Vulnerability database

24,332 results · page 193 of 487

• Oct 22, 2025RockON DJ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53229 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kamleshyadav RockON DJ rockon allows Reflected XSS.This issue affects RockON DJ: from n/a through <= 3.3.

  Product

  RockON DJ

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update RockON DJ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025AppExperts: Insertion of Sensitive Information Into Sent DataCVE-2025-53218 · WordPress plugins & themes · reported by PatchstackMedium 5.8

  Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal AppExperts appexperts allows Retrieve Embedded Sensitive Data.This issue affects AppExperts: from n/a through <= 1.4.5.

  Product

  AppExperts

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update AppExperts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Hello Followers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52770 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in appscreo Hello Followers hellofollowers allows Reflected XSS.This issue affects Hello Followers: from n/a through <= 2.5.

  Product

  Hello Followers

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update Hello Followers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Nifty Backups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52763 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NickDuncan Nifty Backups nifty-backups allows Reflected XSS.This issue affects Nifty Backups: from n/a through <= 1.08.

  Product

  Nifty Backups

  Affected

  up to 1.08

  What to do

  Affects up to 1.08. Update Nifty Backups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025MultiSite Clone Duplicator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52760 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Globalis MultiSite Clone Duplicator multisite-clone-duplicator allows Reflected XSS.This issue affects MultiSite Clone Duplicator: from n/a through <= 1.5.3.

  Product

  MultiSite Clone Duplicator

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update MultiSite Clone Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025SUMO Memberships for WooCommerce: Missing AuthorizationCVE-2025-52757 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SUMO Memberships for WooCommerce: from n/a through < 7.8.0.

  Product

  SUMO Memberships for WooCommerce

  What to do

  Update SUMO Memberships for WooCommerce to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WP Last Modified Info: Improper Control of Generation of Code ('Code Injection')CVE-2025-52756 · WordPress plugins & themes · reported by PatchstackHigh 7.4

  Improper Control of Generation of Code ('Code Injection') vulnerability in Sayan Datta WP Last Modified Info wp-last-modified-info allows Remote Code Inclusion.This issue affects WP Last Modified Info: from n/a through <= 1.9.4.

  Product

  WP Last Modified Info

  Affected

  up to 1.9.4

  What to do

  Affects up to 1.9.4. Update WP Last Modified Info to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Child: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52755 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Taylor Child Themes child-themes allows Reflected XSS.This issue affects Child Themes: from n/a through <= 1.0.1.

  Product

  Child

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Child to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Sello ChannelConnector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52754 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in selloio Sello ChannelConnector sello-channelconnector allows Reflected XSS.This issue affects Sello ChannelConnector: from n/a through <= 1.6.3.

  Product

  Sello ChannelConnector

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update Sello ChannelConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Contact Form by Supsystic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52753 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Reflected XSS.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.36.

  Product

  Contact Form by Supsystic

  Affected

  up to 1.7.36

  What to do

  Affects up to 1.7.36. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025IDonatePro: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-52752 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeAtelier IDonatePro idonate-pro allows Retrieve Embedded Sensitive Data.This issue affects IDonatePro: from n/a through <= 2.1.9.

  Product

  IDonatePro

  Affected

  up to 2.1.9

  What to do

  Affects up to 2.1.9. Update IDonatePro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Slide Puzzle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52751 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in colome Slide Puzzle slide-puzzle allows Reflected XSS.This issue affects Slide Puzzle: from n/a through <= 1.0.0.

  Product

  Slide Puzzle

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Slide Puzzle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Emu2: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52750 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juergen Schulze Emu2 emu2-email-users-2 allows Reflected XSS.This issue affects Emu2: from n/a through <= 0.83b.

  Product

  Emu2

  Affected

  up to 0.83b

  What to do

  Affects up to 0.83b. Update Emu2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Uji Countdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52749 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Activity Track Uji Countdown uji-countdown allows Reflected XSS.This issue affects Uji Countdown: from n/a through <= 2.3.3.

  Product

  Uji Countdown

  Affected

  up to 2.3.3

  What to do

  Affects up to 2.3.3. Update Uji Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Directory Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52748 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Directory Pro directory-pro allows Reflected XSS.This issue affects Directory Pro: from n/a through <= 2.5.5.

  Product

  Directory Pro

  Affected

  up to 2.5.5

  What to do

  Affects up to 2.5.5. Update Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025oik-privacy-policy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52743 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bobbingwide oik-privacy-policy oik-privacy-policy allows Reflected XSS.This issue affects oik-privacy-policy: from n/a through <= 1.4.10.

  Product

  oik-privacy-policy

  Affected

  up to 1.4.10

  What to do

  Affects up to 1.4.10. Update oik-privacy-policy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Pets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52742 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Benic Pets pets allows Reflected XSS.This issue affects Pets: from n/a through <= 1.4.1.

  Product

  Pets

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Pets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Post Connector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52741 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barry Kooij Post Connector post-connector allows Reflected XSS.This issue affects Post Connector: from n/a through <= 1.0.11.

  Product

  Post Connector

  Affected

  up to 1.0.11

  What to do

  Affects up to 1.0.11. Update Post Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Boldermail: Deserialization of Untrusted DataCVE-2025-52740 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Deserialization of Untrusted Data vulnerability in Hernan Villanueva Boldermail boldermail allows Object Injection.This issue affects Boldermail: from n/a through <= 2.4.0.

  Product

  Boldermail

  Affected

  up to 2.4.0

  What to do

  Affects up to 2.4.0. Update Boldermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Wikipedia Preview: Missing AuthorizationCVE-2025-52738 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Wikimedia Foundation Wikipedia Preview wikipedia-preview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wikipedia Preview: from n/a through <= 1.15.0.

  Product

  Wikipedia Preview

  Affected

  up to 1.15.0

  What to do

  Affects up to 1.15.0. Update Wikipedia Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WP Store Locator: Deserialization of Untrusted DataCVE-2025-52737 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Deserialization of Untrusted Data vulnerability in Tijmen Smit WP Store Locator wp-store-locator allows Object Injection.This issue affects WP Store Locator: from n/a through <= 2.2.260.

  Product

  WP Store Locator

  Affected

  up to 2.2.260

  What to do

  Affects up to 2.2.260. Update WP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Finale Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52736 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daman Jeet Finale Lite finale-woocommerce-sales-countdown-timer-discount allows Reflected XSS.This issue affects Finale Lite: from n/a through <= 2.20.0.

  Product

  Finale Lite

  Affected

  up to 2.20.0

  What to do

  Affects up to 2.20.0. Update Finale Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025NextMove Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52735 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Reflected XSS.This issue affects NextMove Lite: from n/a through <= 2.24.0.

  Product

  NextMove Lite

  Affected

  up to 2.24.0

  What to do

  Affects up to 2.24.0. Update NextMove Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025CropRefine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52734 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 CropRefine croprefine allows Reflected XSS.This issue affects CropRefine: from n/a through <= 1.2.1.

  Product

  CropRefine

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update CropRefine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025LearnPress Export Import: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49992 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress Export Import learnpress-import-export allows Reflected XSS.This issue affects LearnPress Export Import: from n/a through <= 4.0.9.

  Product

  LearnPress Export Import

  Affected

  up to 4.0.9

  What to do

  Affects up to 4.0.9. Update LearnPress Export Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Simple Stripe Checkout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49963 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in growniche Simple Stripe Checkout simple-stripe-checkout allows Reflected XSS.This issue affects Simple Stripe Checkout: from n/a through <= 1.1.28.

  Product

  Simple Stripe Checkout

  Affected

  up to 1.1.28

  What to do

  Affects up to 1.1.28. Update Simple Stripe Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025bbPress Notify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49962 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in useStrict bbPress Notify bbpress-notify-nospam allows Reflected XSS.This issue affects bbPress Notify: from n/a through <= 2.19.5.

  Product

  bbPress Notify

  Affected

  up to 2.19.5

  What to do

  Affects up to 2.19.5. Update bbPress Notify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Breeze Checkout: Missing AuthorizationCVE-2025-49961 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Breeze Team Breeze Checkout breeze-checkout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze Checkout: from n/a through <= 1.4.0.

  Product

  Breeze Checkout

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Breeze Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025LeadBI Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49960 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leadbi LeadBI Plugin for WordPress leadbi allows Stored XSS.This issue affects LeadBI Plugin for WordPress: from n/a through <= 1.7.

  Product

  LeadBI Plugin for

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update LeadBI Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025bbPress Move Topics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49959 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pascal Casier bbPress Move Topics bbp-move-topics allows Reflected XSS.This issue affects bbPress Move Topics: from n/a through <= 1.1.6.

  Product

  bbPress Move Topics

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update bbPress Move Topics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Robokassa payment gateway for Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49958 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robokassa Robokassa payment gateway for Woocommerce robokassa allows Reflected XSS.This issue affects Robokassa payment gateway for Woocommerce: from n/a through <= 1.8.6.

  Product

  Robokassa payment gateway for Woocommerce

  Affected

  up to 1.8.6

  What to do

  Affects up to 1.8.6. Update Robokassa payment gateway for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Email Attachment by Order Status & Products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49957 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weboccult Technologies Pvt Ltd Email Attachment by Order Status & Products email-attachment-by-order-status-products allows Reflected XSS.This issue affects Email Attachment by Order Status & Products: from n/a through <= 1.0.1.

  Product

  Email Attachment by Order Status & Products

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Email Attachment by Order Status & Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Fade Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49956 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anandaraj Balu Fade Slider fade-slider allows Reflected XSS.This issue affects Fade Slider: from n/a through <= 2.5.

  Product

  Fade Slider

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update Fade Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WP Smart Flexslider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49955 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rajan Vijayan WP Smart Flexslider wp-smart-flexslider allows Reflected XSS.This issue affects WP Smart Flexslider: from n/a through <= 2.5.

  Product

  WP Smart Flexslider

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update WP Smart Flexslider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WP-Click-Tracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49954 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mithra62 WP-Click-Tracker wp-click-track allows Reflected XSS.This issue affects WP-Click-Tracker: from n/a through <= 0.7.3.

  Product

  WP-Click-Tracker

  Affected

  up to 0.7.3

  What to do

  Affects up to 0.7.3. Update WP-Click-Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025ShareBang, Ultimate Social Share Buttons for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49953 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeinity ShareBang, Ultimate Social Share Buttons for WordPress sharebang allows Reflected XSS.This issue affects ShareBang, Ultimate Social Share Buttons for WordPress: from n/a through <= 1.4.

  Product

  ShareBang, Ultimate Social Share Buttons for

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update ShareBang, Ultimate Social Share Buttons for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Houzez: Authorization Bypass Through User-Controlled KeyCVE-2025-49952 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.2.5.

  Product

  Houzez

  Affected

  up to 4.2.5

  What to do

  Affects up to 4.2.5. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025gAppointments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49951 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpcrunch gAppointments gAppointments allows Reflected XSS.This issue affects gAppointments: from n/a through <= 1.14.1.

  Product

  gAppointments

  Affected

  up to 1.14.1

  What to do

  Affects up to 1.14.1. Update gAppointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Official Integration for Billingo: Missing AuthorizationCVE-2025-49950 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Missing Authorization vulnerability in billingo Official Integration for Billingo billingo allows Privilege Escalation.This issue affects Official Integration for Billingo: from n/a through <= 4.3.0.

  Product

  Official Integration for Billingo

  Affected

  up to 4.3.0

  What to do

  Affects up to 4.3.0. Update Official Integration for Billingo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Templazee: Missing AuthorizationCVE-2025-49949 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in templazee Templazee templazee allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templazee: from n/a through <= 1.0.2.

  Product

  Templazee

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Templazee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WP Super Edit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49948 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad Awais WP Super Edit wp-super-edit allows Reflected XSS.This issue affects WP Super Edit: from n/a through <= 2.5.4.

  Product

  WP Super Edit

  Affected

  up to 2.5.4

  What to do

  Affects up to 2.5.4. Update WP Super Edit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WooCommerce Registration Fields Plugin - Custom Signup Fields: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49947 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendons WooCommerce Registration Fields Plugin - Custom Signup Fields extendons-registration-fields allows Reflected XSS.This issue affects WooCommerce Registration Fields Plugin - Custom Signup Fields: from n/a through <= 3.2.3.

  Product

  WooCommerce Registration Fields Plugin - Custom Signup Fields

  Affected

  up to 3.2.3

  What to do

  Affects up to 3.2.3. Update WooCommerce Registration Fields Plugin - Custom Signup Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Auto Login After Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49946 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cynob IT Consultancy Auto Login After Registration auto-login-after-registration allows Reflected XSS.This issue affects Auto Login After Registration: from n/a through <= 1.0.0.

  Product

  Auto Login After Registration

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Auto Login After Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Shortcode Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49945 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kylegetson Shortcode Generator shortcode-generator allows Reflected XSS.This issue affects Shortcode Generator: from n/a through <= 1.1.

  Product

  Shortcode Generator

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Shortcode Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WPCode Content Ratio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49944 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonatan Jumbert WPCode Content Ratio wpcode-content-ratio allows Reflected XSS.This issue affects WPCode Content Ratio: from n/a through <= 2.0.

  Product

  WPCode Content Ratio

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update WPCode Content Ratio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Fusion Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49940 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows DOM-Based XSS.This issue affects Fusion Builder: from n/a through <= 3.13.2.

  Product

  Fusion Builder

  Affected

  up to 3.13.2

  What to do

  Affects up to 3.13.2. Update Fusion Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49939 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.8.

  Product

  JetElements For Elementor

  Affected

  up to 2.7.8

  What to do

  Affects up to 2.7.8. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49938 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.3.

  Product

  JetEngine

  Affected

  up to 3.7.3

  What to do

  Affects up to 3.7.3. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Smash Balloon Social Post Feed: Missing AuthorizationCVE-2025-49937 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Syed Balkhi Smash Balloon Social Post Feed custom-facebook-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smash Balloon Social Post Feed: from n/a through <= 4.3.2.

  Product

  Smash Balloon Social Post Feed

  Affected

  up to 4.3.2

  What to do

  Affects up to 4.3.2. Update Smash Balloon Social Post Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WoodMart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49936 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart woodmart allows DOM-Based XSS.This issue affects WoodMart: from n/a through < 8.3.2.

  Product

  WoodMart

  What to do

  Update WoodMart to the newest version.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.