Vulnerability database

41,266 results · page 293 of 826

• Sep 22, 2025PlayerJS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58651 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PlayerJS PlayerJS playerjs allows DOM-Based XSS.This issue affects PlayerJS: from n/a through <= 2.24.

  Product

  PlayerJS

  Affected

  up to 2.24

  What to do

  Affects up to 2.24. Update PlayerJS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025All In One SEO Pack: Missing AuthorizationCVE-2025-58650 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All In One SEO Pack: from n/a through <= 4.8.7.1.

  Product

  All In One SEO Pack

  Affected

  up to 4.8.7.1

  What to do

  Affects up to 4.8.7.1. Update All In One SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025All In One SEO Pack: Insertion of Sensitive Information Into Sent DataCVE-2025-58649 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n/a through <= 4.8.7.1.

  Product

  All In One SEO Pack

  Affected

  up to 4.8.7.1

  What to do

  Affects up to 4.8.7.1. Update All In One SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Simple JWT Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58648 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Stored XSS.This issue affects Simple JWT Login: from n/a through <= 3.6.4.

  Product

  Simple JWT Login

  Affected

  up to 3.6.4

  What to do

  Affects up to 3.6.4. Update Simple JWT Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Simple Restaurant Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58647 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Will.I.am Simple Restaurant Menu simple-restaurant-menu allows Stored XSS.This issue affects Simple Restaurant Menu: from n/a through <= 1.2.

  Product

  Simple Restaurant Menu

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Simple Restaurant Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Mobi2Go: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58646 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chtombleson Mobi2Go mobi2go allows Stored XSS.This issue affects Mobi2Go: from n/a through <= 1.0.0.

  Product

  Mobi2Go

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Mobi2Go to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Gravitate Automated Tester: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58645 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gravitate Gravitate Automated Tester gravitate-automated-tester allows Stored XSS.This issue affects Gravitate Automated Tester: from n/a through <= 1.4.5.

  Product

  Gravitate Automated Tester

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update Gravitate Automated Tester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025AnyClip Luminous Studio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58271 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AnyClip Video Platform AnyClip Luminous Studio anyclip-media allows Stored XSS.This issue affects AnyClip Luminous Studio: from n/a through <= 1.3.3.

  Product

  AnyClip Luminous Studio

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update AnyClip Luminous Studio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025NIX Anti-Spam Light: Cross-Site Request Forgery (CSRF)CVE-2025-58270 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in NIX Solutions Ltd NIX Anti-Spam Light nix-anti-spam-light allows Cross Site Request Forgery.This issue affects NIX Anti-Spam Light: from n/a through <= 0.0.4.

  Product

  NIX Anti-Spam Light

  Affected

  up to 0.0.4

  What to do

  Affects up to 0.0.4. Update NIX Anti-Spam Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Project Manager: Use of Hard-coded CredentialsCVE-2025-58269 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Use of Hard-coded Credentials vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 2.6.25.

  Product

  WP Project Manager

  Affected

  up to 2.6.25

  What to do

  Affects up to 2.6.25. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WPMK PDF Generator: Cross-Site Request Forgery (CSRF)CVE-2025-58268 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in WPMK WPMK PDF Generator wpmk-pdf-generator allows Stored XSS.This issue affects WPMK PDF Generator: from n/a through <= 1.0.1.

  Product

  WPMK PDF Generator

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update WPMK PDF Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Stock Message: Cross-Site Request Forgery (CSRF)CVE-2025-58267 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Aftabul Islam Stock Message stock-message allows Stored XSS.This issue affects Stock Message: from n/a through <= 1.1.0.

  Product

  Stock Message

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Stock Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Gianism: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58266 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fumiki Takahashi Gianism gianism allows Stored XSS.This issue affects Gianism: from n/a through <= 6.0.0.

  Product

  Gianism

  Affected

  up to 6.0.0

  What to do

  Affects up to 6.0.0. Update Gianism to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Events Manager – OpenStreetMaps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58265 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stonehenge Creations Events Manager – OpenStreetMaps stonehenge-em-osm allows Stored XSS.This issue affects Events Manager – OpenStreetMaps: from n/a through <= 4.2.1.

  Product

  Events Manager – OpenStreetMaps

  Affected

  up to 4.2.1

  What to do

  Affects up to 4.2.1. Update Events Manager – OpenStreetMaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025JupiterX Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58264 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artbees JupiterX Core jupiterx-core allows Stored XSS.This issue affects JupiterX Core: from n/a through <= 4.11.0.

  Product

  JupiterX Core

  Affected

  up to 4.11.0

  What to do

  Affects up to 4.11.0. Update JupiterX Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025BuddyPress Notification Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58263 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev BuddyPress Notification Widget buddypress-notifications-widget allows Stored XSS.This issue affects BuddyPress Notification Widget: from n/a through <= 1.3.3.

  Product

  BuddyPress Notification Widget

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update BuddyPress Notification Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Sweet Energy Efficiency: Cross-Site Request Forgery (CSRF)CVE-2025-58262 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in WPDirectoryKit Sweet Energy Efficiency sweet-energy-efficiency allows Stored XSS.This issue affects Sweet Energy Efficiency: from n/a through <= 1.0.8.

  Product

  Sweet Energy Efficiency

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Sweet Energy Efficiency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Mavis HTTPS to HTTP Redirection: Cross-Site Request Forgery (CSRF)CVE-2025-58261 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in PressPage Entertainment Inc Mavis HTTPS to HTTP Redirection mavis-https-to-http-redirect allows Stored XSS.This issue affects Mavis HTTPS to HTTP Redirection: from n/a through <= 1.4.3.

  Product

  Mavis HTTPS to HTTP Redirection

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update Mavis HTTPS to HTTP Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Highlight and Share: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58260 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Stored XSS.This issue affects Highlight and Share: from n/a through <= 5.1.1.

  Product

  Highlight and Share

  Affected

  up to 5.1.1

  What to do

  Affects up to 5.1.1. Update Highlight and Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Nokri: Cross-Site Request Forgery (CSRF)CVE-2025-58259 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in scriptsbundle Nokri nokri allows Cross Site Request Forgery.This issue affects Nokri: from n/a through <= 1.6.4.

  Product

  Nokri

  Affected

  up to 1.6.4

  What to do

  Affects up to 1.6.4. Update Nokri to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Lazy Blocks: Missing AuthorizationCVE-2025-58258 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in nK Lazy Blocks lazy-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lazy Blocks: from n/a through <= 4.1.0.

  Product

  Lazy Blocks

  Affected

  up to 4.1.0

  What to do

  Affects up to 4.1.0. Update Lazy Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Verowa Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58257 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Stored XSS.This issue affects Verowa Connect: from n/a through <= 3.2.3.

  Product

  Verowa Connect

  Affected

  up to 3.2.3

  What to do

  Affects up to 3.2.3. Update Verowa Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025DOAJ Export: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58256 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Brinley DOAJ Export doaj-export allows Stored XSS.This issue affects DOAJ Export: from n/a through <= 1.0.4.

  Product

  DOAJ Export

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update DOAJ Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Custom Post Type Images: Cross-Site Request Forgery (CSRF)CVE-2025-58255 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in yonisink Custom Post Type Images custom-post-types-image allows Code Injection.This issue affects Custom Post Type Images: from n/a through <= 0.5.

  Product

  Custom Post Type Images

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update Custom Post Type Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025StylePress for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58254 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dtbaker StylePress for Elementor full-site-builder-for-elementor allows Stored XSS.This issue affects StylePress for Elementor: from n/a through <= 1.2.1.

  Product

  StylePress for Elementor

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update StylePress for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Real Estate Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58253 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows DOM-Based XSS.This issue affects Real Estate Manager: from n/a through <= 7.3.

  Product

  Real Estate Manager

  Affected

  up to 7.3

  What to do

  Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Getwid: Insertion of Sensitive Information Into Sent DataCVE-2025-58252 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Insertion of Sensitive Information Into Sent Data vulnerability in jetmonsters Getwid getwid allows Retrieve Embedded Sensitive Data.This issue affects Getwid: from n/a through <= 2.1.2.

  Product

  Getwid

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Getwid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Sticky Header Effects for Elementor: Missing AuthorizationCVE-2025-58251 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in POSIMYTH Sticky Header Effects for Elementor sticky-header-effects-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Header Effects for Elementor: from n/a through <= 2.1.2.

  Product

  Sticky Header Effects for Elementor

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Sticky Header Effects for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Findgo: Cross-Site Request Forgery (CSRF)CVE-2025-58250 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in ApusTheme Findgo fingo allows Authentication Bypass.This issue affects Findgo: from n/a through <= 1.3.55.

  Product

  Findgo

  Affected

  up to 1.3.55

  What to do

  Affects up to 1.3.55. Update Findgo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Qubely: Insertion of Sensitive Information Into Sent DataCVE-2025-58249 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Insertion of Sensitive Information Into Sent Data vulnerability in Themeum Qubely qubely allows Retrieve Embedded Sensitive Data.This issue affects Qubely: from n/a through <= 1.8.14.

  Product

  Qubely

  Affected

  up to 1.8.14

  What to do

  Affects up to 1.8.14. Update Qubely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Pinterest Pinboard Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58248 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codefish Pinterest Pinboard Widget pinterest-pinboard-widget allows Stored XSS.This issue affects Pinterest Pinboard Widget: from n/a through <= 1.0.7.

  Product

  Pinterest Pinboard Widget

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Pinterest Pinboard Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025TI WooCommerce Wishlist: Missing AuthorizationCVE-2025-58247 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.

  Product

  TI WooCommerce Wishlist

  Affected

  up to 2.10.0

  What to do

  Affects up to 2.10.0. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58245 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bestweblayout Portfolio portfolio allows DOM-Based XSS.This issue affects Portfolio : from n/a through <= 2.58.

  Product

  Portfolio

  Affected

  up to 2.58

  What to do

  Affects up to 2.58. Update Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Constructo: Cross-Site Request Forgery (CSRF)CVE-2025-58244 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in Anps Constructo constructo allows Object Injection.This issue affects Constructo: from n/a through <= 4.3.9.

  Product

  Constructo

  Affected

  up to 4.3.9

  What to do

  Affects up to 4.3.9. Update Constructo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Bg Church Memos: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58242 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vadim Bogaiskov Bg Church Memos bg-church-memos allows DOM-Based XSS.This issue affects Bg Church Memos: from n/a through <= 1.1.

  Product

  Bg Church Memos

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Bg Church Memos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025SnapWidget Social Photo Feed Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58241 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snapwidget SnapWidget Social Photo Feed Widget snapwidget-wp-instagram-widget allows DOM-Based XSS.This issue affects SnapWidget Social Photo Feed Widget: from n/a through <= 1.1.0.

  Product

  SnapWidget Social Photo Feed Widget

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update SnapWidget Social Photo Feed Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025xili-tidy-tags: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58240 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-tidy-tags xili-tidy-tags allows Stored XSS.This issue affects xili-tidy-tags: from n/a through <= 1.12.06.

  Product

  xili-tidy-tags

  Affected

  up to 1.12.06

  What to do

  Affects up to 1.12.06. Update xili-tidy-tags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Category Dropdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58239 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chandrika Sista WP Category Dropdown wp-category-dropdown allows Stored XSS.This issue affects WP Category Dropdown: from n/a through <= 1.9.

  Product

  WP Category Dropdown

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update WP Category Dropdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025PilotPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58238 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ONTRAPORT PilotPress pilotpress allows Stored XSS.This issue affects PilotPress: from n/a through <= 2.0.36.

  Product

  PilotPress

  Affected

  up to 2.0.36

  What to do

  Affects up to 2.0.36. Update PilotPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025LC Wizard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58237 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Niaj Morshed LC Wizard ghl-wizard allows Stored XSS.This issue affects LC Wizard: from n/a through <= 2.2.4.

  Product

  LC Wizard

  Affected

  up to 2.2.4

  What to do

  Affects up to 2.2.4. Update LC Wizard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Force Update Translations: Cross-Site Request Forgery (CSRF)CVE-2025-58236 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Mayo Moriyama Force Update Translations force-update-translations allows Cross Site Request Forgery.This issue affects Force Update Translations: from n/a through <= 0.5.

  Product

  Force Update Translations

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update Force Update Translations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Front End Users: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58235 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows Stored XSS.This issue affects Front End Users: from n/a through <= 3.2.35.

  Product

  Front End Users

  Affected

  up to 3.2.35

  What to do

  Affects up to 3.2.35. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025JS Job Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58234 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomSky JS Job Manager js-jobs allows Stored XSS.This issue affects JS Job Manager: from n/a through <= 2.0.2.

  Product

  JS Job Manager

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update JS Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025SQL Chart Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58233 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Guaven Labs SQL Chart Builder sql-chart-builder allows DOM-Based XSS.This issue affects SQL Chart Builder: from n/a through <= 2.3.7.2.

  Product

  SQL Chart Builder

  Affected

  up to 2.3.7.2

  What to do

  Affects up to 2.3.7.2. Update SQL Chart Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Image Editor by Pixo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58232 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ickata Image Editor by Pixo image-editor-by-pixo allows DOM-Based XSS.This issue affects Image Editor by Pixo: from n/a through <= 2.3.8.

  Product

  Image Editor by Pixo

  Affected

  up to 2.3.8

  What to do

  Affects up to 2.3.8. Update Image Editor by Pixo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Bitly: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58231 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bitlydeveloper Bitly wp-bitly allows Stored XSS.This issue affects Bitly: from n/a through <= 2.8.0.

  Product

  Bitly

  Affected

  up to 2.8.0

  What to do

  Affects up to 2.8.0. Update Bitly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025ZoloBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58230 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes ZoloBlocks zoloblocks allows DOM-Based XSS.This issue affects ZoloBlocks: from n/a through <= 2.3.12.

  Product

  ZoloBlocks

  Affected

  up to 2.3.12

  What to do

  Affects up to 2.3.12. Update ZoloBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Sitekit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58229 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue affects Sitekit: from n/a through <= 2.0.

  Product

  Sitekit

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Sitekit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Quick View for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58228 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC Quick View for WooCommerce woo-quickview allows Stored XSS.This issue affects Quick View for WooCommerce: from n/a through <= 2.2.16.

  Product

  Quick View for WooCommerce

  Affected

  up to 2.2.16

  What to do

  Affects up to 2.2.16. Update Quick View for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Podlove Subscribe button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58227 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alexander Lueken Podlove Subscribe button podlove-subscribe-button allows Stored XSS.This issue affects Podlove Subscribe button: from n/a through <= 1.3.11.

  Product

  Podlove Subscribe button

  Affected

  up to 1.3.11

  What to do

  Affects up to 1.3.11. Update Podlove Subscribe button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.