Vulnerability database

24,557 results · page 295 of 492

• Jan 24, 2025Magic the Gathering Card Tooltips: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24704 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grimdonkey Magic the Gathering Card Tooltips magic-the-gathering-card-tooltips allows Stored XSS.This issue affects Magic the Gathering Card Tooltips: from n/a through <= 3.4.0.

  Product

  Magic the Gathering Card Tooltips

  Affected

  up to 3.4.0

  What to do

  Affects up to 3.4.0. Update Magic the Gathering Card Tooltips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Xagio SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24702 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xagio SEO Xagio SEO xagio-seo allows Stored XSS.This issue affects Xagio SEO: from n/a through <= 7.0.0.20.

  Product

  Xagio SEO

  Affected

  up to 7.0.0.20

  What to do

  Affects up to 7.0.0.20. Update Xagio SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Extensions For CF7: Server-Side Request Forgery (SSRF)CVE-2025-24695 · WordPress plugins & themes · reported by PatchstackMedium 4.4

  Server-Side Request Forgery (SSRF) vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Server Side Request Forgery.This issue affects Extensions For CF7: from n/a through <= 3.2.0.

  Product

  Extensions For CF7

  Affected

  up to 3.2.0

  What to do

  Affects up to 3.2.0. Update Extensions For CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Advanced Notifications: Missing AuthorizationCVE-2025-24693 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Yehi Advanced Notifications advanced-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Notifications: from n/a through <= 1.2.7.

  Product

  Advanced Notifications

  Affected

  up to 1.2.7

  What to do

  Affects up to 1.2.7. Update Advanced Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025People Lists: Missing AuthorizationCVE-2025-24691 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in ctltwp People Lists people-lists allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects People Lists: from n/a through <= 1.3.10.

  Product

  People Lists

  Affected

  up to 1.3.10

  What to do

  Affects up to 1.3.10. Update People Lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Show/Hide Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24687 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lars Wallenborn Show/Hide Shortcode showhide-shortcode allows Stored XSS.This issue affects Show/Hide Shortcode: from n/a through <= 1.0.0.

  Product

  Show/Hide Shortcode

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Show/Hide Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025RSVP and Event Management: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24683 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill RSVP and Event Management rsvp allows SQL Injection.This issue affects RSVP and Event Management: from n/a through <= 2.7.14.

  Product

  RSVP and Event Management

  Affected

  up to 2.7.14

  What to do

  Affects up to 2.7.14. Update RSVP and Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Super Block Slider: Missing AuthorizationCVE-2025-24682 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Michael Super Block Slider super-block-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Block Slider: from n/a through <= 2.7.9.

  Product

  Super Block Slider

  Affected

  up to 2.7.9

  What to do

  Affects up to 2.7.9. Update Super Block Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Product Carousel Slider & Grid Ultimate for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24681 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Product Carousel Slider & Grid Ultimate for WooCommerce woo-product-carousel-slider-and-grid-ultimate allows Stored XSS.This issue affects Product Carousel Slider & Grid Ultimate for WooCommerce: from n/a through <= 1.10.0.

  Product

  Product Carousel Slider & Grid Ultimate for WooCommerce

  Affected

  up to 1.10.0

  What to do

  Affects up to 1.10.0. Update Product Carousel Slider & Grid Ultimate for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Internal Links Manager: Missing AuthorizationCVE-2025-24679 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in webraketen Internal Links Manager seo-automated-link-building allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Internal Links Manager: from n/a through <= 2.5.2.

  Product

  Internal Links Manager

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update Internal Links Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Listamester: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-24678 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in listamester Listamester listamester allows Stored XSS.This issue affects Listamester: from n/a through <= 2.3.4.

  Product

  Listamester

  Affected

  up to 2.3.4

  What to do

  Affects up to 2.3.4. Update Listamester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24675 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Stored XSS.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 7.2.

  Product

  WP Visitor Statistics (Real Time Traffic)

  Affected

  up to 7.2

  What to do

  Affects up to 7.2. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025ShMapper by Teplitsa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24674 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denis Cherniatev ShMapper by Teplitsa shmapper-by-teplitsa allows Stored XSS.This issue affects ShMapper by Teplitsa: from n/a through <= 1.5.0.

  Product

  ShMapper by Teplitsa

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update ShMapper by Teplitsa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Ketchup Shortcodes: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-24673 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AyeCode Ketchup Shortcodes ketchup-shortcodes-pack allows Stored XSS.This issue affects Ketchup Shortcodes: from n/a through <= 0.1.2.

  Product

  Ketchup Shortcodes

  Affected

  up to 0.1.2

  What to do

  Affects up to 0.1.2. Update Ketchup Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Form Builder CP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24672 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople Form Builder CP cp-easy-form-builder allows SQL Injection.This issue affects Form Builder CP: from n/a through <= 1.2.41.

  Product

  Form Builder CP

  Affected

  up to 1.2.41

  What to do

  Affects up to 1.2.41. Update Form Builder CP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025SERPed.net: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24669 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in serpednet SERPed.net serped-net allows SQL Injection.This issue affects SERPed.net: from n/a through <= 4.4.

  Product

  SERPed.net

  Affected

  up to 4.4

  What to do

  Affects up to 4.4. Update SERPed.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025PPOM for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24668 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Stored XSS.This issue affects PPOM for WooCommerce: from n/a through <= 33.0.8.

  Product

  PPOM for WooCommerce

  Affected

  up to 33.0.8

  What to do

  Affects up to 33.0.8. Update PPOM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025AI Chatbot for WordPress – Hyve Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24666 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Stored XSS.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through <= 1.2.2.

  Product

  AI Chatbot for WordPress – Hyve Lite

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update AI Chatbot for WordPress – Hyve Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Simple Download Monitor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24663 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mra13 Simple Download Monitor simple-download-monitor allows Blind SQL Injection.This issue affects Simple Download Monitor: from n/a through <= 3.9.25.

  Product

  Simple Download Monitor

  Affected

  up to 3.9.25

  What to do

  Affects up to 3.9.25. Update Simple Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025WPDM – Premium Packages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24659 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Blind SQL Injection.This issue affects WPDM – Premium Packages: from n/a through <= 5.9.6.

  Product

  WPDM – Premium Packages

  Affected

  up to 5.9.6

  What to do

  Affects up to 5.9.6. Update WPDM – Premium Packages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Auction Nudge – Your eBay on Your Site: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24658 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Auction Nudge – Your eBay on Your Site auction-nudge allows Stored XSS.This issue affects Auction Nudge – Your eBay on Your Site: from n/a through <= 7.2.0.

  Product

  Auction Nudge – Your eBay on Your Site

  Affected

  up to 7.2.0

  What to do

  Affects up to 7.2.0. Update Auction Nudge – Your eBay on Your Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Wishlist for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24657 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee Wishlist for WooCommerce wt-woocommerce-wishlist allows Stored XSS.This issue affects Wishlist for WooCommerce: from n/a through <= 2.1.2.

  Product

  Wishlist for WooCommerce

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025WP Duplicate: Missing AuthorizationCVE-2025-24652 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in revmakx WP Duplicate local-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Duplicate: from n/a through <= 1.1.6.

  Product

  WP Duplicate

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update WP Duplicate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Admin and Site Enhancements (ASE): Missing AuthorizationCVE-2025-24649 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 7.6.2.

  Product

  Admin and Site Enhancements (ASE)

  Affected

  up to 7.6.2

  What to do

  Affects up to 7.6.2. Update Admin and Site Enhancements (ASE) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24644 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels print-invoices-packing-slip-labels-for-woocommerce allows Stored XSS.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through <= 4.7.1.

  Product

  WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels

  Affected

  up to 4.7.1

  What to do

  Affects up to 4.7.1. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Create with Code: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24638 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pddring Create with Code create-with-code allows DOM-Based XSS.This issue affects Create with Code: from n/a through <= 1.4.

  Product

  Create with Code

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Create with Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Orbisius Simple Notice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24634 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Svetoslav Marinov Orbisius Simple Notice orbisius-simple-notice allows Stored XSS.This issue affects Orbisius Simple Notice: from n/a through <= 1.1.3.

  Product

  Orbisius Simple Notice

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Orbisius Simple Notice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Build Private Store For Woocommerce: Missing AuthorizationCVE-2025-24633 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in silverplugins217 Build Private Store For Woocommerce build-private-store-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Build Private Store For Woocommerce: from n/a through <= 1.0.

  Product

  Build Private Store For Woocommerce

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Build Private Store For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Blur Text: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24627 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linnea Huxford Blur Text blur-text allows Stored XSS.This issue affects Blur Text: from n/a through <= 1.0.0.

  Product

  Blur Text

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Blur Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Taxonomy/Term and Role based Discounts for WooCommerce: Missing AuthorizationCVE-2025-24625 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Marco Almeida | Webdados Taxonomy/Term and Role based Discounts for WooCommerce taxonomy-discounts-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxonomy/Term and Role based Discounts for WooCommerce: from n/a through <= 5.1.

  Product

  Taxonomy/Term and Role based Discounts for WooCommerce

  Affected

  up to 5.1

  What to do

  Affects up to 5.1. Update Taxonomy/Term and Role based Discounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025ElementInvader Addons for Elementor: Missing AuthorizationCVE-2025-24618 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.1.

  Product

  ElementInvader Addons for Elementor

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025FV Thoughtful Comments: Missing AuthorizationCVE-2025-24613 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in FolioVision FV Thoughtful Comments thoughtful-comments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FV Thoughtful Comments: from n/a through <= 0.3.5.

  Product

  FV Thoughtful Comments

  Affected

  up to 0.3.5

  What to do

  Affects up to 0.3.5. Update FV Thoughtful Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025WP Ultimate Exporter: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-24611 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Smackcoders Inc., WP Ultimate Exporter wp-ultimate-exporter allows Absolute Path Traversal.This issue affects WP Ultimate Exporter: from n/a through <= 2.9.

  Product

  WP Ultimate Exporter

  Affected

  up to 2.9

  What to do

  Affects up to 2.9. Update WP Ultimate Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Restrict Anonymous Access: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24610 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christian Leuenberg Restrict Anonymous Access restrict-anonymous-access allows Stored XSS.This issue affects Restrict Anonymous Access: from n/a through <= 1.2.

  Product

  Restrict Anonymous Access

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Restrict Anonymous Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025VPSUForm: Missing AuthorizationCVE-2025-24604 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Vikas Ratudi VPSUForm v-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VPSUForm: from n/a through <= 3.0.5.

  Product

  VPSUForm

  Affected

  up to 3.0.5

  What to do

  Affects up to 3.0.5. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025WooCommerce Product Table Lite: Missing AuthorizationCVE-2025-24596 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WC Product Table WooCommerce Product Table Lite wc-product-table-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Table Lite: from n/a through <= 3.8.7.

  Product

  WooCommerce Product Table Lite

  Affected

  up to 3.8.7

  What to do

  Affects up to 3.8.7. Update WooCommerce Product Table Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025All Embed – Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24595 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins All Embed – Elementor Addons all-embed-addons-for-elementor allows Stored XSS.This issue affects All Embed – Elementor Addons: from n/a through <= 1.1.3.

  Product

  All Embed – Elementor Addons

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update All Embed – Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Linet ERP-Woocommerce Integration: Missing AuthorizationCVE-2025-24594 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerce-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Linet ERP-Woocommerce Integration: from n/a through <= 3.5.7.

  Product

  Linet ERP-Woocommerce Integration

  Affected

  up to 3.5.7

  What to do

  Affects up to 3.5.7. Update Linet ERP-Woocommerce Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025GDPR CCPA Compliance Support: Missing AuthorizationCVE-2025-24591 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.1.

  Product

  GDPR CCPA Compliance Support

  Affected

  up to 2.7.1

  What to do

  Affects up to 2.7.1. Update GDPR CCPA Compliance Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025JSM Show Post Metadata: Missing AuthorizationCVE-2025-24589 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in JS Morisset JSM Show Post Metadata jsm-show-post-meta allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JSM Show Post Metadata: from n/a through <= 4.6.0.

  Product

  JSM Show Post Metadata

  Affected

  up to 4.6.0

  What to do

  Affects up to 4.6.0. Update JSM Show Post Metadata to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Patreon: Missing AuthorizationCVE-2025-24588 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in patreon Patreon WordPress patreon-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Patreon WordPress: from n/a through <= 1.9.1.

  Product

  Patreon

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update Patreon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Email Subscription Popup: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24587 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nks Email Subscription Popup email-subscribe allows Blind SQL Injection.This issue affects Email Subscription Popup: from n/a through <= 1.2.23.

  Product

  Email Subscription Popup

  Affected

  up to 1.2.23

  What to do

  Affects up to 1.2.23. Update Email Subscription Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24585 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This issue affects Event post: from n/a through <= 5.9.7.

  Product

  Event post

  Affected

  up to 5.9.7

  What to do

  Affects up to 5.9.7. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 202512 Step Meeting List: Insertion of Sensitive Information Into Sent DataCVE-2025-24582 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive Data.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5.

  Product

  12 Step Meeting List

  Affected

  up to 3.16.5

  What to do

  Affects up to 3.16.5. Update 12 Step Meeting List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 202512 Step Meeting List: Missing AuthorizationCVE-2025-24580 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5.

  Product

  12 Step Meeting List

  Affected

  up to 3.16.5

  What to do

  Affects up to 3.16.5. Update 12 Step Meeting List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Nested Pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24579 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Nested Pages wp-nested-pages allows Stored XSS.This issue affects Nested Pages: from n/a through <= 3.2.9.

  Product

  Nested Pages

  Affected

  up to 3.2.9

  What to do

  Affects up to 3.2.9. Update Nested Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025ElementInvader Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24578 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows DOM-Based XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.0.

  Product

  ElementInvader Addons for Elementor

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025HelloAsso: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24575 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso HelloAsso helloasso allows Stored XSS.This issue affects HelloAsso: from n/a through <= 1.1.11.

  Product

  HelloAsso

  Affected

  up to 1.1.11

  What to do

  Affects up to 1.1.11. Update HelloAsso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025PageLayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24573 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softaculous PageLayer pagelayer allows DOM-Based XSS.This issue affects PageLayer: from n/a through <= 1.9.4.

  Product

  PageLayer

  Affected

  up to 1.9.4

  What to do

  Affects up to 1.9.4. Update PageLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025WP Fast Total Search: Missing AuthorizationCVE-2025-24571 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Fast Total Search: from n/a through <= 1.78.258.

  Product

  WP Fast Total Search

  Affected

  up to 1.78.258

  What to do

  Affects up to 1.78.258. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.