Vulnerability database

5,817 results · page 38 of 117

• Jun 6, 2025AppBanners: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30625 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Pramschufer AppBanners appbanners allows Stored XSS.This issue affects AppBanners: from n/a through <= 1.5.14.

  Product

  AppBanners

  Affected

  up to 1.5.14

  What to do

  Affects up to 1.5.14. Update AppBanners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025YouTube Simple Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-29011 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CHR Designer YouTube Simple Gallery youtube-simple-gallery allows Stored XSS.This issue affects YouTube Simple Gallery: from n/a through <= 2.2.0.

  Product

  YouTube Simple Gallery

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update YouTube Simple Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025The Holiday Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-29003 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mva7 The Holiday Calendar the-holiday-calendar allows Stored XSS.This issue affects The Holiday Calendar: from n/a through <= 1.18.2.1.

  Product

  The Holiday Calendar

  Affected

  up to 1.18.2.1

  What to do

  Affects up to 1.18.2.1. Update The Holiday Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Read More Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28989 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arildur Read More Login read-more-login allows Stored XSS.This issue affects Read More Login: from n/a through <= 2.0.3.

  Product

  Read More Login

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update Read More Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Simple Google Static Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27334 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ángel C. Simple Google Static Map simple-google-static-map allows DOM-Based XSS.This issue affects Simple Google Static Map: from n/a through <= 1.0.1.

  Product

  Simple Google Static Map

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Simple Google Static Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Next Event Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-26001 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marchetti Design Next Event Calendar allows Stored XSS. This issue affects Next Event Calendar: from n/a through 1.2.

  Product

  Next Event Calendar

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Next Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Bang tinh vay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-26000 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hanhdo205 Bang tinh vay allows Stored XSS. This issue affects Bang tinh vay: from n/a through 1.0.1.

  Product

  Bang tinh vay

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Bang tinh vay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025The Plus Addons for Elementor Page Builder Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49076 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 6.2.7.

  Product

  The Plus Addons for Elementor Page Builder Lite

  Affected

  up to 6.2.7

  What to do

  Affects up to 6.2.7. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49075 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Wishlist wishlist allows Stored XSS.This issue affects Wishlist: from n/a through <= 1.0.43.

  Product

  Wishlist

  Affected

  up to 1.0.43

  What to do

  Affects up to 1.0.43. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WidgetKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49074 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abu Huraira Bin Aman WidgetKit widgetkit-for-elementor allows Stored XSS.This issue affects WidgetKit: from n/a through <= 2.5.4.

  Product

  WidgetKit

  Affected

  up to 2.5.4

  What to do

  Affects up to 2.5.4. Update WidgetKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Ocean Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49068 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oceanwp Ocean Extra ocean-extra allows Stored XSS.This issue affects Ocean Extra: from n/a through <= 2.4.8.

  Product

  Ocean Extra

  Affected

  up to 2.4.8

  What to do

  Affects up to 2.4.8. Update Ocean Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Nasa Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49067 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Nasa Core nasa-core allows Stored XSS.This issue affects Nasa Core: from n/a through < 6.4.1.

  Product

  Nasa Core

  What to do

  Update Nasa Core to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Real Time Validation for Gravity Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48329 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows Reflected XSS.This issue affects Real Time Validation for Gravity Forms: from n/a through <= 1.7.0.

  Product

  Real Time Validation for Gravity Forms

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update Real Time Validation for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 2, 2025WP-Optimize: Does not properly escape user inputCVE-2025-3951 · WordPress plugins & themes · reported by WPScanMedium 4.1

  The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could allow users with the administrator role to conduct SQL Injection attacks in the context of Multi-Site WordPress configurations.

  Product

  WP-Optimize

  Fixed in

  4.2.0

  What to do

  Update WP-Optimize to 4.2.0 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 27, 2025Volunteer Sign Up Sheets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-3704 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DBAR Productions Volunteer Sign Up Sheets pta-volunteer-sign-up-sheets allows Stored XSS.This issue affects Volunteer Sign Up Sheets: from n/a through < 5.5.5.

  Product

  Volunteer Sign Up Sheets

  What to do

  Update Volunteer Sign Up Sheets to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025ReDi Restaurant Reservation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48286 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catkin ReDi Restaurant Reservation redi-restaurant-reservation allows Reflected XSS.This issue affects ReDi Restaurant Reservation: from n/a through <= 24.1209.

  Product

  ReDi Restaurant Reservation

  Affected

  up to 24.1209

  What to do

  Affects up to 24.1209. Update ReDi Restaurant Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Quick Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48245 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal Quick Contact Form quick-contact-form allows Reflected XSS.This issue affects Quick Contact Form: from n/a through <= 8.2.1.

  Product

  Quick Contact Form

  Affected

  up to 8.2.1

  What to do

  Affects up to 8.2.1. Update Quick Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Verge3D: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48241 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D verge3d allows Reflected XSS.This issue affects Verge3D: from n/a through <= 4.9.3.

  Product

  Verge3D

  Affected

  up to 4.9.3

  What to do

  Affects up to 4.9.3. Update Verge3D to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025xili-tidy-tags: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47680 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-tidy-tags xili-tidy-tags allows Reflected XSS.This issue affects xili-tidy-tags: from n/a through <= 1.12.06.

  Product

  xili-tidy-tags

  Affected

  up to 1.12.06

  What to do

  Affects up to 1.12.06. Update xili-tidy-tags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025FunnelCockpit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47678 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelCockpit FunnelCockpit funnelcockpit allows Reflected XSS.This issue affects FunnelCockpit: from n/a through <= 1.4.3.

  Product

  FunnelCockpit

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update FunnelCockpit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Arconix Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47673 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Reflected XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.16.

  Product

  Arconix Shortcodes

  Affected

  up to 2.1.16

  What to do

  Affects up to 2.1.16. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025BMI Adult & Kid Calculator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47618 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mortgage Calculator BMI Adult & Kid Calculator bmi-adultkid-calculator allows Reflected XSS.This issue affects BMI Adult & Kid Calculator: from n/a through <= 1.2.2.

  Product

  BMI Adult & Kid Calculator

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update BMI Adult & Kid Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025School Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47613 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla School Management allows Reflected XSS. This issue affects School Management: from n/a through 92.0.0.

  Product

  School Management

  Affected

  up to 92.0.0

  What to do

  Affects up to 92.0.0. Update School Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025User Meta: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47611 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Khaled User Meta user-meta allows Reflected XSS.This issue affects User Meta: from n/a through <= 3.1.2.

  Product

  User Meta

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update User Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025CoinPayments.net Payment Gateway for WooCommerce: Deserialization of Untrusted DataCVE-2025-47532 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Deserialization of Untrusted Data vulnerability in CoinPayments CoinPayments.net Payment Gateway for WooCommerce coinpayments-payment-gateway-for-woocommerce allows Object Injection.This issue affects CoinPayments.net Payment Gateway for WooCommerce: from n/a through <= 1.0.17.

  Product

  CoinPayments.net Payment Gateway for WooCommerce

  Affected

  up to 1.0.17

  What to do

  Affects up to 1.0.17. Update CoinPayments.net Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025B2i Investor Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47458 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in B2itech B2i Investor Tools b2i-investor-tools allows Reflected XSS.This issue affects B2i Investor Tools: from n/a through <= 1.0.7.9.

  Product

  B2i Investor Tools

  Affected

  up to 1.0.7.9

  What to do

  Affects up to 1.0.7.9. Update B2i Investor Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Section Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46537 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ctltwp Section Widget section-widget allows Reflected XSS.This issue affects Section Widget: from n/a through <= 3.3.1.

  Product

  Section Widget

  Affected

  up to 3.3.1

  What to do

  Affects up to 3.3.1. Update Section Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025My Custom Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46526 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in janekniefeldt My Custom Widgets mycustomwidget allows Reflected XSS.This issue affects My Custom Widgets: from n/a through <= 2.0.5.

  Product

  My Custom Widgets

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update My Custom Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025IGIT Related Posts With Thumb Image After Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46518 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phpaddicted IGIT Related Posts With Thumb Image After Posts igit-related-posts-with-thumb-images-after-posts allows Stored XSS.This issue affects IGIT Related Posts With Thumb Image After Posts: from n/a through <= 4.5.3.

  Product

  IGIT Related Posts With Thumb Image After Posts

  Affected

  up to 4.5.3

  What to do

  Affects up to 4.5.3. Update IGIT Related Posts With Thumb Image After Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Category Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46515 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Category Widget category-widget allows Reflected XSS.This issue affects Category Widget: from n/a through <= 2.0.2.

  Product

  Category Widget

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update Category Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Crossword Compiler Puzzles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46493 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordwebsoftware Crossword Compiler Puzzles crossword-compiler-puzzles allows Stored XSS.This issue affects Crossword Compiler Puzzles: from n/a through <= 14.5.

  Product

  Crossword Compiler Puzzles

  Affected

  up to 14.5

  What to do

  Affects up to 14.5. Update Crossword Compiler Puzzles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025EC Authorize.net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46487 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sftranna EC Authorize.net ec-authorizenet allows Reflected XSS.This issue affects EC Authorize.net: from n/a through <= 0.3.3.

  Product

  EC Authorize.net

  Affected

  up to 0.3.3

  What to do

  Affects up to 0.3.3. Update EC Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Theme Blvd Sliders: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46456 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Theme Blvd Sliders theme-blvd-sliders allows Reflected XSS.This issue affects Theme Blvd Sliders: from n/a through <= 1.2.5.

  Product

  Theme Blvd Sliders

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Theme Blvd Sliders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Document Management System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46448 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reifsnyderb Document Management System dms allows Reflected XSS.This issue affects Document Management System: from n/a through <= 1.24.

  Product

  Document Management System

  Affected

  up to 1.24

  What to do

  Affects up to 1.24. Update Document Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Libro de Reclamaciones: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46446 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ivanrojas Libro de Reclamaciones libro-de-reclamaciones allows Stored XSS.This issue affects Libro de Reclamaciones: from n/a through <= 1.0.1.

  Product

  Libro de Reclamaciones

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Libro de Reclamaciones to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025kStats Reloaded: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46440 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark kStats Reloaded kstats-reloaded allows Reflected XSS.This issue affects kStats Reloaded: from n/a through <= 0.7.4.

  Product

  kStats Reloaded

  Affected

  up to 0.7.4

  What to do

  Affects up to 0.7.4. Update kStats Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Tayori Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46437 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tayoricom Tayori Form tayori allows Reflected XSS.This issue affects Tayori Form: from n/a through <= 1.2.9.

  Product

  Tayori Form

  Affected

  up to 1.2.9

  What to do

  Affects up to 1.2.9. Update Tayori Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Goodlayers Hotel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39505 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Reflected XSS.This issue affects Goodlayers Hotel: from n/a through <= 3.1.4.

  Product

  Goodlayers Hotel

  Affected

  up to 3.1.4

  What to do

  Affects up to 3.1.4. Update Goodlayers Hotel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Goodlayers Hostel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39502 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Reflected XSS.This issue affects Goodlayers Hostel: from n/a through <= 3.1.2.

  Product

  Goodlayers Hostel

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update Goodlayers Hostel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Butcher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32285 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ApusTheme Butcher butcher allows Reflected XSS.This issue affects Butcher: from n/a through < 2.54.

  Product

  Butcher

  What to do

  Update Butcher to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025WP Post Modules for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31636 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SaurabhSharma WP Post Modules for Elementor wp-post-modules-el allows Reflected XSS.This issue affects WP Post Modules for Elementor: from n/a through <= 2.5.0.

  Product

  WP Post Modules for Elementor

  Affected

  up to 2.5.0

  What to do

  Affects up to 2.5.0. Update WP Post Modules for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Hospital Management System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39393 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla Hospital Management System hospital-management allows Reflected XSS.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-2023).

  Product

  Hospital Management System

  Affected

  up to 47.0

  What to do

  Affects up to 47.0. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WPAMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39392 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPAMS apartment-management allows Reflected XSS.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).

  Product

  WPAMS

  Affected

  up to 44.0

  What to do

  Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WordPress Events Calendar Registration & Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39372 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Reflected XSS.This issue affects WordPress Events Calendar Registration & Tickets: from n/a through <= 2.6.0.

  Product

  WordPress Events Calendar Registration & Tickets

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update WordPress Events Calendar Registration & Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025wProject: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39365 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rocket Apps wProject allows Reflected XSS.This issue affects wProject: from n/a before 5.8.0.

  Product

  wProject

  Fixed in

  5.8.0

  What to do

  Update wProject to 5.8.0 or newer.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Tiger: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31027 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jocoxdesign Tiger tiger allows Reflected XSS.This issue affects Tiger: from n/a through 2.0.

  Product

  Tiger

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Tiger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025BP Messages Tool: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43839 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Messages Tool bp-messages-tool allows Reflected XSS.This issue affects BP Messages Tool: from n/a through <= 2.2.

  Product

  BP Messages Tool

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update BP Messages Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Total Donations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43837 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in binti76 Total Donations total-donations allows Reflected XSS.This issue affects Total Donations: from n/a through <= 3.0.8.

  Product

  Total Donations

  Affected

  up to 3.0.8

  What to do

  Affects up to 3.0.8. Update Total Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Syndicate Out: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43836 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in confuzzledduck Syndicate Out syndicate-out allows Reflected XSS.This issue affects Syndicate Out: from n/a through <= 0.9.

  Product

  Syndicate Out

  Affected

  up to 0.9

  What to do

  Affects up to 0.9. Update Syndicate Out to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Remote Images Grabber: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43832 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andreyk Remote Images Grabber remote-images-grabber allows Reflected XSS.This issue affects Remote Images Grabber: from n/a through <= 0.6.

  Product

  Remote Images Grabber

  Affected

  up to 0.6

  What to do

  Affects up to 0.6. Update Remote Images Grabber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.