Vulnerability database

6,567 results · page 14 of 132

• Mar 26, 2026Elementor Website Builder: Incorrect Authorization to Sensitive Information ExposureCVE-2026-1206 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and including, 3.35.7. This is due to a logic error in the is_allowed_to_read_template() function permission check that treats non-published templates as readable without verifying edit capabilities. This makes it possible for authenticated attackers, with contributor-level access and above, to read private or draft Elementor template content via the 'template_id' supplied to the 'get_template_data' action of the 'elementor_ajax' endpoint.

  Product

  Elementor Website Builder

  Affected

  up to 3.35.7

  What to do

  Affects up to 3.35.7. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Mar 26, 2026FormLift for Infusionsoft Web Forms: Missing AuthorizationCVE-2026-4281 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The FormLift for Infusionsoft Web Forms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 7.5.21. This is due to missing capability checks on the connect() and listen_for_tokens() methods of the FormLift_Infusionsoft_Manager class, both of which are hooked to 'plugins_loaded' and execute on every page load. The connect() function generates an OAuth connection password and leaks it in the redirect Location header without verifying the requesting user is authenticated or authorized. The listen_for_tokens() function only validates the temporary password but performs no user authentication before calling update_option() to save attacker-controlled OAuth tokens and app domain. This makes it possible for unauthenticated attackers to hijack the site's Infusionsoft connection by first triggering the OAuth flow to obtain the temporary password, then using that password to set arbitrary OAuth tokens and app domain via update_option(), effectively redirecting the plugin's API communication to an attacker-controlled server.

  Product

  FormLift for Infusionsoft Web Forms

  Affected

  up to 7.5.21

  What to do

  Affects up to 7.5.21. Update FormLift for Infusionsoft Web Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 25, 2026Taboola Pixel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32545 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Taboola Taboola Pixel taboola-pixel allows Reflected XSS.This issue affects Taboola Pixel: from n/a through <= 1.1.4.

  Product

  Taboola Pixel

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Taboola Pixel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026OOPSpam Anti-Spam: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32544 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OOPSpam Team OOPSpam Anti-Spam oopspam-anti-spam allows Stored XSS.This issue affects OOPSpam Anti-Spam: from n/a through <= 1.2.62.

  Product

  OOPSpam Anti-Spam

  Affected

  up to 1.2.62

  What to do

  Affects up to 1.2.62. Update OOPSpam Anti-Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Fusion Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32542 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows Reflected XSS.This issue affects Fusion Builder: from n/a through < 3.15.0.

  Product

  Fusion Builder

  What to do

  Update Fusion Builder to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Bookly: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32540 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bookly Bookly bookly-responsive-appointment-booking-tool allows Reflected XSS.This issue affects Bookly: from n/a through <= 26.7.

  Product

  Bookly

  Affected

  up to 26.7

  What to do

  Affects up to 26.7. Update Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Contact Form & Lead Form Elementor Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32532 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Stored XSS.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.

  Product

  Contact Form & Lead Form Elementor Builder

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Contact Form & Lead Form Elementor Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Molla: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32529 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in don-themes Molla molla allows Reflected XSS.This issue affects Molla: from n/a through < 1.5.19.

  Product

  Molla

  What to do

  Update Molla to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Riode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32528 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in don-themes Riode riode allows Reflected XSS.This issue affects Riode: from n/a through < 1.6.29.

  Product

  Riode

  What to do

  Update Riode to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Abandoned Cart Recovery for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32526 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Stored XSS.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <= 1.1.10.

  Product

  Abandoned Cart Recovery for WooCommerce

  Affected

  up to 1.1.10

  What to do

  Affects up to 1.1.10. Update Abandoned Cart Recovery for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026WP Custom Admin Interface: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32521 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows DOM-Based XSS.This issue affects WP Custom Admin Interface: from n/a through <= 7.42.

  Product

  WP Custom Admin Interface

  Affected

  up to 7.42

  What to do

  Affects up to 7.42. Update WP Custom Admin Interface to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Gaea: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32518 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes Gaea gaea allows Reflected XSS.This issue affects Gaea: from n/a through < 3.8.

  Product

  Gaea

  What to do

  Update Gaea to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Contact Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32517 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kleor Contact Manager contact-manager allows Reflected XSS.This issue affects Contact Manager: from n/a through <= 9.1.

  Product

  Contact Manager

  Affected

  up to 9.1

  What to do

  Affects up to 9.1. Update Contact Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Image Slider by Ays: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32494 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Image Slider by Ays ays-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Slider by Ays: from n/a through <= 2.7.1.

  Product

  Image Slider by Ays

  Affected

  up to 2.7.1

  What to do

  Affects up to 2.7.1. Update Image Slider by Ays to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026JobSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32493 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.This issue affects JobSearch: from n/a through <= 3.2.0.

  Product

  JobSearch

  Affected

  up to 3.2.0

  What to do

  Affects up to 3.2.0. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026WP Review Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32491 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgwhite33 WP Review Slider wp-facebook-reviews allows Stored XSS.This issue affects WP Review Slider: from n/a through <= 13.9.

  Product

  WP Review Slider

  Affected

  up to 13.9

  What to do

  Affects up to 13.9. Update WP Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026WP TripAdvisor Review Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32490 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgwhite33 WP TripAdvisor Review Slider wp-tripadvisor-review-slider allows Stored XSS.This issue affects WP TripAdvisor Review Slider: from n/a through <= 14.1.

  Product

  WP TripAdvisor Review Slider

  Affected

  up to 14.1

  What to do

  Affects up to 14.1. Update WP TripAdvisor Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026WP Courses LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-31914 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hookandhook WP Courses LMS wp-courses allows DOM-Based XSS.This issue affects WP Courses LMS: from n/a through <= 3.2.26.

  Product

  WP Courses LMS

  Affected

  up to 3.2.26

  What to do

  Affects up to 3.2.26. Update WP Courses LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Darna Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27088 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Darna Framework darna-framework allows Reflected XSS.This issue affects Darna Framework: from n/a through <= 2.9.

  Product

  Darna Framework

  Affected

  up to 2.9

  What to do

  Affects up to 2.9. Update Darna Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Wolverine Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27087 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Wolverine Framework wolverine-framework allows Reflected XSS.This issue affects Wolverine Framework: from n/a through <= 1.9.

  Product

  Wolverine Framework

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update Wolverine Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Penci Soledad Data Migrator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27054 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Soledad Data Migrator penci-data-migrator allows Reflected XSS.This issue affects Penci Soledad Data Migrator: from n/a through <= 1.3.1.

  Product

  Penci Soledad Data Migrator

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Penci Soledad Data Migrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026CP Multi View Event Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25465 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Multi View Event Calendar cp-multi-view-calendar allows Stored XSS.This issue affects CP Multi View Event Calendar : from n/a through <= 1.4.36.

  Product

  CP Multi View Event Calendar

  Affected

  up to 1.4.36

  What to do

  Affects up to 1.4.36. Update CP Multi View Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Listeo Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25461 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes Listeo Core listeo-core allows Reflected XSS.This issue affects Listeo Core: from n/a through <= 2.0.21.

  Product

  Listeo Core

  Affected

  up to 2.0.21

  What to do

  Affects up to 2.0.21. Update Listeo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Remoji: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25452 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDO Remoji remoji allows Stored XSS.This issue affects Remoji: from n/a through <= 2.2.

  Product

  Remoji

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Remoji to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Booking calendar, Appointment Booking System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25435 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Stored XSS.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.36.

  Product

  Booking calendar, Appointment Booking System

  Affected

  up to 3.2.36

  What to do

  Affects up to 3.2.36. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026ProfileGrid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25417 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Stored XSS.This issue affects ProfileGrid : from n/a through <= 5.9.8.1.

  Product

  ProfileGrid

  Affected

  up to 5.9.8.1

  What to do

  Affects up to 5.9.8.1. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026KiviCare: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25383 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Reflected XSS.This issue affects KiviCare: from n/a through <= 3.6.16.

  Product

  KiviCare

  Affected

  up to 3.6.16

  What to do

  Affects up to 3.6.16. Update KiviCare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Addon Jobsearch Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25376 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix Addon Jobsearch Chat addon-jobsearch-chat allows Reflected XSS.This issue affects Addon Jobsearch Chat: from n/a through <= 3.0.

  Product

  Addon Jobsearch Chat

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update Addon Jobsearch Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Vayvo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25373 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProgressionStudios Vayvo vayvo-progression allows Reflected XSS.This issue affects Vayvo: from n/a through < 6.8.

  Product

  Vayvo

  What to do

  Update Vayvo to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026WpEvently: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25361 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam WpEvently mage-eventpress allows Reflected XSS.This issue affects WpEvently: from n/a through <= 5.1.4.

  Product

  WpEvently

  Affected

  up to 5.1.4

  What to do

  Affects up to 5.1.4. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Yobazar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25356 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Yobazar yobazar allows Reflected XSS.This issue affects Yobazar: from n/a through < 1.6.7.

  Product

  Yobazar

  What to do

  Update Yobazar to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Sanzo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25355 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Sanzo sanzo allows Stored XSS.This issue affects Sanzo: from n/a through < 2.4.3.

  Product

  Sanzo

  What to do

  Update Sanzo to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Reebox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25354 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Reebox reebox allows Reflected XSS.This issue affects Reebox: from n/a through < 1.4.8.

  Product

  Reebox

  What to do

  Update Reebox to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Nooni: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25353 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Nooni nooni allows Reflected XSS.This issue affects Nooni: from n/a through < 1.5.1.

  Product

  Nooni

  What to do

  Update Nooni to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026MyDecor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25352 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup MyDecor mydecor allows Reflected XSS.This issue affects MyDecor: from n/a through < 1.5.9.

  Product

  MyDecor

  What to do

  Update MyDecor to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026MyMedi: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25351 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup MyMedi mymedi allows Reflected XSS.This issue affects MyMedi: from n/a through < 1.7.7.

  Product

  MyMedi

  What to do

  Update MyMedi to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Miti: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25350 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Miti miti allows Reflected XSS.This issue affects Miti: from n/a through < 1.5.3.

  Product

  Miti

  What to do

  Update Miti to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Loobek: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25349 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Loobek loobek allows Reflected XSS.This issue affects Loobek: from n/a through < 1.5.2.

  Product

  Loobek

  What to do

  Update Loobek to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026WP REST Cache: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25347 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Acato WP REST Cache wp-rest-cache allows Stored XSS.This issue affects WP REST Cache: from n/a through <= 2026.1.0.

  Product

  WP REST Cache

  Affected

  up to 2026.1.0

  What to do

  Affects up to 2026.1.0. Update WP REST Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026FAQ Builder AYS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25346 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro FAQ Builder AYS faq-builder-ays allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FAQ Builder AYS: from n/a through <= 1.8.2.

  Product

  FAQ Builder AYS

  Affected

  up to 1.8.2

  What to do

  Affects up to 1.8.2. Update FAQ Builder AYS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Boutique: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25342 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kutethemes Boutique kute-boutique allows Reflected XSS.This issue affects Boutique: from n/a through < 2.4.6.

  Product

  Boutique

  What to do

  Update Boutique to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026RSFirewall!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25341 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RSJoomla! RSFirewall! rsfirewall allows Stored XSS.This issue affects RSFirewall!: from n/a through <= 1.1.45.

  Product

  RSFirewall!

  Affected

  up to 1.1.45

  What to do

  Affects up to 1.1.45. Update RSFirewall! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026XStore Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25306 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through <= 5.6.4.

  Product

  XStore Core

  Affected

  up to 5.6.4

  What to do

  Affects up to 5.6.4. Update XStore Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Jaroti: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25304 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Jaroti jaroti allows Reflected XSS.This issue affects Jaroti: from n/a through < 1.4.8.

  Product

  Jaroti

  What to do

  Update Jaroti to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Motta Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25033 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uixthemes Motta Addons motta-addons allows Reflected XSS.This issue affects Motta Addons: from n/a through < 1.6.1.

  Product

  Motta Addons

  What to do

  Update Motta Addons to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026VikRestaurants: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25025 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Reflected XSS.This issue affects VikRestaurants: from n/a through <= 1.5.2.

  Product

  VikRestaurants

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update VikRestaurants to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026NaturaLife Extensions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25018 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan NaturaLife Extensions naturalife-extensions allows Reflected XSS.This issue affects NaturaLife Extensions: from n/a through <= 2.1.

  Product

  NaturaLife Extensions

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update NaturaLife Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Phox Hosting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25013 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WHMCSdes Phox Hosting phox-host allows Reflected XSS.This issue affects Phox Hosting: from n/a through <= 2.0.8.

  Product

  Phox Hosting

  Affected

  up to 2.0.8

  What to do

  Affects up to 2.0.8. Update Phox Hosting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026UpSolution Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24983 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.This issue affects UpSolution Core: from n/a through <= 8.41.

  Product

  UpSolution Core

  Affected

  up to 8.41

  What to do

  Affects up to 8.41. Update UpSolution Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2026Visionary Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24980 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Visionary Core noo-visionary-core allows Reflected XSS.This issue affects Visionary Core: from n/a through <= 1.4.9.

  Product

  Visionary Core

  Affected

  up to 1.4.9

  What to do

  Affects up to 1.4.9. Update Visionary Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.