Vulnerability database

24,525 results · page 261 of 491

• Apr 3, 2025Social Share And Social Locker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31911 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems Social Share And Social Locker social-share-and-social-locker-arsocial allows Blind SQL Injection.This issue affects Social Share And Social Locker: from n/a through <= 1.4.2.

  Product

  Social Share And Social Locker

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update Social Share And Social Locker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Apptivo Business Site CRM: Missing AuthorizationCVE-2025-31909 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in Apptivo Apptivo Business Site CRM apptivo-business-site allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apptivo Business Site CRM: from n/a through <= 5.3.

  Product

  Apptivo Business Site CRM

  Affected

  up to 5.3

  What to do

  Affects up to 5.3. Update Apptivo Business Site CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Team Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31907 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labib Ahmed Team Builder team-display allows Reflected XSS.This issue affects Team Builder: from n/a through <= 1.3.

  Product

  Team Builder

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Team Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Team Rosters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31905 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark O'Donnell Team Rosters team-rosters allows Reflected XSS.This issue affects Team Rosters: from n/a through <= 4.7.

  Product

  Team Rosters

  Affected

  up to 4.7

  What to do

  Affects up to 4.7. Update Team Rosters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025XV Random Quotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31903 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xavi Ivars XV Random Quotes xv-random-quotes allows Reflected XSS.This issue affects XV Random Quotes: from n/a through <= 2.0.0.

  Product

  XV Random Quotes

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update XV Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Social Share And Social Locker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31902 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems Social Share And Social Locker social-share-and-social-locker-arsocial allows Reflected XSS.This issue affects Social Share And Social Locker: from n/a through <= 1.4.1.

  Product

  Social Share And Social Locker

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Social Share And Social Locker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Digihood HTML Sitemap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31901 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digihood Digihood HTML Sitemap wedesin-html-sitemap allows Reflected XSS.This issue affects Digihood HTML Sitemap: from n/a through <= 3.1.1.

  Product

  Digihood HTML Sitemap

  Affected

  up to 3.1.1

  What to do

  Affects up to 3.1.1. Update Digihood HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Lexicata: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31900 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lexicata Lexicata lexicata allows Reflected XSS.This issue affects Lexicata: from n/a through <= 1.0.16.

  Product

  Lexicata

  Affected

  up to 1.0.16

  What to do

  Affects up to 1.0.16. Update Lexicata to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Awesome Logos: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31899 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpshopee Awesome Logos awesome-logos allows Reflected XSS.This issue affects Awesome Logos: from n/a through <= 1.2.

  Product

  Awesome Logos

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Awesome Logos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025MediaView: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31898 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dustinscarberry MediaView mediaview allows Reflected XSS.This issue affects MediaView: from n/a through <= 1.1.2.

  Product

  MediaView

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update MediaView to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025GetBookingsWP: Missing AuthorizationCVE-2025-31896 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in istmoplugins GetBookingsWP get-bookings-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetBookingsWP: from n/a through <= 1.1.27.

  Product

  GetBookingsWP

  Affected

  up to 1.1.27

  What to do

  Affects up to 1.1.27. Update GetBookingsWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Botnet Attack Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31893 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cheesefather Botnet Attack Blocker botnet-attack-blocker allows Stored XSS.This issue affects Botnet Attack Blocker: from n/a through <= 2.0.0.

  Product

  Botnet Attack Blocker

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Botnet Attack Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Payday: Missing AuthorizationCVE-2025-31876 · WordPress plugins & themes · reported by PatchstackMedium 5.8

  Missing Authorization vulnerability in gunnarpayday Payday payday allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payday: from n/a through <= 3.3.18.

  Product

  Payday

  Affected

  up to 3.3.18

  What to do

  Affects up to 3.3.18. Update Payday to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Local Magic: Missing AuthorizationCVE-2025-31858 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in matthewrubin Local Magic local-magic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Local Magic: from n/a through <= 2.9.0.

  Product

  Local Magic

  Affected

  up to 2.9.0

  What to do

  Affects up to 2.9.0. Update Local Magic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025FPW Category Thumbnails: Missing AuthorizationCVE-2025-31841 · WordPress plugins & themes · reported by PatchstackMedium 6.3

  Missing Authorization vulnerability in Frank P. Walentynowicz FPW Category Thumbnails fpw-category-thumbnails allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FPW Category Thumbnails: from n/a through <= 1.9.5.

  Product

  FPW Category Thumbnails

  Affected

  up to 1.9.5

  What to do

  Affects up to 1.9.5. Update FPW Category Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Fonto: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31827 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vlad.olaru Fonto fonto allows Path Traversal.This issue affects Fonto: from n/a through <= 1.2.2.

  Product

  Fonto

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Fonto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Category Icon: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31825 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pixelgrade Category Icon category-icon allows Path Traversal.This issue affects Category Icon: from n/a through <= 1.0.1.

  Product

  Category Icon

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Category Icon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Publitio: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31800 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in publitio Publitio publitio allows Path Traversal.This issue affects Publitio: from n/a through <= 2.2.0.

  Product

  Publitio

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update Publitio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Shopify to WooCommerce Migration: Missing AuthorizationCVE-2025-31795 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Plugin Devs Shopify to WooCommerce Migration migrate-shopify-to-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shopify to WooCommerce Migration: from n/a through <= 1.3.0.

  Product

  Shopify to WooCommerce Migration

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Shopify to WooCommerce Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025WR Price List Manager For Woocommerce: Missing AuthorizationCVE-2025-31794 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Web Ready Now WR Price List Manager For Woocommerce wr-price-list-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WR Price List Manager For Woocommerce: from n/a through <= 1.0.8.

  Product

  WR Price List Manager For Woocommerce

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update WR Price List Manager For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025TextMe SMS: Missing AuthorizationCVE-2025-31789 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Matat Technologies TextMe SMS textme-sms-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TextMe SMS: from n/a through <= 1.9.1.

  Product

  TextMe SMS

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update TextMe SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Widget Manager Light: Missing AuthorizationCVE-2025-31768 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in OTWthemes Widget Manager Light widget-manager-light allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Widget Manager Light: from n/a through <= 1.18.

  Product

  Widget Manager Light

  Affected

  up to 1.18

  What to do

  Affects up to 1.18. Update Widget Manager Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Free Woocommerce Product Table View: Missing AuthorizationCVE-2025-31758 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in BinaryCarpenter Free Woocommerce Product Table View free-product-table-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Free Woocommerce Product Table View: from n/a through <= 1.78.

  Product

  Free Woocommerce Product Table View

  Affected

  up to 1.78

  What to do

  Affects up to 1.78. Update Free Woocommerce Product Table View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Clients: Missing AuthorizationCVE-2025-31746 · WordPress plugins & themes · reported by PatchstackMedium 6.4

  Missing Authorization vulnerability in Think201 Clients clients allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clients: from n/a through <= 1.1.4.

  Product

  Clients

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Minimalistic Event Manager: Missing AuthorizationCVE-2025-31739 · WordPress plugins & themes · reported by PatchstackMedium 6.4

  Missing Authorization vulnerability in Manuel Schmalstieg Minimalistic Event Manager minimalistic-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Minimalistic Event Manager: from n/a through <= 1.1.1.

  Product

  Minimalistic Event Manager

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Minimalistic Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Rich Text Editor: Missing AuthorizationCVE-2025-31736 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in richtexteditor Rich Text Editor richtexteditor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rich Text Editor: from n/a through <= 1.0.1.

  Product

  Rich Text Editor

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Rich Text Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025WooTumblog: Missing AuthorizationCVE-2025-31729 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in jeffikus WooTumblog woo-tumblog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooTumblog: from n/a through <= 2.1.4.

  Product

  WooTumblog

  Affected

  up to 2.1.4

  What to do

  Affects up to 2.1.4. Update WooTumblog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Support Helpdesk Ticket System Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31626 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alisaleem252 Support Helpdesk Ticket System Lite ticket-help-desk-system-lite allows Reflected XSS.This issue affects Support Helpdesk Ticket System Lite: from n/a through 4.5.2.

  Product

  Support Helpdesk Ticket System Lite

  Affected

  up to 4.5.2

  What to do

  Affects up to 4.5.2. Update Support Helpdesk Ticket System Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Advanced Typekit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31622 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Utkarsh Kukreti Advanced Typekit advanced-typekit allows Stored XSS.This issue affects Advanced Typekit: from n/a through <= 1.0.1.

  Product

  Advanced Typekit

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Advanced Typekit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Contact Form vCard Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31582 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani Contact Form vCard Generator contact-form-vcard-generator allows Stored XSS.This issue affects Contact Form vCard Generator: from n/a through <= 2.4.

  Product

  Contact Form vCard Generator

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update Contact Form vCard Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025WP Video Playlist: Missing AuthorizationCVE-2025-31581 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Sandeep Kumar WP Video Playlist wp-video-playlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Video Playlist: from n/a through <= 1.1.2.

  Product

  WP Video Playlist

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update WP Video Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025PeproDev CF7 Database: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31573 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev CF7 Database pepro-cf7-database allows Stored XSS.This issue affects PeproDev CF7 Database: from n/a through <= 2.0.0.

  Product

  PeproDev CF7 Database

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update PeproDev CF7 Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025TailPress: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2025-31558 · WordPress plugins & themes · reported by PatchstackMedium 5.8

  Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Greg TailPress tailpress allows Retrieve Embedded Sensitive Data.This issue affects TailPress: from n/a through <= 0.4.4.

  Product

  TailPress

  Affected

  up to 0.4.4

  What to do

  Affects up to 0.4.4. Update TailPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Docxpresso: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31554 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in docxpresso Docxpresso docxpresso allows Absolute Path Traversal.This issue affects Docxpresso: from n/a through <= 2.6.

  Product

  Docxpresso

  Affected

  up to 2.6

  What to do

  Affects up to 2.6. Update Docxpresso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025TuriTop Booking System: Missing AuthorizationCVE-2025-31541 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in TuriTop TuriTop Booking System turitop-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TuriTop Booking System: from n/a through <= 1.0.10.

  Product

  TuriTop Booking System

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update TuriTop Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025CF7 Spreadsheets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31536 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Reflected XSS.This issue affects CF7 Spreadsheets: from n/a through <= 2.3.2.

  Product

  CF7 Spreadsheets

  Affected

  up to 2.3.2

  What to do

  Affects up to 2.3.2. Update CF7 Spreadsheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025WP_Identicon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31468 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scottsm WP_Identicon wp-identicon allows Reflected XSS.This issue affects WP_Identicon: from n/a through <= 2.0.

  Product

  WP_Identicon

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update WP_Identicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Flickr Photostream: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31467 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in miro.mannino Flickr Photostream flickr-photostream allows Reflected XSS.This issue affects Flickr Photostream: from n/a through <= 3.1.8.

  Product

  Flickr Photostream

  Affected

  up to 3.1.8

  What to do

  Affects up to 3.1.8. Update Flickr Photostream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Search engine keywords highlighter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31442 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e1tekoap42 Search engine keywords highlighter keywords-highlight-tool allows Reflected XSS.This issue affects Search engine keywords highlighter: from n/a through <= 0.1.3.

  Product

  Search engine keywords highlighter

  Affected

  up to 0.1.3

  What to do

  Affects up to 0.1.3. Update Search engine keywords highlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Blubrry PowerPress Podcasting plugin MultiSite add-on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31436 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Angelo Mandato Blubrry PowerPress Podcasting plugin MultiSite add-on powerpress-multisite allows Reflected XSS.This issue affects Blubrry PowerPress Podcasting plugin MultiSite add-on: from n/a through <= 0.1.1.

  Product

  Blubrry PowerPress Podcasting plugin MultiSite add-on

  Affected

  up to 0.1.1

  What to do

  Affects up to 0.1.1. Update Blubrry PowerPress Podcasting plugin MultiSite add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025DeBounce Email Validator: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31098 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in debounce DeBounce Email Validator debounce-io-email-validator allows PHP Local File Inclusion. This issue affects DeBounce Email Validator: from n/a through <= 5.7.

  Product

  DeBounce Email Validator

  Affected

  up to 5.7

  What to do

  Affects up to 5.7. Update DeBounce Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025CM Header and Footer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31091 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Header and Footer cm-header-footer-script-loader allows Stored XSS.This issue affects CM Header and Footer: from n/a through <= 1.2.4.

  Product

  CM Header and Footer

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update CM Header and Footer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Residential Address Detection: Missing AuthorizationCVE-2025-30916 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Residential Address Detection: from n/a through <= 2.5.4.

  Product

  Residential Address Detection

  Affected

  up to 2.5.4

  What to do

  Affects up to 2.5.4. Update Residential Address Detection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Small Package Quotes – Worldwide Express Edition: Missing AuthorizationCVE-2025-30915 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through <= 5.2.19.

  Product

  Small Package Quotes – Worldwide Express Edition

  Affected

  up to 5.2.19

  What to do

  Affects up to 5.2.19. Update Small Package Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Testimonial Slider: Deserialization of Untrusted DataCVE-2025-30889 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Deserialization of Untrusted Data vulnerability in PickPlugins Testimonial Slider testimonial allows Object Injection.This issue affects Testimonial Slider: from n/a through <= 2.0.13.

  Product

  Testimonial Slider

  Affected

  up to 2.0.13

  What to do

  Affects up to 2.0.13. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Snow Storm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30858 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Snow Storm snow-storm allows Reflected XSS.This issue affects Snow Storm: from n/a through <= 1.4.6.

  Product

  Snow Storm

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update Snow Storm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Latest Custom Post Type Updates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30616 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Wood Latest Custom Post Type Updates latest-custom-post-type-updates allows Reflected XSS.This issue affects Latest Custom Post Type Updates: from n/a through <= 1.3.0.

  Product

  Latest Custom Post Type Updates

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Latest Custom Post Type Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Wptobe-signinup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30611 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wptobe Wptobe-signinup wptobe-signinup allows Reflected XSS.This issue affects Wptobe-signinup: from n/a through <= 1.1.2.

  Product

  Wptobe-signinup

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Wptobe-signinup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025include-file: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30596 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in tstafford include-file include-file allows Path Traversal.This issue affects include-file: from n/a through <= 1.

  Product

  include-file

  Affected

  up to 1

  What to do

  Affects up to 1. Update include-file to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 2, 2025Shopper Approved Reviews: Unauthorized modification of data that can lead to privilege escalationCVE-2025-3063 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The Shopper Approved Reviews plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_callback_update_sa_option() function in versions 2.0 to 2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

  Product

  Shopper Approved Reviews

  Affected

  2.0 to 2.1

  What to do

  Affects 2.0 to 2.1. Update Shopper Approved Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.