Vulnerability database

24,525 results · page 270 of 491

• Mar 27, 2025ARPrice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26731 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARPrice arprice allows Stored XSS.This issue affects ARPrice: from n/a through <= 4.1.3.

  Product

  ARPrice

  Affected

  up to 4.1.3

  What to do

  Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Power Mag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22816 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetrendy Power Mag power-mag allows DOM-Based XSS.This issue affects Power Mag: from n/a through <= 1.1.5.

  Product

  Power Mag

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update Power Mag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Envo Multipurpose: Missing AuthorizationCVE-2025-22770 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in EnvoThemes Envo Multipurpose allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envo Multipurpose: from n/a through 1.1.6.

  Product

  Envo Multipurpose

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Envo Multipurpose to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025EAN for WooCommerce: Missing AuthorizationCVE-2025-22673 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in WPFactory EAN for WooCommerce ean-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EAN for WooCommerce: from n/a through <= 5.3.5.

  Product

  EAN for WooCommerce

  Affected

  up to 5.3.5

  What to do

  Affects up to 5.3.5. Update EAN for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025The Pack Elementor addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30925 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through <= 2.1.1.

  Product

  The Pack Elementor addons

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Simplebooklet PDF Viewer and Embedder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30922 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in simplebooklet Simplebooklet PDF Viewer and Embedder simplebooklet allows Stored XSS.This issue affects Simplebooklet PDF Viewer and Embedder: from n/a through <= 1.1.1.

  Product

  Simplebooklet PDF Viewer and Embedder

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Simplebooklet PDF Viewer and Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Newsletters: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30921 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through <= 4.9.9.7.

  Product

  Newsletters

  Affected

  up to 4.9.9.7

  What to do

  Affects up to 4.9.9.7. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WP Posts Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30920 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Stored XSS.This issue affects WP Posts Carousel: from n/a through <= 1.3.7.

  Product

  WP Posts Carousel

  Affected

  up to 1.3.7

  What to do

  Affects up to 1.3.7. Update WP Posts Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Structured Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30918 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme Structured Content structured-content allows Stored XSS.This issue affects Structured Content: from n/a through <= 1.6.3.

  Product

  Structured Content

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update Structured Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Conversios.io: Missing AuthorizationCVE-2025-30909 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 7.2.3.

  Product

  Conversios.io

  Affected

  up to 7.2.3

  What to do

  Affects up to 7.2.3. Update Conversios.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025SecuPress Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30907 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SecuPress SecuPress Free secupress allows DOM-Based XSS.This issue affects SecuPress Free: from n/a through <= 2.2.5.3.

  Product

  SecuPress Free

  Affected

  up to 2.2.5.3

  What to do

  Affects up to 2.2.5.3. Update SecuPress Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Chartify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30904 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Chartify chart-builder allows Stored XSS.This issue affects Chartify: from n/a through <= 3.1.7.

  Product

  Chartify

  Affected

  up to 3.1.7

  What to do

  Affects up to 3.1.7. Update Chartify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025SyntaxHighlighter Evolved: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30903 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Mills SyntaxHighlighter Evolved syntaxhighlighter allows DOM-Based XSS.This issue affects SyntaxHighlighter Evolved: from n/a through <= 3.7.1.

  Product

  SyntaxHighlighter Evolved

  Affected

  up to 3.7.1

  What to do

  Affects up to 3.7.1. Update SyntaxHighlighter Evolved to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Zoho Billing – Embed Payment Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30900 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Subscriptions Zoho Billing – Embed Payment Form allows Stored XSS. This issue affects Zoho Billing – Embed Payment Form: from n/a through 4.0.

  Product

  Zoho Billing – Embed Payment Form

  Affected

  up to 4.0

  What to do

  Affects up to 4.0. Update Zoho Billing – Embed Payment Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025User Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30899 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through <= 4.0.3.

  Product

  User Registration

  Affected

  up to 4.0.3

  What to do

  Affects up to 4.0.3. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30898 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahdi Yousefi [MahdiY] افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) persian-woocommerce-shipping allows Stored XSS.This issue affects افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری): from n/a through <= 4.2.3.

  Product

  افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری)

  Affected

  up to 4.2.3

  What to do

  Affects up to 4.2.3. Update افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Analytify: Missing AuthorizationCVE-2025-30897 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Adnan Analytify wp-analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Analytify: from n/a through <= 5.5.1.

  Product

  Analytify

  Affected

  up to 5.5.1

  What to do

  Affects up to 5.5.1. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WP ERP: Missing AuthorizationCVE-2025-30896 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through <= 1.13.4.

  Product

  WP ERP

  Affected

  up to 1.13.4

  What to do

  Affects up to 1.13.4. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WpEvently: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30895 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in magepeopleteam WpEvently mage-eventpress allows PHP Local File Inclusion.This issue affects WpEvently: from n/a through <= 4.2.9.

  Product

  WpEvently

  Affected

  up to 4.2.9

  What to do

  Affects up to 4.2.9. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WP Fast Total Search: Missing AuthorizationCVE-2025-30894 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Fast Total Search: from n/a through <= 1.79.262.

  Product

  WP Fast Total Search

  Affected

  up to 1.79.262

  What to do

  Affects up to 1.79.262. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025LeadConnector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30893 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeadConnector LeadConnector leadconnector allows DOM-Based XSS.This issue affects LeadConnector: from n/a through <= 3.0.2.

  Product

  LeadConnector

  Affected

  up to 3.0.2

  What to do

  Affects up to 3.0.2. Update LeadConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WpTravelly: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30891 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through <= 1.8.7.

  Product

  WpTravelly

  Affected

  up to 1.8.7

  What to do

  Affects up to 1.8.7. Update WpTravelly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Login Widget for Ultimate Member: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30890 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SuitePlugins Login Widget for Ultimate Member login-widget-for-ultimate-member allows PHP Local File Inclusion.This issue affects Login Widget for Ultimate Member: from n/a through <= 1.1.2.

  Product

  Login Widget for Ultimate Member

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Login Widget for Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Custom Fields Account Registration For Woocommerce: Cross-Site Request Forgery (CSRF)CVE-2025-30888 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in silverplugins217 Custom Fields Account Registration For Woocommerce custom-fields-account-registration-for-woocommerce allows Cross Site Request Forgery.This issue affects Custom Fields Account Registration For Woocommerce: from n/a through <= 1.1.

  Product

  Custom Fields Account Registration For Woocommerce

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Custom Fields Account Registration For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WpEvently: Missing AuthorizationCVE-2025-30887 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 4.2.9.

  Product

  WpEvently

  Affected

  up to 4.2.9

  What to do

  Affects up to 4.2.9. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Bit Form: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30885 · WordPress plugins & themes · reported by PatchstackMedium 4.7

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bit Apps Bit Form bit-form allows Phishing.This issue affects Bit Form: from n/a through <= 2.18.0.

  Product

  Bit Form

  Affected

  up to 2.18.0

  What to do

  Affects up to 2.18.0. Update Bit Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Bit Integrations: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30884 · WordPress plugins & themes · reported by PatchstackMedium 4.7

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bit Apps Bit Integrations bit-integrations allows Phishing.This issue affects Bit Integrations: from n/a through <= 2.4.10.

  Product

  Bit Integrations

  Affected

  up to 2.4.10

  What to do

  Affects up to 2.4.10. Update Bit Integrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Trust.Reviews: Missing AuthorizationCVE-2025-30883 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in richplugins Trust.Reviews fb-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trust.Reviews: from n/a through <= 2.3.

  Product

  Trust.Reviews

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Trust.Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Big Store: Missing AuthorizationCVE-2025-30881 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in themehunk Big Store big-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Big Store: from n/a through <= 2.0.8.

  Product

  Big Store

  Affected

  up to 2.0.8

  What to do

  Affects up to 2.0.8. Update Big Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025MC Woocommerce Wishlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30879 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert allows SQL Injection.This issue affects MC Woocommerce Wishlist: from n/a through <= 1.8.9.

  Product

  MC Woocommerce Wishlist

  Affected

  up to 1.8.9

  What to do

  Affects up to 1.8.9. Update MC Woocommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Quiz Cat: Missing AuthorizationCVE-2025-30877 · WordPress plugins & themes · reported by PatchstackLow 2.7

  Missing Authorization vulnerability in fatcatapps Quiz Cat quiz-cat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz Cat: from n/a through <= 3.0.8.

  Product

  Quiz Cat

  Affected

  up to 3.0.8

  What to do

  Affects up to 3.0.8. Update Quiz Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Specific Content For Mobile: Missing AuthorizationCVE-2025-30874 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Jose Mortellaro Specific Content For Mobile specific-content-for-mobile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Specific Content For Mobile: from n/a through <= 0.5.3.

  Product

  Specific Content For Mobile

  Affected

  up to 0.5.3

  What to do

  Affects up to 0.5.3. Update Specific Content For Mobile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Greenshift: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30873 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Stored XSS.This issue affects Greenshift: from n/a through <= 11.0.2.

  Product

  Greenshift

  Affected

  up to 11.0.2

  What to do

  Affects up to 11.0.2. Update Greenshift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WP Travel Engine: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30871 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affects WP Travel Engine: from n/a through <= 6.3.5.

  Product

  WP Travel Engine

  Affected

  up to 6.3.5

  What to do

  Affects up to 6.3.5. Update WP Travel Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Team Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30868 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Maidul Team Manager wp-team-manager allows PHP Local File Inclusion.This issue affects Team Manager: from n/a through <= 2.1.23.

  Product

  Team Manager

  Affected

  up to 2.1.23

  What to do

  Affects up to 2.1.23. Update Team Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025SearchIQ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30867 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SearchIQ SearchIQ searchiq allows Stored XSS.This issue affects SearchIQ: from n/a through <= 4.7.

  Product

  SearchIQ

  Affected

  up to 4.7

  What to do

  Affects up to 4.7. Update SearchIQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Terms & Conditions Per Product: Missing AuthorizationCVE-2025-30866 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Giannis Kipouros Terms & Conditions Per Product terms-and-conditions-per-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Terms & Conditions Per Product: from n/a through <= 1.2.15.

  Product

  Terms & Conditions Per Product

  Affected

  up to 1.2.15

  What to do

  Affects up to 1.2.15. Update Terms & Conditions Per Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Exchange Rates: Missing AuthorizationCVE-2025-30864 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in falselight Exchange Rates exchange-rates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Exchange Rates: from n/a through <= 1.2.2.

  Product

  Exchange Rates

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Exchange Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms: Cross-Site Request Forgery (CSRF)CVE-2025-30863 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms integration-for-contact-form-7-and-google-sheets allows Cross Site Request Forgery.This issue affects Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through <= 1.0.9.

  Product

  Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Five Star Restaurant Reservations: Missing AuthorizationCVE-2025-30861 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.6.29.

  Product

  Five Star Restaurant Reservations

  Affected

  up to 2.6.29

  What to do

  Affects up to 2.6.29. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Off-Canvas Sidebars & Menus (Slidebars): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30860 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars allows DOM-Based XSS.This issue affects Off-Canvas Sidebars & Menus (Slidebars): from n/a through <= 0.5.8.2.

  Product

  Off-Canvas Sidebars & Menus (Slidebars)

  Affected

  up to 0.5.8.2

  What to do

  Affects up to 0.5.8.2. Update Off-Canvas Sidebars & Menus (Slidebars) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025AliNext: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30859 · WordPress plugins & themes · reported by PatchstackMedium 4.7

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in guru-aliexpress AliNext ali2woo-lite allows Phishing.This issue affects AliNext: from n/a through <= 3.5.1.

  Product

  AliNext

  Affected

  up to 3.5.1

  What to do

  Affects up to 3.5.1. Update AliNext to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Tickera: Missing AuthorizationCVE-2025-30851 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.5.2.

  Product

  Tickera

  Affected

  up to 3.5.5.2

  What to do

  Affects up to 3.5.5.2. Update Tickera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Dr. Flex: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30850 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sfaerber Dr. Flex dr-flex allows Stored XSS.This issue affects Dr. Flex: from n/a through <= 2.0.0.

  Product

  Dr. Flex

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Dr. Flex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Novelist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30847 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashley Novelist novelist allows Stored XSS.This issue affects Novelist: from n/a through <= 1.2.3.

  Product

  Novelist

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Novelist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Restaurant Menu by MotoPress: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30846 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows PHP Local File Inclusion.This issue affects Restaurant Menu by MotoPress: from n/a through <= 2.4.4.

  Product

  Restaurant Menu by MotoPress

  Affected

  up to 2.4.4

  What to do

  Affects up to 2.4.4. Update Restaurant Menu by MotoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025The Pack Elementor addons: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30845 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in webangon The Pack Elementor addons the-pack-addon allows PHP Local File Inclusion.This issue affects The Pack Elementor addons: from n/a through <= 2.1.1.

  Product

  The Pack Elementor addons

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025bizcalendar-web: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30843 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in setriosoft bizcalendar-web bizcalendar-web allows SQL Injection.This issue affects bizcalendar-web: from n/a through <= 1.1.0.34.

  Product

  bizcalendar-web

  Affected

  up to 1.1.0.34

  What to do

  Affects up to 1.1.0.34. Update bizcalendar-web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Taxi Booking Manager for WooCommerce: Missing AuthorizationCVE-2025-30839 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.2.1.

  Product

  Taxi Booking Manager for WooCommerce

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Cozy Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30838 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through <= 2.1.6.

  Product

  Cozy Blocks

  Affected

  up to 2.1.6

  What to do

  Affects up to 2.1.6. Update Cozy Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.