Vulnerability database

24,525 results · page 264 of 491

• Apr 1, 2025OpenAI Tools for WordPress & WooCommerce: Missing AuthorizationCVE-2025-31843 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Wilson OpenAI Tools for WordPress & WooCommerce openai-tools-for-wp-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OpenAI Tools for WordPress & WooCommerce: from n/a through <= 2.2.1.

  Product

  OpenAI Tools for WordPress & WooCommerce

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update OpenAI Tools for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Viral Loops WP Integration: Insertion of Sensitive Information Into Sent DataCVE-2025-31842 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Insertion of Sensitive Information Into Sent Data vulnerability in viralloops Viral Loops WP Integration viral-loops-wp-integration allows Retrieve Embedded Sensitive Data.This issue affects Viral Loops WP Integration: from n/a through <= 3.4.0.

  Product

  Viral Loops WP Integration

  Affected

  up to 3.4.0

  What to do

  Affects up to 3.4.0. Update Viral Loops WP Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Eventbee RSVP Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31838 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eventbee Eventbee RSVP Widget eventbee-rsvp-widget allows DOM-Based XSS.This issue affects Eventbee RSVP Widget: from n/a through <= 1.0.

  Product

  Eventbee RSVP Widget

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Eventbee RSVP Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Proposals: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31837 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Codeus WP Proposals allows Stored XSS. This issue affects WP Proposals: from n/a through 2.3.

  Product

  WP Proposals

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update WP Proposals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Review Manager: Missing AuthorizationCVE-2025-31836 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in matthewrubin Review Manager review-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Review Manager: from n/a through <= 2.5.0.

  Product

  Review Manager

  Affected

  up to 2.5.0

  What to do

  Affects up to 2.5.0. Update Review Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Plugin Info Card: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31835 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brice Capobianco WP Plugin Info Card wp-plugin-info-card allows DOM-Based XSS.This issue affects WP Plugin Info Card: from n/a through <= 5.3.0.

  Product

  WP Plugin Info Card

  Affected

  up to 5.3.0

  What to do

  Affects up to 5.3.0. Update WP Plugin Info Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025JobBoard Job listing: Missing AuthorizationCVE-2025-31834 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in themeglow JobBoard Job listing job-board-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobBoard Job listing: from n/a through <= 1.2.8.

  Product

  JobBoard Job listing

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update JobBoard Job listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025JobBoard Job listing: Authorization Bypass Through User-Controlled KeyCVE-2025-31833 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Authorization Bypass Through User-Controlled Key vulnerability in themeglow JobBoard Job listing job-board-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobBoard Job listing: from n/a through <= 1.2.8.

  Product

  JobBoard Job listing

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update JobBoard Job listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025ACF City Selector: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-31832 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beee ACF City Selector acf-city-selector allows Retrieve Embedded Sensitive Data.This issue affects ACF City Selector: from n/a through <= 1.17.0.

  Product

  ACF City Selector

  Affected

  up to 1.17.0

  What to do

  Affects up to 1.17.0. Update ACF City Selector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025AtomChat: Missing AuthorizationCVE-2025-31831 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Team AtomChat AtomChat atomchat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AtomChat: from n/a through <= 1.1.7.

  Product

  AtomChat

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update AtomChat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Printus: Missing AuthorizationCVE-2025-31830 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Uriahs Victor Printus printus-cloud-printing-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Printus: from n/a through <= 1.2.6.

  Product

  Printus

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update Printus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025ShopCred: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31829 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devscred ShopCred shopcred allows DOM-Based XSS.This issue affects ShopCred: from n/a through <= 1.3.0.

  Product

  ShopCred

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update ShopCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Ni WooCommerce Cost Of Goods: Missing AuthorizationCVE-2025-31826 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods ni-woocommerce-cost-of-goods allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ni WooCommerce Cost Of Goods: from n/a through <= 3.2.8.

  Product

  Ni WooCommerce Cost Of Goods

  Affected

  up to 3.2.8

  What to do

  Affects up to 3.2.8. Update Ni WooCommerce Cost Of Goods to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WPoperation Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31823 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpoperations WPoperation Elementor Addons wpop-elementor-addons allows Stored XSS.This issue affects WPoperation Elementor Addons: from n/a through <= 1.1.9.

  Product

  WPoperation Elementor Addons

  Affected

  up to 1.1.9

  What to do

  Affects up to 1.1.9. Update WPoperation Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Simple HTML Sitemap: Missing AuthorizationCVE-2025-31822 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Simple HTML Sitemap: from n/a through <= 3.5.

  Product

  WP Simple HTML Sitemap

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update WP Simple HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Integration of Zoho CRM and Contact Form 7: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-31821 · WordPress plugins & themes · reported by PatchstackMedium 4.7

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integration of Zoho CRM and Contact Form 7 allows Phishing. This issue affects Integration of Zoho CRM and Contact Form 7: from n/a through 1.0.6.

  Product

  Integration of Zoho CRM and Contact Form 7

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Integration of Zoho CRM and Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Automatic Featured Images from Videos: Missing AuthorizationCVE-2025-31820 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic Featured Images from Videos: from n/a through <= 1.2.4.

  Product

  Automatic Featured Images from Videos

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update Automatic Featured Images from Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025ContentBot AI Writer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31818 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ContentBot.ai ContentBot AI Writer content-bot allows Stored XSS.This issue affects ContentBot AI Writer: from n/a through <= 1.2.4.

  Product

  ContentBot AI Writer

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update ContentBot AI Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025BlockWheels: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31817 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPWheels BlockWheels blockwheels allows DOM-Based XSS.This issue affects BlockWheels: from n/a through <= 1.0.2.

  Product

  BlockWheels

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update BlockWheels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Mobile App Canvas: Missing AuthorizationCVE-2025-31816 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in pietro Mobile App Canvas mobile-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile App Canvas: from n/a through <= 3.8.2.

  Product

  Mobile App Canvas

  Affected

  up to 3.8.2

  What to do

  Affects up to 3.8.2. Update Mobile App Canvas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Design Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31815 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devscred Design Blocks exclusive-blocks allows Stored XSS.This issue affects Design Blocks: from n/a through <= 1.2.5.

  Product

  Design Blocks

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Design Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WPSHARE247 Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31813 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Website366.com WPSHARE247 Elementor Addons wpshare247-elementor-addons allows Stored XSS.This issue affects WPSHARE247 Elementor Addons: from n/a through <= 2.5.

  Product

  WPSHARE247 Elementor Addons

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update WPSHARE247 Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025BuddyPress Members Only: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31812 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomas BuddyPress Members Only buddypress-members-only allows Stored XSS.This issue affects BuddyPress Members Only: from n/a through <= 3.5.3.

  Product

  BuddyPress Members Only

  Affected

  up to 3.5.3

  What to do

  Affects up to 3.5.3. Update BuddyPress Members Only to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Planyo online reservation system: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31811 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtreeme Planyo online reservation system planyo-online-reservation-system allows Stored XSS.This issue affects Planyo online reservation system: from n/a through <= 3.1.

  Product

  Planyo online reservation system

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update Planyo online reservation system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Question Answer: Missing AuthorizationCVE-2025-31810 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in PickPlugins Question Answer question-answer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Question Answer: from n/a through <= 1.2.73.

  Product

  Question Answer

  Affected

  up to 1.2.73

  What to do

  Affects up to 1.2.73. Update Question Answer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Webling: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31806 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uSystems Webling webling allows Stored XSS.This issue affects Webling: from n/a through <= 3.9.0.

  Product

  Webling

  Affected

  up to 3.9.0

  What to do

  Affects up to 3.9.0. Update Webling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Gutena Kit – Gutenberg Blocks and Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31805 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal Gutena Kit – Gutenberg Blocks and Templates gutena-kit allows Stored XSS.This issue affects Gutena Kit – Gutenberg Blocks and Templates: from n/a through <= 2.0.7.

  Product

  Gutena Kit – Gutenberg Blocks and Templates

  Affected

  up to 2.0.7

  What to do

  Affects up to 2.0.7. Update Gutena Kit – Gutenberg Blocks and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Follow Us Badges: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31804 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DraftPress Team Follow Us Badges wpsite-follow-us-badges allows Stored XSS.This issue affects Follow Us Badges: from n/a through <= 3.1.11.

  Product

  Follow Us Badges

  Affected

  up to 3.1.11

  What to do

  Affects up to 3.1.11. Update Follow Us Badges to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Turisbook Booking System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31803 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Neteuro Turisbook Booking System turisbook-booking-system allows Stored XSS.This issue affects Turisbook Booking System: from n/a through <= 1.3.8.

  Product

  Turisbook Booking System

  Affected

  up to 1.3.8

  What to do

  Affects up to 1.3.8. Update Turisbook Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Shiptimize for WooCommerce: Missing AuthorizationCVE-2025-31802 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Shiptimize Shiptimize for WooCommerce shiptimize-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shiptimize for WooCommerce: from n/a through <= 3.1.86.

  Product

  Shiptimize for WooCommerce

  Affected

  up to 3.1.86

  What to do

  Affects up to 3.1.86. Update Shiptimize for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025MX Time Zone Clocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31801 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maksym Marko MX Time Zone Clocks mx-time-zone-clocks allows Reflected XSS.This issue affects MX Time Zone Clocks: from n/a through <= 5.1.1.

  Product

  MX Time Zone Clocks

  Affected

  up to 5.1.1

  What to do

  Affects up to 5.1.1. Update MX Time Zone Clocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Publitio: Missing AuthorizationCVE-2025-31799 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in publitio Publitio publitio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Publitio: from n/a through <= 2.1.8.

  Product

  Publitio

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update Publitio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Publitio: Missing AuthorizationCVE-2025-31798 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in publitio Publitio publitio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Publitio: from n/a through <= 2.1.8.

  Product

  Publitio

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update Publitio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Sprout Clients: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31797 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Stored XSS.This issue affects Sprout Clients: from n/a through <= 3.2.

  Product

  Sprout Clients

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update Sprout Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Piotnet Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31793 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Forms piotnetforms allows Stored XSS.This issue affects Piotnet Forms: from n/a through <= 1.0.30.

  Product

  Piotnet Forms

  Affected

  up to 1.0.30

  What to do

  Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Piotnet Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31792 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Forms piotnetforms allows Stored XSS.This issue affects Piotnet Forms: from n/a through <= 1.0.30.

  Product

  Piotnet Forms

  Affected

  up to 1.0.30

  What to do

  Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Pin Generator: Missing AuthorizationCVE-2025-31791 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Oliver Boyers Pin Generator pin-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pin Generator: from n/a through <= 2.0.0.

  Product

  Pin Generator

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Pin Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Posten: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31790 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Binsaifullah Posten posten-post-blocks allows DOM-Based XSS.This issue affects Posten: from n/a through <= 0.0.1.

  Product

  Posten

  Affected

  up to 0.0.1

  What to do

  Affects up to 0.0.1. Update Posten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025AIO Performance Profiler, Monitor, Optimize, Compress & Debug: Insertion of Sensitive Information into Log FileCVE-2025-31788 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Insertion of Sensitive Information into Log File vulnerability in Smackcoders Inc., AIO Performance Profiler, Monitor, Optimize, Compress & Debug all-in-one-performance-accelerator allows Retrieve Embedded Sensitive Data.This issue affects AIO Performance Profiler, Monitor, Optimize, Compress & Debug: from n/a through <= 1.3.

  Product

  AIO Performance Profiler, Monitor, Optimize, Compress & Debug

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update AIO Performance Profiler, Monitor, Optimize, Compress & Debug to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Cue: Missing AuthorizationCVE-2025-31787 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in AudioTheme Cue cue allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cue: from n/a through <= 2.4.4.

  Product

  Cue

  Affected

  up to 2.4.4

  What to do

  Affects up to 2.4.4. Update Cue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Simple Icons: Missing AuthorizationCVE-2025-31786 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Travis Simple Icons simple-icons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Icons: from n/a through <= 2.8.4.

  Product

  Simple Icons

  Affected

  up to 2.8.4

  What to do

  Affects up to 2.8.4. Update Simple Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Leartes TRY Exchange Rates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31783 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leartes.NET Leartes TRY Exchange Rates leartes-try-exchange-rates allows Stored XSS.This issue affects Leartes TRY Exchange Rates: from n/a through <= 2.1.

  Product

  Leartes TRY Exchange Rates

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Leartes TRY Exchange Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025mb.YTPlayer: Missing AuthorizationCVE-2025-31782 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in pupunzi mb.YTPlayer wpmbytplayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects mb.YTPlayer: from n/a through <= 3.3.8.

  Product

  mb.YTPlayer

  Affected

  up to 3.3.8

  What to do

  Affects up to 3.3.8. Update mb.YTPlayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Gift Cards for WooCommerce: Missing AuthorizationCVE-2025-31781 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in ahmadshyk Gift Cards for WooCommerce woo-giftcards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gift Cards for WooCommerce: from n/a through <= 1.5.8.

  Product

  Gift Cards for WooCommerce

  Affected

  up to 1.5.8

  What to do

  Affects up to 1.5.8. Update Gift Cards for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Append Content: Missing AuthorizationCVE-2025-31780 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Andy Stratton Append Content append-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Append Content: from n/a through <= 2.1.1.

  Product

  Append Content

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update Append Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Donate Me: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31778 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in raphaelheide Donate Me donate-me allows Reflected XSS.This issue affects Donate Me: from n/a through <= 1.2.5.

  Product

  Donate Me

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Donate Me to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Clockinator Lite: Missing AuthorizationCVE-2025-31777 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in BeastThemes Clockinator Lite clockify-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clockinator Lite: from n/a through <= 1.0.9.

  Product

  Clockinator Lite

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Clockinator Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Astra Security Suite: Missing AuthorizationCVE-2025-31774 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WebProtect.ai Astra Security Suite getastra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Astra Security Suite: from n/a through <= 0.2.

  Product

  Astra Security Suite

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update Astra Security Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Ship Per Product: Missing AuthorizationCVE-2025-31773 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in cedcommerce Ship Per Product ship-per-product allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ship Per Product: from n/a through <= 2.1.0.

  Product

  Ship Per Product

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Ship Per Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Modal Popup with Cookie Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31772 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify WP Modal Popup with Cookie Integration wp-modal-popup-with-cookie-integration allows Stored XSS.This issue affects WP Modal Popup with Cookie Integration: from n/a through <= 2.4.

  Product

  WP Modal Popup with Cookie Integration

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update WP Modal Popup with Cookie Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.