Vulnerability database

12,427 results · page 138 of 249

• Jan 16, 2025GDPR Personal Data Reports: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23777 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in willowsconsulting GDPR Personal Data Reports gdpr-personal-data-reports allows Stored XSS.This issue affects GDPR Personal Data Reports: from n/a through <= 1.0.5.

  Product

  GDPR Personal Data Reports

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update GDPR Personal Data Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025GMAPS for WPBakery Page Builder Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23775 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WWP GMAPS for WPBakery Page Builder Free gmaps-for-visual-composer-free allows Stored XSS.This issue affects GMAPS for WPBakery Page Builder Free: from n/a through <= 1.2.

  Product

  GMAPS for WPBakery Page Builder Free

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update GMAPS for WPBakery Page Builder Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025imaGenius: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23772 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eugenio Petulla’ imaGenius imagenius allows Stored XSS.This issue affects imaGenius: from n/a through <= 1.7.

  Product

  imaGenius

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update imaGenius to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Chatter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23760 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Volkov Chatter allows Stored XSS. This issue affects Chatter: from n/a through 1.0.1.

  Product

  Chatter

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Chatter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Greek Namedays Widget From Eortologio.Net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23783 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in carrotbits Greek Namedays Widget From Eortologio.Net greek-namedays-widget allows Stored XSS.This issue affects Greek Namedays Widget From Eortologio.Net: from n/a through <= 20191113.

  Product

  Greek Namedays Widget From Eortologio.Net

  Affected

  up to 20191113

  What to do

  Affects up to 20191113. Update Greek Namedays Widget From Eortologio.Net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Marmoset Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23767 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revoxis Marmoset Viewer marmoset-viewer allows Stored XSS.This issue affects Marmoset Viewer: from n/a through <= 1.9.3.

  Product

  Marmoset Viewer

  Affected

  up to 1.9.3

  What to do

  Affects up to 1.9.3. Update Marmoset Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Event Countdown Timer Plugin by TechMix: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23699 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techmix Event Countdown Timer Plugin by TechMix event-countdown-timer allows Reflected XSS.This issue affects Event Countdown Timer Plugin by TechMix: from n/a through <= 1.4.

  Product

  Event Countdown Timer Plugin by TechMix

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Event Countdown Timer Plugin by TechMix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Blogger Image Import: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23689 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Poco Blogger Image Import allows Stored XSS.This issue affects Blogger Image Import: from 2.1 through n/a.

  Product

  Blogger Image Import

  What to do

  Update Blogger Image Import to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025QuoteMedia Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23644 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in justin.kuepper QuoteMedia Tools quotemedia-tools allows DOM-Based XSS.This issue affects QuoteMedia Tools: from n/a through <= 1.0.

  Product

  QuoteMedia Tools

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update QuoteMedia Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Sidebar-Content from Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23642 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pflonk Sidebar-Content from Shortcode sidebar-content-from-shortcode allows DOM-Based XSS.This issue affects Sidebar-Content from Shortcode: from n/a through <= 2.0.

  Product

  Sidebar-Content from Shortcode

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Sidebar-Content from Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Powie's pLinks PagePeeker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23641 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PowieT Powie's pLinks PagePeeker plinks allows DOM-Based XSS.This issue affects Powie's pLinks PagePeeker: from n/a through <= 1.0.2.

  Product

  Powie's pLinks PagePeeker

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Powie's pLinks PagePeeker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Contact Form 7 – CCAvenue Add-on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23623 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Bisen Contact Form 7 – CCAvenue Add-on cf7-cc-avenue-add-on allows Reflected XSS.This issue affects Contact Form 7 – CCAvenue Add-on: from n/a through <= 1.0.

  Product

  Contact Form 7 – CCAvenue Add-on

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Contact Form 7 – CCAvenue Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Captchelfie – Captcha by Selfie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23620 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trof Captchelfie – Captcha by Selfie captchelfie-captcha-by-selfie allows Reflected XSS.This issue affects Captchelfie – Captcha by Selfie: from n/a through <= 1.0.7.

  Product

  Captchelfie – Captcha by Selfie

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Captchelfie – Captcha by Selfie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025LH Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23547 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH Login Page lh-login-page allows Reflected XSS.This issue affects LH Login Page: from n/a through <= 2.14.

  Product

  LH Login Page

  Affected

  up to 2.14

  What to do

  Affects up to 2.14. Update LH Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Stars SMTP Mailer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23453 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Myriad Solutionz Stars SMTP Mailer stars-smtp-mailer allows Reflected XSS.This issue affects Stars SMTP Mailer: from n/a through <= 1.7.

  Product

  Stars SMTP Mailer

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Stars SMTP Mailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025EditionGuard for WooCommerce – eBook Sales with DRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23452 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EditionGuard EditionGuard for WooCommerce – eBook Sales with DRM editionguard-for-woocommerce-ebook-sales-with-drm allows Reflected XSS.This issue affects EditionGuard for WooCommerce – eBook Sales with DRM: from n/a through <= 3.4.2.

  Product

  EditionGuard for WooCommerce – eBook Sales with DRM

  Affected

  up to 3.4.2

  What to do

  Affects up to 3.4.2. Update EditionGuard for WooCommerce – eBook Sales with DRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Scroll Top Advanced: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23444 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nasir179125 Scroll Top Advanced scroll-top-advanced allows Stored XSS.This issue affects Scroll Top Advanced: from n/a through <= 2.5.

  Product

  Scroll Top Advanced

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update Scroll Top Advanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP PT-Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23438 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Mimoun-Prat WP PT-Viewer wp-ptviewer allows Reflected XSS.This issue affects WP PT-Viewer: from n/a through <= 2.0.2.

  Product

  WP PT-Viewer

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update WP PT-Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Easy EU Cookie law: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23434 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in viher3 Easy EU Cookie law easy-eu-cookie-law allows Stored XSS.This issue affects Easy EU Cookie law: from n/a through <= 1.3.3.1.

  Product

  Easy EU Cookie law

  Affected

  up to 1.3.3.1

  What to do

  Affects up to 1.3.3.1. Update Easy EU Cookie law to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025AlT Report: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23432 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AlTi5 AlT Report alt-report allows Reflected XSS.This issue affects AlT Report: from n/a through <= 1.12.0.

  Product

  AlT Report

  Affected

  up to 1.12.0

  What to do

  Affects up to 1.12.0. Update AlT Report to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Altima Lookbook Free for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23429 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in altima-interactive Altima Lookbook Free for WooCommerce altima-lookbook-free-for-woocommerce allows Reflected XSS.This issue affects Altima Lookbook Free for WooCommerce: from n/a through <= 1.1.0.

  Product

  Altima Lookbook Free for WooCommerce

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Altima Lookbook Free for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP Responsive Tabs: Stored Cross-Site ScriptingCVE-2024-13387 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The WP Responsive Tabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprtabs' shortcode in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  WP Responsive Tabs

  Affected

  up to 1.2.9

  What to do

  Affects up to 1.2.9. Update WP Responsive Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 15, 2025Chamber Dashboard Business Directory: Stored Cross-Site ScriptingCVE-2024-11452 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'business_categories' shortcode in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Chamber Dashboard Business Directory

  Affected

  up to 3.3.8

  What to do

  Affects up to 3.3.8. Update Chamber Dashboard Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 15, 2025DWT - Directory & Listing: Reflected Cross-Site ScriptingCVE-2025-0170 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping on the 'sort_by' and 'token' parameters. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  DWT - Directory & Listing

  Affected

  up to 3.3.3

  What to do

  Affects up to 3.3.3. Update DWT - Directory & Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordscriptsbundle.gitbook.iowordfence.com

• Jan 15, 2025UpdraftPlus: WP Backup & Migration: Reflected Cross-Site ScriptingCVE-2025-0215 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and initiate_restore parameters in all versions up to, and including, 1.24.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link.

  Product

  UpdraftPlus: WP Backup & Migration

  Affected

  up to 1.24.12

  What to do

  Affects up to 1.24.12. Update UpdraftPlus: WP Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 15, 2025Responsive jQuery Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22798 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CHR Designer Responsive jQuery Slider responsive-jquery-slider allows Stored XSS.This issue affects Responsive jQuery Slider: from n/a through <= 1.1.1.

  Product

  Responsive jQuery Slider

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Responsive jQuery Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Gallery and Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22797 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oğulcan Özügenç Gallery and Lightbox gallery-and-lightbox allows Stored XSS.This issue affects Gallery and Lightbox: from n/a through <= 1.0.14.

  Product

  Gallery and Lightbox

  Affected

  up to 1.0.14

  What to do

  Affects up to 1.0.14. Update Gallery and Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Multilang Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22795 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitaldonkey Multilang Contact Form multilang-contact-form allows Reflected XSS.This issue affects Multilang Contact Form: from n/a through <= 1.5.

  Product

  Multilang Contact Form

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Multilang Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Bold pagos en linea: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22793 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Bold pagos en linea bold-pagos-en-linea allows DOM-Based XSS.This issue affects Bold pagos en linea: from n/a through <= 3.1.4.

  Product

  Bold pagos en linea

  Affected

  up to 3.1.4

  What to do

  Affects up to 3.1.4. Update Bold pagos en linea to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025CoDesigner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22788 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codexpert, Inc CoDesigner woolementor allows Stored XSS.This issue affects CoDesigner: from n/a through <= 4.29.

  Product

  CoDesigner

  Affected

  up to 4.29

  What to do

  Affects up to 4.29. Update CoDesigner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Nativery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22781 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nativery Nativery nativery allows DOM-Based XSS.This issue affects Nativery: from n/a through <= 0.1.6.

  Product

  Nativery

  Affected

  up to 0.1.6

  What to do

  Affects up to 0.1.6. Update Nativery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025wp-pano: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22780 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrey wp-pano wp-pano allows Stored XSS.This issue affects wp-pano: from n/a through <= 1.17.

  Product

  wp-pano

  Affected

  up to 1.17

  What to do

  Affects up to 1.17. Update wp-pano to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Lijit Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22778 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in damniel Lijit Search wp-lijit-wijit allows Reflected XSS.This issue affects Lijit Search: from n/a through <= 1.1.

  Product

  Lijit Search

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Lijit Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025WP Bulletin Board: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22776 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codebycarter WP Bulletin Board wp-bulletin-board allows Reflected XSS.This issue affects WP Bulletin Board: from n/a through <= 1.1.4.

  Product

  WP Bulletin Board

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update WP Bulletin Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Multifox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22769 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Brahma Multifox allows Stored XSS.This issue affects Multifox: from n/a through 1.3.7.

  Product

  Multifox

  Affected

  up to 1.3.7

  What to do

  Affects up to 1.3.7. Update Multifox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Zarinpal Paid Download: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22766 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Masoud Amini Zarinpal Paid Download zarinpal-paid-downloads allows Reflected XSS.This issue affects Zarinpal Paid Download: from n/a through <= 2.3.

  Product

  Zarinpal Paid Download

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Zarinpal Paid Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025WP Order By: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22765 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weiluri WP Order By wp-order-by allows Reflected XSS.This issue affects WP Order By: from n/a through <= 1.4.2.

  Product

  WP Order By

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update WP Order By to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025WP Post Corrector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22764 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vipul Jariwala WP Post Corrector wp-post-corrector allows Reflected XSS.This issue affects WP Post Corrector: from n/a through <= 1.0.2.

  Product

  WP Post Corrector

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update WP Post Corrector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22762 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Octrace WordPress HelpDesk & Support Ticket System Plugin – Octrace Support octrace-support allows Stored XSS.This issue affects WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: from n/a through <= 1.2.7.

  Product

  WordPress HelpDesk & Support Ticket System Plugin – Octrace Support

  Affected

  up to 1.2.7

  What to do

  Affects up to 1.2.7. Update WordPress HelpDesk & Support Ticket System Plugin – Octrace Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Ajax Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22761 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer Ajax Contact Form fws-ajax-contact-form allows Stored XSS.This issue affects Ajax Contact Form: from n/a through <= 1.4.1.

  Product

  Ajax Contact Form

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Ajax Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025CodeBard Help Desk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22760 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Reflected XSS.This issue affects CodeBard Help Desk: from n/a through <= 1.1.2.

  Product

  CodeBard Help Desk

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update CodeBard Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Post and Page Builder by BoldGrid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22759 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Stored XSS.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.5.

  Product

  Post and Page Builder by BoldGrid

  Affected

  up to 1.27.5

  What to do

  Affects up to 1.27.5. Update Post and Page Builder by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Elementor AI Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22758 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harnani Elementor AI Addons ai-addons-for-elementor allows DOM-Based XSS.This issue affects Elementor AI Addons: from n/a through <= 2.2.1.

  Product

  Elementor AI Addons

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update Elementor AI Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025WP Headmaster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22755 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bavington WP Headmaster wp-headmaster allows Reflected XSS.This issue affects WP Headmaster: from n/a through <= 0.3.

  Product

  WP Headmaster

  Affected

  up to 0.3

  What to do

  Affects up to 0.3. Update WP Headmaster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Amber: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22754 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Berkman Klein Center Amber amberlink allows Reflected XSS.This issue affects Amber: from n/a through <= 1.4.4.

  Product

  Amber

  Affected

  up to 1.4.4

  What to do

  Affects up to 1.4.4. Update Amber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025turboSMTP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22753 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in turboSMTP turboSMTP turbosmtp allows Reflected XSS.This issue affects turboSMTP: from n/a through <= 4.6.

  Product

  turboSMTP

  Affected

  up to 4.6

  What to do

  Affects up to 4.6. Update turboSMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025GSheetConnector for Forminator Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22752 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WesternDeal GSheetConnector for Forminator Forms gsheetconnector-forminator allows Reflected XSS.This issue affects GSheetConnector for Forminator Forms: from n/a through <= 1.0.12.

  Product

  GSheetConnector for Forminator Forms

  Affected

  up to 1.0.12

  What to do

  Affects up to 1.0.12. Update GSheetConnector for Forminator Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Partners: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22751 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in farinspace Partners partners allows Reflected XSS.This issue affects Partners: from n/a through <= 0.2.0.

  Product

  Partners

  Affected

  up to 0.2.0

  What to do

  Affects up to 0.2.0. Update Partners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Post Carousel & Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22750 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Patel Post Carousel & Slider post-types-carousel-slider allows Reflected XSS.This issue affects Post Carousel & Slider: from n/a through <= 1.0.4.

  Product

  Post Carousel & Slider

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Post Carousel & Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Social Media Engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22749 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemesCraft.co Social Media Engine social-media-engine allows Stored XSS.This issue affects Social Media Engine: from n/a through <= 1.0.2.

  Product

  Social Media Engine

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Social Media Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.