Vulnerability database

41,498 results · page 366 of 830

• Apr 24, 2025Navegg Analytics: Cross-Site Request Forgery (CSRF)CVE-2025-46497 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Navegg Navegg Analytics navegg allows Stored XSS.This issue affects Navegg Analytics: from n/a through <= 3.3.3.

  Product

  Navegg Analytics

  Affected

  up to 3.3.3

  What to do

  Affects up to 3.3.3. Update Navegg Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Mini twitter feed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46496 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oniswap Mini twitter feed mini-twitter-feed allows Stored XSS.This issue affects Mini twitter feed: from n/a through <= 3.0.

  Product

  Mini twitter feed

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update Mini twitter feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Drop Caps: Cross-Site Request Forgery (CSRF)CVE-2025-46495 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in tomontoast Drop Caps drop-caps allows Stored XSS.This issue affects Drop Caps: from n/a through <= 2.1.

  Product

  Drop Caps

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Drop Caps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Call Now PHT Blog: Cross-Site Request Forgery (CSRF)CVE-2025-46492 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Pham Thanh Call Now PHT Blog call-now-coccoc-pht-blog allows Stored XSS.This issue affects Call Now PHT Blog: from n/a through <= 2.4.1.

  Product

  Call Now PHT Blog

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update Call Now PHT Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Multi-Column Taxonomy List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46491 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthew Muro Multi-Column Taxonomy List multi-column-taxonomy-list allows Stored XSS.This issue affects Multi-Column Taxonomy List: from n/a through <= 1.5.

  Product

  Multi-Column Taxonomy List

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Multi-Column Taxonomy List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Bulk Assign Linked Products For WooCommerce: Missing AuthorizationCVE-2025-46489 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in vinodvaswani9 Bulk Assign Linked Products For WooCommerce wc-bulk-assign-linked-products allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bulk Assign Linked Products For WooCommerce: from n/a through <= 2.1.

  Product

  Bulk Assign Linked Products For WooCommerce

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Bulk Assign Linked Products For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025WP Customize Login Page: Missing AuthorizationCVE-2025-46485 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Customize Login Page: from n/a through <= 1.6.5.

  Product

  WP Customize Login Page

  Affected

  up to 1.6.5

  What to do

  Affects up to 1.6.5. Update WP Customize Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Image Hover Effects For WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46484 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nasir179125 Image Hover Effects For WPBakery Page Builder image-hover-effects-for-visual-composer allows DOM-Based XSS.This issue affects Image Hover Effects For WPBakery Page Builder: from n/a through <= 2.0.

  Product

  Image Hover Effects For WPBakery Page Builder

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Image Hover Effects For WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Peadig’s Google +1 Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46483 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Moss Peadig’s Google +1 Button google-1 allows DOM-Based XSS.This issue affects Peadig’s Google +1 Button: from n/a through <= 0.1.2.

  Product

  Peadig’s Google +1 Button

  Affected

  up to 0.1.2

  What to do

  Affects up to 0.1.2. Update Peadig’s Google +1 Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Flickr Shortcode Importer: Deserialization of Untrusted DataCVE-2025-46481 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Deserialization of Untrusted Data vulnerability in Michael Cannon Flickr Shortcode Importer flickr-shortcode-importer allows Object Injection.This issue affects Flickr Shortcode Importer: from n/a through <= 2.2.3.

  Product

  Flickr Shortcode Importer

  Affected

  up to 2.2.3

  What to do

  Affects up to 2.2.3. Update Flickr Shortcode Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Nepali Post Date: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46480 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Padam Shankhadev Nepali Post Date nepali-post-date allows Stored XSS.This issue affects Nepali Post Date: from n/a through <= 5.1.1.

  Product

  Nepali Post Date

  Affected

  up to 5.1.1

  What to do

  Affects up to 5.1.1. Update Nepali Post Date to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025BBCode Deluxe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46479 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevynCJohnson BBCode Deluxe bbcode-deluxe allows DOM-Based XSS.This issue affects BBCode Deluxe: from n/a through <= 2020.08.01.2.

  Product

  BBCode Deluxe

  Affected

  up to 2020.08.01.2

  What to do

  Affects up to 2020.08.01.2. Update BBCode Deluxe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Dropdown Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46478 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaloha Dropdown Content dropdown-content allows Stored XSS.This issue affects Dropdown Content: from n/a through <= 1.0.2.

  Product

  Dropdown Content

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Dropdown Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025WP Customize Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46477 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Stored XSS.This issue affects WP Customize Login Page: from n/a through <= 1.6.5.

  Product

  WP Customize Login Page

  Affected

  up to 1.6.5

  What to do

  Affects up to 1.6.5. Update WP Customize Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Awesome Wp Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46476 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nayon46 Awesome Wp Image Gallery awesome-wp-image-gallery allows Stored XSS.This issue affects Awesome Wp Image Gallery: from n/a through <= 1.0.

  Product

  Awesome Wp Image Gallery

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Awesome Wp Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Able Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46475 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Dolson Able Player ableplayer allows DOM-Based XSS.This issue affects Able Player: from n/a through <= 1.2.1.

  Product

  Able Player

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Able Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Social Counter: Deserialization of Untrusted DataCVE-2025-46473 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Deserialization of Untrusted Data vulnerability in Prisna Social Counter social-counter allows Object Injection.This issue affects Social Counter: from n/a through <= 2.0.5.

  Product

  Social Counter

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update Social Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025The Pack Elementor addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46472 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through <= 2.1.6.

  Product

  The Pack Elementor addons

  Affected

  up to 2.1.6

  What to do

  Affects up to 2.1.6. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025WP Custom Post Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46471 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gnanavelshenll WP Custom Post Popup custom-post-popup allows DOM-Based XSS.This issue affects WP Custom Post Popup: from n/a through <= 1.0.1.

  Product

  WP Custom Post Popup

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update WP Custom Post Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Smart Hashtags [#hashtagger]: Missing AuthorizationCVE-2025-46470 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Peter Raschendorfer Smart Hashtags [#hashtagger] hashtagger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Hashtags [#hashtagger]: from n/a through <= 7.2.3.

  Product

  Smart Hashtags [#hashtagger]

  Affected

  up to 7.2.3

  What to do

  Affects up to 7.2.3. Update Smart Hashtags [#hashtagger] to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Send From: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46469 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Buddle Send From send-from allows Stored XSS.This issue affects Send From: from n/a through <= 2.2.

  Product

  Send From

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Send From to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025RAphicon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46467 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rahendra Putra K™ RAphicon raphicon allows DOM-Based XSS.This issue affects RAphicon: from n/a through <= 2.1.2.

  Product

  RAphicon

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update RAphicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Modern Polls: Cross-Site Request Forgery (CSRF)CVE-2025-46466 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in felixtz Modern Polls modern-polls allows Stored XSS.This issue affects Modern Polls: from n/a through <= 1.0.10.

  Product

  Modern Polls

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update Modern Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Print Science Designer: Cross-Site Request Forgery (CSRF)CVE-2025-46465 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in John Weissberg Print Science Designer print-science-designer allows Stored XSS.This issue affects Print Science Designer: from n/a through <= 1.3.155.

  Product

  Print Science Designer

  Affected

  up to 1.3.155

  What to do

  Affects up to 1.3.155. Update Print Science Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025WPVN: Cross-Site Request Forgery (CSRF)CVE-2025-46462 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Trân Minh-Quân WPVN wpvn-username-changer allows Cross Site Request Forgery.This issue affects WPVN: from n/a through <= 0.7.8.

  Product

  WPVN

  Affected

  up to 0.7.8

  What to do

  Affects up to 0.7.8. Update WPVN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025RRSSB: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46461 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Relentless Apps RRSSB rrssb allows DOM-Based XSS.This issue affects RRSSB: from n/a through <= 1.0.1.

  Product

  RRSSB

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update RRSSB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Confirm User Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46459 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ralf Hortt Confirm User Registration confirm-user-registration allows Stored XSS.This issue affects Confirm User Registration: from n/a through <= 2.1.5.

  Product

  Confirm User Registration

  Affected

  up to 2.1.5

  What to do

  Affects up to 2.1.5. Update Confirm User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Wp Custom CMS Block: Cross-Site Request Forgery (CSRF)CVE-2025-46457 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Ahsanullah Akanda Wp Custom CMS Block wp-custom-cms-block allows Stored XSS.This issue affects Wp Custom CMS Block: from n/a through <= 2.1.

  Product

  Wp Custom CMS Block

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Wp Custom CMS Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Zoho Creator Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46453 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreatorTeam Zoho Creator Forms allows Stored XSS. This issue affects Zoho Creator Forms: from n/a through 1.0.5.

  Product

  Zoho Creator Forms

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Zoho Creator Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Google News: Cross-Site Request Forgery (CSRF)CVE-2025-46452 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Olav Kolbu Google News allows Stored XSS. This issue affects Google News: from n/a through 2.5.1.

  Product

  Google News

  Affected

  up to 2.5.1

  What to do

  Affects up to 2.5.1. Update Google News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Floating Social Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46451 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Floating Social Bar floating-social-bar allows Stored XSS.This issue affects Floating Social Bar: from n/a through <= 1.1.7.

  Product

  Floating Social Bar

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update Floating Social Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025occupancyplan: Cross-Site Request Forgery (CSRF)CVE-2025-46450 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in x000x occupancyplan occupancyplan allows Stored XSS.This issue affects occupancyplan: from n/a through <= 1.0.3.0.

  Product

  occupancyplan

  Affected

  up to 1.0.3.0

  What to do

  Affects up to 1.0.3.0. Update occupancyplan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025WoWHead Tooltips: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46449 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Novium WoWHead Tooltips wowhead-tooltips allows Stored XSS.This issue affects WoWHead Tooltips: from n/a through <= 2.0.1.

  Product

  WoWHead Tooltips

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update WoWHead Tooltips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Fable Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46447 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFable Fable Extra fable-extra allows DOM-Based XSS.This issue affects Fable Extra: from n/a through <= 1.0.6.

  Product

  Fable Extra

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Fable Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025External Markdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46445 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pReya External Markdown external-markdown allows Stored XSS.This issue affects External Markdown: from n/a through <= 0.0.1.

  Product

  External Markdown

  Affected

  up to 0.0.1

  What to do

  Affects up to 0.0.1. Update External Markdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Animate: Server-Side Request Forgery (SSRF)CVE-2025-46443 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Server-Side Request Forgery (SSRF) vulnerability in Adam Pery Animate animate allows Server Side Request Forgery.This issue affects Animate: from n/a through <= 0.5.

  Product

  Animate

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update Animate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Loan Calculator: Cross-Site Request Forgery (CSRF)CVE-2025-46442 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Casey Johnson Loan Calculator repayment-calculator allows Stored XSS.This issue affects Loan Calculator: from n/a through <= 1.3.

  Product

  Loan Calculator

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Loan Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Plugin Central: Cross-Site Request Forgery (CSRF)CVE-2025-46439 · WordPress plugins & themes · reported by PatchstackHigh 7.4

  Cross-Site Request Forgery (CSRF) vulnerability in Vladimir Prelovac Plugin Central plugin-central allows Path Traversal.This issue affects Plugin Central: from n/a through <= 2.5.1.

  Product

  Plugin Central

  Affected

  up to 2.5.1

  What to do

  Affects up to 2.5.1. Update Plugin Central to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025GTDB Guitar Tuners: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46438 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in warmwhisky GTDB Guitar Tuners guitar-tuner allows Stored XSS.This issue affects GTDB Guitar Tuners: from n/a through <= 4.2.2.

  Product

  GTDB Guitar Tuners

  Affected

  up to 4.2.2

  What to do

  Affects up to 4.2.2. Update GTDB Guitar Tuners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025SCSS-Library: Cross-Site Request Forgery (CSRF)CVE-2025-46436 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Sebastian Echeverry SCSS-Library scss-library allows Cross Site Request Forgery.This issue affects SCSS-Library: from n/a through <= 0.4.1.

  Product

  SCSS-Library

  Affected

  up to 0.4.1

  What to do

  Affects up to 0.4.1. Update SCSS-Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Time Based Greeting: Cross-Site Request Forgery (CSRF)CVE-2025-46435 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Yash Binani Time Based Greeting time-based-greeting allows Stored XSS.This issue affects Time Based Greeting: from n/a through <= 2.2.2.

  Product

  Time Based Greeting

  Affected

  up to 2.2.2

  What to do

  Affects up to 2.2.2. Update Time Based Greeting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025PowerPress Podcasting: Unrestricted Upload of File with Dangerous TypeCVE-2025-46264 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Unrestricted Upload of File with Dangerous Type vulnerability in blubrry PowerPress Podcasting powerpress allows Upload a Web Shell to a Web Server.This issue affects PowerPress Podcasting: from n/a through <= 11.12.5.

  Product

  PowerPress Podcasting

  Affected

  up to 11.12.5

  What to do

  Affects up to 11.12.5. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Seriously Simple Podcasting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46261 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through <= 3.9.0.

  Product

  Seriously Simple Podcasting

  Affected

  up to 3.9.0

  What to do

  Affects up to 3.9.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Sky Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46260 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wowDevs Sky Addons for Elementor sky-elementor-addons allows Stored XSS.This issue affects Sky Addons for Elementor: from n/a through <= 3.0.1.

  Product

  Sky Addons for Elementor

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update Sky Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Frontend Dashboard: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-46248 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows SQL Injection.This issue affects Frontend Dashboard: from n/a through <= 2.2.5.

  Product

  Frontend Dashboard

  Affected

  up to 2.2.5

  What to do

  Affects up to 2.2.5. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Control Listings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46234 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Razib Control Listings control-listings allows Reflected XSS.This issue affects Control Listings: from n/a through <= 1.0.4.1.

  Product

  Control Listings

  Affected

  up to 1.0.4.1

  What to do

  Affects up to 1.0.4.1. Update Control Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Popup Builder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-46230 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GhozyLab Popup Builder easy-notify-lite allows PHP Local File Inclusion.This issue affects Popup Builder: from n/a through <= 1.1.35.

  Product

  Popup Builder

  Affected

  up to 1.1.35

  What to do

  Affects up to 1.1.35. Update Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025BruteGuard – Brute Force Login Protection: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39408 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress BruteGuard – Brute Force Login Protection bruteguard allows Reflected XSS.This issue affects BruteGuard – Brute Force Login Protection: from n/a through <= 0.1.4.

  Product

  BruteGuard – Brute Force Login Protection

  Affected

  up to 0.1.4

  What to do

  Affects up to 0.1.4. Update BruteGuard – Brute Force Login Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Sassy Social Share: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-39404 · WordPress plugins & themes · reported by PatchstackMedium 4.7

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Heateor Support Sassy Social Share sassy-social-share allows Phishing.This issue affects Sassy Social Share: from n/a through <= 3.3.73.

  Product

  Sassy Social Share

  Affected

  up to 3.3.73

  What to do

  Affects up to 3.3.73. Update Sassy Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025User Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39400 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Reflected XSS.This issue affects User Registration: from n/a through < 4.2.0.

  Product

  User Registration

  What to do

  Update User Registration to the newest version.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.