Vulnerability database

41,266 results · page 295 of 826

• Sep 22, 2025Clariti: Missing AuthorizationCVE-2025-57991 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Clariti Clariti clariti allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clariti: from n/a through <= 1.2.1.

  Product

  Clariti

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Clariti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Blog Designer: Missing AuthorizationCVE-2025-57990 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in solwininfotech Blog Designer blog-designer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blog Designer: from n/a through <= 3.1.8.

  Product

  Blog Designer

  Affected

  up to 3.1.8

  What to do

  Affects up to 3.1.8. Update Blog Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WordPress Widgets Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57989 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brajesh Singh WordPress Widgets Shortcode wp-widgets-shortcode allows Stored XSS.This issue affects WordPress Widgets Shortcode: from n/a through <= 1.0.3.

  Product

  WordPress Widgets Shortcode

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update WordPress Widgets Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Uncanny Toolkit for LearnDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57988 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.3.

  Product

  Uncanny Toolkit for LearnDash

  Affected

  up to 3.7.0.3

  What to do

  Affects up to 3.7.0.3. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Events Manager: Missing AuthorizationCVE-2025-57987 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in ThimPress WP Events Manager wp-events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Events Manager: from n/a through <= 2.2.1.

  Product

  WP Events Manager

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update WP Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Subtitle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57986 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in husani WP Subtitle wp-subtitle allows Stored XSS.This issue affects WP Subtitle: from n/a through <= 3.4.1.

  Product

  WP Subtitle

  Affected

  up to 3.4.1

  What to do

  Affects up to 3.4.1. Update WP Subtitle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Ultimate Watermark: Missing AuthorizationCVE-2025-57985 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in MantraBrain Ultimate Watermark ultimate-watermark allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Watermark: from n/a through <= 1.1.

  Product

  Ultimate Watermark

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Ultimate Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025MakeStories (for Google Web Stories): Server-Side Request Forgery (SSRF)CVE-2025-57984 · WordPress plugins & themes · reported by PatchstackMedium 4.4

  Server-Side Request Forgery (SSRF) vulnerability in Pratik Ghela MakeStories (for Google Web Stories) makestories-helper allows Server Side Request Forgery.This issue affects MakeStories (for Google Web Stories): from n/a through <= 3.0.4.

  Product

  MakeStories (for Google Web Stories)

  Affected

  up to 3.0.4

  What to do

  Affects up to 3.0.4. Update MakeStories (for Google Web Stories) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025BP Disable Activation Reloaded: Cross-Site Request Forgery (CSRF)CVE-2025-57983 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in Damian BP Disable Activation Reloaded bp-disable-activation-reloaded allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BP Disable Activation Reloaded: from n/a through <= 1.2.1.

  Product

  BP Disable Activation Reloaded

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update BP Disable Activation Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Advance Portfolio Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57982 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean Advance Portfolio Grid advance-portfolio-grid allows Stored XSS.This issue affects Advance Portfolio Grid: from n/a through <= 1.07.6.

  Product

  Advance Portfolio Grid

  Affected

  up to 1.07.6

  What to do

  Affects up to 1.07.6. Update Advance Portfolio Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Social Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57981 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through <= 2.3.1.

  Product

  WP Social Widget

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update WP Social Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Safety Exit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57980 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomas Cordero Safety Exit safety-exit allows Stored XSS.This issue affects Safety Exit: from n/a through <= 1.8.0.

  Product

  Safety Exit

  Affected

  up to 1.8.0

  What to do

  Affects up to 1.8.0. Update Safety Exit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025AuthorSure: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57979 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson AuthorSure authorsure allows Stored XSS.This issue affects AuthorSure: from n/a through <= 2.3.

  Product

  AuthorSure

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update AuthorSure to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Advanced Appointment Booking & Scheduling: Cross-Site Request Forgery (CSRF)CVE-2025-57978 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in themespride Advanced Appointment Booking & Scheduling advanced-appointment-booking-scheduling allows Cross Site Request Forgery.This issue affects Advanced Appointment Booking & Scheduling: from n/a through <= 2.1.

  Product

  Advanced Appointment Booking & Scheduling

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Advanced Appointment Booking & Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Flexible PDF Invoices for WooCommerce &: Cross-Site Request Forgery (CSRF)CVE-2025-57977 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible PDF Invoices for WooCommerce & WordPress flexible-invoices allows Cross Site Request Forgery.This issue affects Flexible PDF Invoices for WooCommerce & WordPress: from n/a through <= 6.0.13.

  Product

  Flexible PDF Invoices for WooCommerce &

  Affected

  up to 6.0.13

  What to do

  Affects up to 6.0.13. Update Flexible PDF Invoices for WooCommerce & to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025CardCom Payment Gateway: Missing AuthorizationCVE-2025-57976 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in CardCom CardCom Payment Gateway woo-cardcom-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CardCom Payment Gateway: from n/a through <= 3.5.0.7.

  Product

  CardCom Payment Gateway

  Affected

  up to 3.5.0.7

  What to do

  Affects up to 3.5.0.7. Update CardCom Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Team: Missing AuthorizationCVE-2025-57975 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.6.

  Product

  Team

  Affected

  up to 5.0.6

  What to do

  Affects up to 5.0.6. Update Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025TZ PlusGallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57974 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tuyennv TZ PlusGallery tz-plus-gallery allows Stored XSS.This issue affects TZ PlusGallery: from n/a through <= 1.5.5.

  Product

  TZ PlusGallery

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update TZ PlusGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP-Members: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57973 · WordPress plugins & themes · reported by PatchstackMedium 5.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chad Butler WP-Members wp-members allows Stored XSS.This issue affects WP-Members: from n/a through <= 3.5.4.2.

  Product

  WP-Members

  Affected

  up to 3.5.4.2

  What to do

  Affects up to 3.5.4.2. Update WP-Members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Helpdesk Support Ticket System for WooCommerce: Missing AuthorizationCVE-2025-57972 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in WPFactory Helpdesk Support Ticket System for WooCommerce support-ticket-system-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Helpdesk Support Ticket System for WooCommerce: from n/a through <= 2.1.1.

  Product

  Helpdesk Support Ticket System for WooCommerce

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update Helpdesk Support Ticket System for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025SALESmanago & Leadoo: Missing AuthorizationCVE-2025-57971 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALESmanago & Leadoo: from n/a through <= 3.8.1.

  Product

  SALESmanago & Leadoo

  Affected

  up to 3.8.1

  What to do

  Affects up to 3.8.1. Update SALESmanago & Leadoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025SALESmanago & Leadoo: Cross-Site Request Forgery (CSRF)CVE-2025-57970 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Cross Site Request Forgery.This issue affects SALESmanago & Leadoo: from n/a through <= 3.8.1.

  Product

  SALESmanago & Leadoo

  Affected

  up to 3.8.1

  What to do

  Affects up to 3.8.1. Update SALESmanago & Leadoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Hide WP Toolbar: Missing AuthorizationCVE-2025-57969 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Jeremy Saxey Hide WP Toolbar hide-wp-toolbar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hide WP Toolbar: from n/a through <= 2.7.

  Product

  Hide WP Toolbar

  Affected

  up to 2.7

  What to do

  Affects up to 2.7. Update Hide WP Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025VikRestaurants: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57968 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Reflected XSS.This issue affects VikRestaurants: from n/a through <= 1.5.

  Product

  VikRestaurants

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update VikRestaurants to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WPB Quick View for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57967 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean WPB Quick View for WooCommerce woocommerce-lightbox allows Stored XSS.This issue affects WPB Quick View for WooCommerce: from n/a through <= 2.1.8.

  Product

  WPB Quick View for WooCommerce

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update WPB Quick View for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Gallery Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57966 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery Lightbox gallery-lightbox-slider allows Stored XSS.This issue affects Gallery Lightbox: from n/a through <= 1.0.0.41.

  Product

  Gallery Lightbox

  Affected

  up to 1.0.0.41

  What to do

  Affects up to 1.0.0.41. Update Gallery Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Proposals: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57965 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs WP Proposals allows Stored XSS. This issue affects WP Proposals: from n/a through 2.3.

  Product

  WP Proposals

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update WP Proposals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Library Bookshelves: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57964 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in photonicgnostic Library Bookshelves library-bookshelves allows Stored XSS.This issue affects Library Bookshelves: from n/a through <= 5.11.

  Product

  Library Bookshelves

  Affected

  up to 5.11

  What to do

  Affects up to 5.11. Update Library Bookshelves to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Zoho Billing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57963 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Subscriptions Zoho Billing zoho-subscriptions allows DOM-Based XSS.This issue affects Zoho Billing: from n/a through <= 4.1.

  Product

  Zoho Billing

  Affected

  up to 4.1

  What to do

  Affects up to 4.1. Update Zoho Billing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025VikRestaurants: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57962 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Stored XSS.This issue affects VikRestaurants: from n/a through <= 1.5.1.

  Product

  VikRestaurants

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update VikRestaurants to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025CoDesigner: Missing AuthorizationCVE-2025-57961 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Codexpert, Inc CoDesigner woolementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoDesigner: from n/a through <= 4.29.

  Product

  CoDesigner

  Affected

  up to 4.29

  What to do

  Affects up to 4.29. Update CoDesigner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Travel Map: Cross-Site Request Forgery (CSRF)CVE-2025-57960 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in TravelMap Travel Map travelmap-blog allows Cross Site Request Forgery.This issue affects Travel Map: from n/a through <= 1.0.3.

  Product

  Travel Map

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Travel Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Slightly troublesome permalink: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57959 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tmatsuur Slightly troublesome permalink slightly-troublesome-permalink allows Stored XSS.This issue affects Slightly troublesome permalink: from n/a through <= 1.2.0.

  Product

  Slightly troublesome permalink

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Slightly troublesome permalink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WooMS: Missing AuthorizationCVE-2025-57957 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in wpcraft WooMS wooms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooMS: from n/a through <= 9.12.

  Product

  WooMS

  Affected

  up to 9.12

  What to do

  Affects up to 9.12. Update WooMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WooMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57956 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpcraft WooMS wooms allows Stored XSS.This issue affects WooMS: from n/a through <= 9.12.

  Product

  WooMS

  Affected

  up to 9.12

  What to do

  Affects up to 9.12. Update WooMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Post Carousel Slider for Elementor: Missing AuthorizationCVE-2025-57955 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Plugin Devs Post Carousel Slider for Elementor post-carousel-slider-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Carousel Slider for Elementor: from n/a through <= 1.7.0.

  Product

  Post Carousel Slider for Elementor

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update Post Carousel Slider for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Poll Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57954 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Poll Maker poll-maker allows DOM-Based XSS.This issue affects Poll Maker: from n/a through <= 6.0.2.

  Product

  Poll Maker

  Affected

  up to 6.0.2

  What to do

  Affects up to 6.0.2. Update Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Open User Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57953 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 100plugins Open User Map open-user-map allows DOM-Based XSS.This issue affects Open User Map: from n/a through <= 1.4.14.

  Product

  Open User Map

  Affected

  up to 1.4.14

  What to do

  Affects up to 1.4.14. Update Open User Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Maps for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57952 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc Maps for WP maps-for-wp allows Stored XSS.This issue affects Maps for WP: from n/a through <= 1.2.5.

  Product

  Maps for WP

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Maps for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025SiteNarrator Text-to-Speech Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57951 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ken107 SiteNarrator Text-to-Speech Widget sitespeaker-widget allows Stored XSS.This issue affects SiteNarrator Text-to-Speech Widget: from n/a through <= 1.9.

  Product

  SiteNarrator Text-to-Speech Widget

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update SiteNarrator Text-to-Speech Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Plugin Security Scanner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57950 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Glen Scott Plugin Security Scanner plugin-security-scanner allows Stored XSS.This issue affects Plugin Security Scanner: from n/a through <= 2.0.2.

  Product

  Plugin Security Scanner

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update Plugin Security Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Ongkoskirim.id: Missing AuthorizationCVE-2025-57949 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in oggix Ongkoskirim.id ongkoskirim-id allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ongkoskirim.id: from n/a through <= 1.0.6.

  Product

  Ongkoskirim.id

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Ongkoskirim.id to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Directory Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57948 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Directory Pro directory-pro allows DOM-Based XSS.This issue affects Directory Pro: from n/a through <= 2.5.5.

  Product

  Directory Pro

  Affected

  up to 2.5.5

  What to do

  Affects up to 2.5.5. Update Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Photo Gallery by Ays: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57947 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Photo Gallery by Ays gallery-photo-gallery allows DOM-Based XSS.This issue affects Photo Gallery by Ays: from n/a through <= 6.3.8.

  Product

  Photo Gallery by Ays

  Affected

  up to 6.3.8

  What to do

  Affects up to 6.3.8. Update Photo Gallery by Ays to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025payOS: Cross-Site Request Forgery (CSRF)CVE-2025-57946 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Loc Bui payOS payos allows Cross Site Request Forgery.This issue affects payOS: from n/a through <= 1.0.73.

  Product

  payOS

  Affected

  up to 1.0.73

  What to do

  Affects up to 1.0.73. Update payOS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Advanced PDF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57945 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cedcommerce WP Advanced PDF wp-advanced-pdf allows Stored XSS.This issue affects WP Advanced PDF: from n/a through <= 1.1.7.

  Product

  WP Advanced PDF

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update WP Advanced PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Skimlinks Affiliate Marketing Tool: Missing AuthorizationCVE-2025-57944 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Skimlinks Skimlinks Affiliate Marketing Tool skimlinks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Skimlinks Affiliate Marketing Tool: from n/a through <= 1.3.

  Product

  Skimlinks Affiliate Marketing Tool

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Skimlinks Affiliate Marketing Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Skimlinks Affiliate Marketing Tool: Server-Side Request Forgery (SSRF)CVE-2025-57943 · WordPress plugins & themes · reported by PatchstackMedium 4.4

  Server-Side Request Forgery (SSRF) vulnerability in Skimlinks Skimlinks Affiliate Marketing Tool skimlinks allows Server Side Request Forgery.This issue affects Skimlinks Affiliate Marketing Tool: from n/a through <= 1.3.1.

  Product

  Skimlinks Affiliate Marketing Tool

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Skimlinks Affiliate Marketing Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Emergency Password Reset: Cross-Site Request Forgery (CSRF)CVE-2025-57942 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Emergency Password Reset emergency-password-reset allows Cross Site Request Forgery.This issue affects Emergency Password Reset: from n/a through <= 9.3.

  Product

  Emergency Password Reset

  Affected

  up to 9.3

  What to do

  Affects up to 9.3. Update Emergency Password Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Append Link on Copy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57941 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JonathanMH Append Link on Copy append-link-on-copy allows Stored XSS.This issue affects Append Link on Copy: from n/a through <= 0.2.

  Product

  Append Link on Copy

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update Append Link on Copy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.