Vulnerability database

5,852 results · page 39 of 118

• Jun 9, 2025WP Email Delivery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39539 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brewlabs WP Email Delivery wp-email-delivery allows Reflected XSS.This issue affects WP Email Delivery: from n/a through <= 1.20.11.23.

  Product

  WP Email Delivery

  Affected

  up to 1.20.11.23

  What to do

  Affects up to 1.20.11.23. Update WP Email Delivery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025WordPress FlatNews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32305 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sneeit WordPress FlatNews Theme flatnews allows Reflected XSS.This issue affects WordPress FlatNews Theme: from n/a through <= 5.8.

  Product

  WordPress FlatNews

  Affected

  up to 5.8

  What to do

  Affects up to 5.8. Update WordPress FlatNews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025SHOUT: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31925 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup SHOUT lbg-audio8-html5-radio_ads allows Reflected XSS.This issue affects SHOUT: from n/a through <= 3.5.3.

  Product

  SHOUT

  Affected

  up to 3.5.3

  What to do

  Affects up to 3.5.3. Update SHOUT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025Universal Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31917 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player universal_video_player allows Reflected XSS.This issue affects Universal Video Player: from n/a through <= 3.8.3.

  Product

  Universal Video Player

  Affected

  up to 3.8.3

  What to do

  Affects up to 3.8.3. Update Universal Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025Spare: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31638 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeton Spare allows Reflected XSS. This issue affects Spare: from n/a through 1.7.

  Product

  Spare

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Spare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025Sticky Radio Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31426 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutcast_sticky allows Reflected XSS.This issue affects Sticky Radio Player: from n/a through <= 3.4.

  Product

  Sticky Radio Player

  Affected

  up to 3.4

  What to do

  Affects up to 3.4. Update Sticky Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025WP Lead Capturing Pages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31424 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through < 2.6.

  Product

  WP Lead Capturing Pages

  What to do

  Update WP Lead Capturing Pages to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31061 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redqteam Wishlist wishlist allows Reflected XSS.This issue affects Wishlist: from n/a through <= 2.1.0.

  Product

  Wishlist

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025Revolution Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31058 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Revolution Video Player revolution_video_player allows Reflected XSS.This issue affects Revolution Video Player: from n/a through <= 2.9.2.

  Product

  Revolution Video Player

  Affected

  up to 2.9.2

  What to do

  Affects up to 2.9.2. Update Revolution Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025Universal Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31057 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player elementor_widget_universal_video_player allows Reflected XSS.This issue affects Universal Video Player: from n/a through <= 1.4.0.

  Product

  Universal Video Player

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Universal Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 7, 2025Social Sharing Plugin – Sassy Social Share: Reflected Cross-Site ScriptingCVE-2025-5528 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in all versions up to, and including, 3.3.75 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action, such as clicking on a link.

  Product

  Social Sharing Plugin – Sassy Social Share

  Affected

  up to 3.3.75

  What to do

  Affects up to 3.3.75. Update Social Sharing Plugin – Sassy Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jun 6, 2025SEPA Girocode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49450 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mhallmann SEPA Girocode sepa-girocode allows Stored XSS.This issue affects SEPA Girocode: from n/a through <= 0.5.1.

  Product

  SEPA Girocode

  Affected

  up to 0.5.1

  What to do

  Affects up to 0.5.1. Update SEPA Girocode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Bacon Ipsum: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49443 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris McCoy Bacon Ipsum bacon-ipsum allows Stored XSS.This issue affects Bacon Ipsum: from n/a through <= 2.4.

  Product

  Bacon Ipsum

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update Bacon Ipsum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Simple Nested Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49442 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mostafa Shahiri Simple Nested Menu simple-nested-menu allows Stored XSS.This issue affects Simple Nested Menu: from n/a through <= 1.0.

  Product

  Simple Nested Menu

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Simple Nested Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Video Embeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49429 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Burnette Video Embeds video-embeds allows Stored XSS.This issue affects Video Embeds: from n/a through <= 0.1.1.

  Product

  Video Embeds

  Affected

  up to 0.1.1

  What to do

  Affects up to 0.1.1. Update Video Embeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Abbie Expander: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49427 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Burnette Abbie Expander abbie-expander allows Stored XSS.This issue affects Abbie Expander: from n/a through <= 1.0.1.

  Product

  Abbie Expander

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Abbie Expander to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Simple Membership: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49333 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership simple-membership allows Stored XSS.This issue affects Simple Membership: from n/a through <= 4.6.3.

  Product

  Simple Membership

  Affected

  up to 4.6.3

  What to do

  Affects up to 4.6.3. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025404 Page by SeedProd: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49322 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeedProd 404 Page by SeedProd allows Stored XSS. This issue affects 404 Page by SeedProd: from n/a through n/a.

  Product

  404 Page by SeedProd

  What to do

  Update 404 Page by SeedProd to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WPtouch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49318 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPtouch WPtouch wptouch allows Stored XSS.This issue affects WPtouch: from n/a through <= 4.3.60.

  Product

  WPtouch

  Affected

  up to 4.3.60

  What to do

  Affects up to 4.3.60. Update WPtouch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025BRW: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49314 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ovatheme BRW ova-brw allows Stored XSS.This issue affects BRW: from n/a through <= 1.8.6.

  Product

  BRW

  Affected

  up to 1.8.6

  What to do

  Affects up to 1.8.6. Update BRW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025The Events Calendar Countdown Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49311 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CoolHappy The Events Calendar Countdown Addon countdown-for-the-events-calendar allows Stored XSS.This issue affects The Events Calendar Countdown Addon: from n/a through <= 1.4.9.

  Product

  The Events Calendar Countdown Addon

  Affected

  up to 1.4.9

  What to do

  Affects up to 1.4.9. Update The Events Calendar Countdown Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Frontend Dashboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49310 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Stored XSS.This issue affects Frontend Dashboard: from n/a through <= 2.2.8.

  Product

  Frontend Dashboard

  Affected

  up to 2.2.8

  What to do

  Affects up to 2.2.8. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025HT Team Member: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49309 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Team Member ht-team-member allows Stored XSS.This issue affects HT Team Member: from n/a through <= 1.1.7.

  Product

  HT Team Member

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update HT Team Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WP Social Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49306 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through <= 2.3.

  Product

  WP Social Widget

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update WP Social Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Product Catalog Simple: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49305 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode Product Catalog Simple post-type-x allows Stored XSS.This issue affects Product Catalog Simple: from n/a through <= 1.8.1.

  Product

  Product Catalog Simple

  Affected

  up to 1.8.1

  What to do

  Affects up to 1.8.1. Update Product Catalog Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Search with Typesense: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49304 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeManas Search with Typesense search-with-typesense allows Stored XSS.This issue affects Search with Typesense: from n/a through <= 2.0.10.

  Product

  Search with Typesense

  Affected

  up to 2.0.10

  What to do

  Affects up to 2.0.10. Update Search with Typesense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Greenshift: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49301 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows DOM-Based XSS.This issue affects Greenshift: from n/a through <= 11.5.5.

  Product

  Greenshift

  Affected

  up to 11.5.5

  What to do

  Affects up to 11.5.5. Update Greenshift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WebHotelier: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49299 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPlugged.com WebHotelier webhotelier allows Stored XSS.This issue affects WebHotelier: from n/a through <= 1.9.2.

  Product

  WebHotelier

  Affected

  up to 1.9.2

  What to do

  Affects up to 1.9.2. Update WebHotelier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49298 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This issue affects Event post: from n/a through <= 5.10.1.

  Product

  Event post

  Affected

  up to 5.10.1

  What to do

  Affects up to 5.10.1. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Sina Extension for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49262 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shaonsina Sina Extension for Elementor sina-extension-for-elementor allows Stored XSS.This issue affects Sina Extension for Elementor: from n/a through <= 3.6.1.

  Product

  Sina Extension for Elementor

  Affected

  up to 3.6.1

  What to do

  Affects up to 3.6.1. Update Sina Extension for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Shortcodes Ultimate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49244 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vova Shortcodes Ultimate shortcodes-ultimate allows Stored XSS.This issue affects Shortcodes Ultimate: from n/a through <= 7.3.5.

  Product

  Shortcodes Ultimate

  Affected

  up to 7.3.5

  What to do

  Affects up to 7.3.5. Update Shortcodes Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025ShiftNav – Responsive Mobile Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49243 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark ShiftNav – Responsive Mobile Menu shiftnav-responsive-mobile-menu allows Stored XSS.This issue affects ShiftNav – Responsive Mobile Menu: from n/a through <= 1.8.

  Product

  ShiftNav – Responsive Mobile Menu

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update ShiftNav – Responsive Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Bellows Accordion Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49242 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark Bellows Accordion Menu bellows-accordion-menu allows Stored XSS.This issue affects Bellows Accordion Menu: from n/a through <= 1.4.3.

  Product

  Bellows Accordion Menu

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update Bellows Accordion Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025RTMKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49235 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit rometheme-for-elementor allows Stored XSS.This issue affects RTMKit: from n/a through <= 1.6.0.

  Product

  RTMKit

  Affected

  up to 1.6.0

  What to do

  Affects up to 1.6.0. Update RTMKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Image Hover Effects Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31025 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blocksera Image Hover Effects Block image-hover-effects-block allows Stored XSS.This issue affects Image Hover Effects Block: from n/a through <= 1.4.5.

  Product

  Image Hover Effects Block

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update Image Hover Effects Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WPDM – Premium Packages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30991 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Stored XSS.This issue affects WPDM – Premium Packages: from n/a through <= 6.0.6.

  Product

  WPDM – Premium Packages

  Affected

  up to 6.0.6

  What to do

  Affects up to 6.0.6. Update WPDM – Premium Packages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Chaport: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30977 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chaport Live Chat Chaport chaport allows Stored XSS.This issue affects Chaport: from n/a through <= 1.1.6.

  Product

  Chaport

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Chaport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Nexa Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30952 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdive Nexa Blocks nexa-blocks allows Stored XSS.This issue affects Nexa Blocks: from n/a through <= 1.1.0.

  Product

  Nexa Blocks

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Nexa Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025BlockStrap Page Builder - Bootstrap Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30951 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Stored XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a through <= 0.1.36.

  Product

  BlockStrap Page Builder - Bootstrap Blocks

  Affected

  up to 0.1.36

  What to do

  Affects up to 0.1.36. Update BlockStrap Page Builder - Bootstrap Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025All Currencies for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30950 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham All Currencies for WooCommerce woocommerce-all-currencies allows Stored XSS.This issue affects All Currencies for WooCommerce: from n/a through <= 2.4.3.

  Product

  All Currencies for WooCommerce

  Affected

  up to 2.4.3

  What to do

  Affects up to 2.4.3. Update All Currencies for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Post Custom Templates Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30942 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Post Custom Templates Lite post-custom-templates-lite allows Stored XSS.This issue affects Post Custom Templates Lite: from n/a through <= 1.14.

  Product

  Post Custom Templates Lite

  Affected

  up to 1.14

  What to do

  Affects up to 1.14. Update Post Custom Templates Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Pinterest Verify Meta Tag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30941 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marvie Pons Pinterest Verify Meta Tag pinterest-verify-meta-tag allows Stored XSS.This issue affects Pinterest Verify Meta Tag: from n/a through <= 1.3.

  Product

  Pinterest Verify Meta Tag

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Pinterest Verify Meta Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Melipayamak: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30940 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in melipayamak Melipayamak melipayamak allows Stored XSS.This issue affects Melipayamak: from n/a through <= 2.2.12.

  Product

  Melipayamak

  Affected

  up to 2.2.12

  What to do

  Affects up to 2.2.12. Update Melipayamak to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025IFrame Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30939 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debashish IFrame Widget iframe-widget allows Stored XSS.This issue affects IFrame Widget: from n/a through <= 4.1.

  Product

  IFrame Widget

  Affected

  up to 4.1

  What to do

  Affects up to 4.1. Update IFrame Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Broadly for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30938 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in broadly Broadly for WordPress broadly allows Stored XSS.This issue affects Broadly for WordPress: from n/a through <= 3.0.2.

  Product

  Broadly for

  Affected

  up to 3.0.2

  What to do

  Affects up to 3.0.2. Update Broadly for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Responsify WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30937 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stefanledin Responsify WP responsify-wp allows Stored XSS.This issue affects Responsify WP: from n/a through <= 1.9.11.

  Product

  Responsify WP

  Affected

  up to 1.9.11

  What to do

  Affects up to 1.9.11. Update Responsify WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30935 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NickDuncan Contact Form contact-form-ready allows DOM-Based XSS.This issue affects Contact Form: from n/a through <= 2.0.12.

  Product

  Contact Form

  Affected

  up to 2.0.12

  What to do

  Affects up to 2.0.12. Update Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025«Подсказки» от DaData.ru: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30931 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamil Shafeev «Подсказки» от DaData.ru dadata-ru allows Stored XSS.This issue affects «Подсказки» от DaData.ru: from n/a through <= 1.0.6.

  Product

  «Подсказки» от DaData.ru

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update «Подсказки» от DaData.ru to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025ACF: Yandex Maps Field: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30930 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unreal Themes ACF: Yandex Maps Field acf-yandex-maps-field allows Stored XSS.This issue affects ACF: Yandex Maps Field: from n/a through <= 1.1.

  Product

  ACF: Yandex Maps Field

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update ACF: Yandex Maps Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WP Biographia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30928 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vicchi WP Biographia wp-biographia allows Stored XSS.This issue affects WP Biographia: from n/a through <= 4.0.0.

  Product

  WP Biographia

  Affected

  up to 4.0.0

  What to do

  Affects up to 4.0.0. Update WP Biographia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.