-2025-1784 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb block in all versions up to, and including, 2.19.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Spectra – WordPress Gutenberg Blocks
Affected
up to 2.19.0
What to do
Affects up to 2.19.0. Update Spectra – WordPress Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025Smart Maintenance Mode: Does not sanitise and escape some of its settingsCVE-2024-12683 · WordPress plugins & themes · reported by WPScanLow 3.5
The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Smart Maintenance Mode
Fixed in
1.5.2
What to do
Update Smart Maintenance Mode to 1.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Ayyash Studio — The kick-start kit: Stored Cross-Site ScriptingCVE-2025-2576 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Ayyash Studio — The kick-start kit
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Ayyash Studio — The kick-start kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025Amazing service box Addons For WPBakery Page Builder (formerly Visual Composer): Stored Cross-Site ScriptingCVE-2025-2573 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Amazing service box Addons For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Amazing service box Addons For WPBakery Page Builder (formerly Visual Composer)
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Amazing service box Addons For WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025SH Email Alert: Reflected Cross-Site ScriptingCVE-2025-2165 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SH Email Alert plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
SH Email Alert
Affected
up to 1.0
What to do
Affects up to 1.0. Update SH Email Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 25, 2025Smart Maintenance Mode: Reflected Cross-Site ScriptingCVE-2025-1490 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Smart Maintenance Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘setstatus’ parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Smart Maintenance Mode
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Smart Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 25, 2025Advanced Woo Search: Stored Cross-Site ScriptingCVE-2025-2302 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aws_search_terms shortcode in all versions up to, and including, 3.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced Woo Search
Affected
up to 3.28
What to do
Affects up to 3.28. Update Advanced Woo Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025Gallery for Social Photo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26742 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery for Social Photo feed-instagram-lite allows Stored XSS.This issue affects Gallery for Social Photo: from n/a through <= 1.0.0.35.
Product
Gallery for Social Photo
Affected
up to 1.0.0.35
What to do
Affects up to 1.0.0.35. Update Gallery for Social Photo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2025Digital License Manager: Reflected Cross-Site ScriptingCVE-2025-2635 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Digital License Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg() function without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Digital License Manager
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Digital License Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025Your Simple SVG Support: Stored Cross-Site ScriptingCVE-2025-2542 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Your Simple SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Your Simple SVG Support
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Your Simple SVG Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025Frndzk Expandable Bottom Bar: Stored Cross-Site ScriptingCVE-2025-2510 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Frndzk Expandable Bottom Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Frndzk Expandable Bottom Bar
Affected
up to 1.0
What to do
Affects up to 1.0. Update Frndzk Expandable Bottom Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 25, 2025Alert Box Block – Display notice/alerts in the front end.: Stored Cross-Site ScriptingCVE-2024-13731 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Alert Box Block – Display notice/alerts in the front end. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Alert Box block in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Alert Box Block – Display notice/alerts in the front end.
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Alert Box Block – Display notice/alerts in the front end. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 25, 2025Estatebud – Properties & Listings: Cross-Site Request ForgeryCVE-2024-13710 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Estatebud – Properties & Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.5.0. This is due to missing or incorrect nonce validation on the 'estatebud_settings' page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Estatebud – Properties & Listings
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update Estatebud – Properties & Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 25, 2025WP Church Donation: Stored Cross-Site ScriptingCVE-2024-13690 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Church Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several donation form submission parameters in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Church Donation
Affected
up to 1.7
What to do
Affects up to 1.7. Update WP Church Donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Mar 25, 2025DICOM Support: Stored Cross-Site ScriptingCVE-2024-12623 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DICOM Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dcm' shortcode in all versions up to, and including, 0.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
DICOM Support
Affected
up to 0.10.6
What to do
Affects up to 0.10.6. Update DICOM Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings: Unauthorized access and modification of dataCVE-2025-2224 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'parse_query' function in all versions up to, and including, 8.2. This makes it possible for unauthenticated attackers to update the post_status of any post to 'publish'.
Product
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings
Affected
up to 8.2
What to do
Affects up to 8.2. Update Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025The does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site SCVE-2025-1798 · WordPress plugins & themes · reported by WPScanMedium 6.1
The does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site Scripting attacks.
Fixed in
1.1.2
What to do
Update the plugin to 1.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Favorites: Does not sanitise and escape some of its settingsCVE-2025-1452 · WordPress plugins & themes · reported by WPScanLow 3.5
The Favorites WordPress plugin before 2.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Favorites
Fixed in
2.3.5
What to do
Update Favorites to 2.3.5 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025DesignThemes Core Features: Stored Cross-Site ScriptingCVE-2025-0845 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
DesignThemes Core Features
Affected
up to 4.8
What to do
Affects up to 4.8. Update DesignThemes Core Features to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 25, 2025Stylish Google Sheet Reader 4.0: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13863 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Stylish Google Sheet Reader 4.0 WordPress plugin before 4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Stylish Google Sheet Reader 4.0
Fixed in
4.1
What to do
Update Stylish Google Sheet Reader 4.0 to 4.1 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025AFI: Does not sanitise and escape some of its settingsCVE-2024-13123 · WordPress plugins & themes · reported by WPScanLow 3.5
The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
AFI
Fixed in
1.100.0
What to do
Update AFI to 1.100.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025AFI: Does not sanitise and escape some of its settingsCVE-2024-13122 · WordPress plugins & themes · reported by WPScanLow 3.5
The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
AFI
Fixed in
1.100.0
What to do
Update AFI to 1.100.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Simple Banner: Does not sanitise and escape some of its settingsCVE-2024-12769 · WordPress plugins & themes · reported by WPScanLow 3.5
The Simple Banner WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Simple Banner
Fixed in
3.0.4
What to do
Update Simple Banner to 3.0.4 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Smart Maintenance Mode: Does not sanitise and escape some of its settingsCVE-2024-12682 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Smart Maintenance Mode
Fixed in
1.5.2
What to do
Update Smart Maintenance Mode to 1.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025WP Tabs: Does not sanitise and escape some of its settingsCVE-2024-11503 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Tabs WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WP Tabs
Fixed in
2.2.7
What to do
Update WP Tabs to 2.2.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Contact Form & SMTP Plugin for WordPress by PirateForms: Does not sanitise and escape some of its settingsCVE-2024-11273 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Contact Form & SMTP Plugin for WordPress by PirateForms
Fixed in
2.6.0
What to do
Update Contact Form & SMTP Plugin for WordPress by PirateForms to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Contact Form & SMTP Plugin for WordPress by PirateForms: Does not sanitise and escape some of its settingsCVE-2024-11272 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Contact Form & SMTP Plugin for WordPress by PirateForms
Fixed in
2.6.0
What to do
Update Contact Form & SMTP Plugin for WordPress by PirateForms to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Registrations for the Events Calendar: Does not sanitise and escape some of its settingsCVE-2024-10703 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Registrations for the Events Calendar
Fixed in
2.13.4
What to do
Update Registrations for the Events Calendar to 2.13.4 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Quiz and Survey Master (QSM): Does not sanitise and escape some of its settingsCVE-2024-10679 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Quiz and Survey Master (QSM)
Fixed in
9.2.1
What to do
Update Quiz and Survey Master (QSM) to 9.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Slider by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10566 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Slider by 10Web
Fixed in
1.2.62
What to do
Update Slider by 10Web to 1.2.62 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Slider by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10565 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Slider by 10Web
Fixed in
1.2.62
What to do
Update Slider by 10Web to 1.2.62 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10560 · WordPress plugins & themes · reported by WPScanLow 3.5
The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Form Maker by 10Web
Fixed in
1.15.30
What to do
Update Form Maker by 10Web to 1.15.30 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025WordPress WP-Advanced-Search: Does not sanitise and escape some of its settingsCVE-2024-10554 · WordPress plugins & themes · reported by WPScanLow 3.5
The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WordPress WP-Advanced-Search
Fixed in
3.3.9.3
What to do
Update WordPress WP-Advanced-Search to 3.3.9.3 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Stylish Price List: Does not sanitise and escape some of its settingsCVE-2024-10472 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Stylish Price List WordPress plugin before 7.1.12 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Stylish Price List
Fixed in
7.1.12
What to do
Update Stylish Price List to 7.1.12 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Job Postings: Does not sanitise and escape some of its settingsCVE-2024-10105 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Job Postings
Fixed in
2.7.11
What to do
Update Job Postings to 2.7.11 or newer.
Full record and what to do →NVD record wpscan.com
Mar 24, 2025wA11y – The Web Accessibility Toolbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30623 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry wA11y – The Web Accessibility Toolbox wa11y allows Stored XSS.This issue affects wA11y – The Web Accessibility Toolbox: from n/a through <= 1.0.3.
Product
wA11y – The Web Accessibility Toolbox
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update wA11y – The Web Accessibility Toolbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025WP Social Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through <= 2.2.7.
Product
WP Social Widget
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update WP Social Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Easy Page Transition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30606 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Logan Carlile Easy Page Transition easy-page-transition allows Stored XSS.This issue affects Easy Page Transition: from n/a through <= 1.0.1.
Product
Easy Page Transition
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Easy Page Transition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Related Posts via Categories: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30602 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alphasis Related Posts via Categories related-posts-via-categories allows Stored XSS.This issue affects Related Posts via Categories: from n/a through <= 2.1.2.
Product
Related Posts via Categories
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Related Posts via Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.