Vulnerability database

41,587 results · page 403 of 832

• Mar 24, 2025Translator: Cross-Site Request Forgery (CSRF)CVE-2025-30621 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in kornelly Translator translator allows Stored XSS.This issue affects Translator: from n/a through <= 0.3.

  Product

  Translator

  Affected

  up to 0.3

  What to do

  Affects up to 0.3. Update Translator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WP Odoo Form Integrator: Cross-Site Request Forgery (CSRF)CVE-2025-30620 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in coderscom WP Odoo Form Integrator wp-odoo-form-integrator allows Stored XSS.This issue affects WP Odoo Form Integrator: from n/a through <= 1.1.0.

  Product

  WP Odoo Form Integrator

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update WP Odoo Form Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025SpeakPipe: Cross-Site Request Forgery (CSRF)CVE-2025-30619 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in SpeakPipe SpeakPipe speakpipe-voicemail-for-websites allows Cross Site Request Forgery.This issue affects SpeakPipe: from n/a through <= 0.2.

  Product

  SpeakPipe

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update SpeakPipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Rewrite: Cross-Site Request Forgery (CSRF)CVE-2025-30617 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in takien Rewrite rewrite allows Cross Site Request Forgery.This issue affects Rewrite: from n/a through <= 0.2.1.

  Product

  Rewrite

  Affected

  up to 0.2.1

  What to do

  Affects up to 0.2.1. Update Rewrite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WP e-Commerce Style Email: Cross-Site Request Forgery (CSRF)CVE-2025-30615 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Code Injection.This issue affects WP e-Commerce Style Email: from n/a through <= 0.6.2.

  Product

  WP e-Commerce Style Email

  Affected

  up to 0.6.2

  What to do

  Affects up to 0.6.2. Update WP e-Commerce Style Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Replace Default Words: Cross-Site Request Forgery (CSRF)CVE-2025-30612 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mandegarweb Replace Default Words replace-default-words allows Stored XSS.This issue affects Replace Default Words: from n/a through <= 1.3.

  Product

  Replace Default Words

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Replace Default Words to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WP Social Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30610 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through <= 2.2.7.

  Product

  WP Social Widget

  Affected

  up to 2.2.7

  What to do

  Affects up to 2.2.7. Update WP Social Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025AppExperts: Insertion of Sensitive Information Into Sent DataCVE-2025-30609 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal AppExperts appexperts allows Retrieve Embedded Sensitive Data.This issue affects AppExperts: from n/a through <= 1.4.3.

  Product

  AppExperts

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update AppExperts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WordPress SQL Backup: Cross-Site Request Forgery (CSRF)CVE-2025-30608 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Anthony WordPress SQL Backup wordpress-sql-backup allows Stored XSS.This issue affects WordPress SQL Backup: from n/a through <= 3.5.2.

  Product

  WordPress SQL Backup

  Affected

  up to 3.5.2

  What to do

  Affects up to 3.5.2. Update WordPress SQL Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Easy Page Transition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30606 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Logan Carlile Easy Page Transition easy-page-transition allows Stored XSS.This issue affects Easy Page Transition: from n/a through <= 1.0.1.

  Product

  Easy Page Transition

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Easy Page Transition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025sourceplay-navermap: Missing AuthorizationCVE-2025-30605 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in ldwin79 sourceplay-navermap sourceplay-navermap allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects sourceplay-navermap: from n/a through <= 0.0.2.

  Product

  sourceplay-navermap

  Affected

  up to 0.0.2

  What to do

  Affects up to 0.0.2. Update sourceplay-navermap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025JiangQie Official Website Mini Program: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30604 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jiangqie JiangQie Official Website Mini Program jiangqie-official-website-mini-program allows Blind SQL Injection.This issue affects JiangQie Official Website Mini Program: from n/a through <= 1.8.2.

  Product

  JiangQie Official Website Mini Program

  Affected

  up to 1.8.2

  What to do

  Affects up to 1.8.2. Update JiangQie Official Website Mini Program to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025CopyLink: Cross-Site Request Forgery (CSRF)CVE-2025-30603 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in DEJAN CopyLink copy-link allows Stored XSS.This issue affects CopyLink: from n/a through <= 1.1.

  Product

  CopyLink

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update CopyLink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Related Posts via Categories: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30602 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alphasis Related Posts via Categories related-posts-via-categories allows Stored XSS.This issue affects Related Posts via Categories: from n/a through <= 2.1.2.

  Product

  Related Posts via Categories

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Related Posts via Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Flipdish Ordering System: Cross-Site Request Forgery (CSRF)CVE-2025-30601 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in flipdish Flipdish Ordering System flipdish-ordering-system allows Cross Site Request Forgery.This issue affects Flipdish Ordering System: from n/a through <= 1.5.2.

  Product

  Flipdish Ordering System

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update Flipdish Ordering System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WP Hotjar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30600 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thiagogsrwp WP Hotjar wp-hotjar allows Stored XSS.This issue affects WP Hotjar: from n/a through <= 0.0.3.

  Product

  WP Hotjar

  Affected

  up to 0.0.3

  What to do

  Affects up to 0.0.3. Update WP Hotjar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WP Parallax Content Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30599 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp-maverick WP Parallax Content Slider wp-parallax-content-slider allows Stored XSS.This issue affects WP Parallax Content Slider: from n/a through <= 0.9.8.

  Product

  WP Parallax Content Slider

  Affected

  up to 0.9.8

  What to do

  Affects up to 0.9.8. Update WP Parallax Content Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025OSS Upload: Cross-Site Request Forgery (CSRF)CVE-2025-30598 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Link OSS Upload oss-upload allows Cross Site Request Forgery.This issue affects OSS Upload: from n/a through <= 4.8.9.

  Product

  OSS Upload

  Affected

  up to 4.8.9

  What to do

  Affects up to 4.8.9. Update OSS Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025IG Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30597 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iografica IG Shortcodes ig-shortcodes allows DOM-Based XSS.This issue affects IG Shortcodes: from n/a through <= 3.1.

  Product

  IG Shortcodes

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update IG Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025include-file: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30595 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tstafford include-file include-file allows Stored XSS.This issue affects include-file: from n/a through <= 1.

  Product

  include-file

  Affected

  up to 1

  What to do

  Affects up to 1. Update include-file to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Include URL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30593 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in samsk Include URL include-url allows Stored XSS.This issue affects Include URL: from n/a through <= 0.3.5.

  Product

  Include URL

  Affected

  up to 0.3.5

  What to do

  Affects up to 0.3.5. Update Include URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Advanced Dewplayer: Missing AuthorizationCVE-2025-30592 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WesternDeal Advanced Dewplayer advanced-dewplayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Dewplayer: from n/a through <= 1.6.

  Product

  Advanced Dewplayer

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Advanced Dewplayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Music Press Pro: Missing AuthorizationCVE-2025-30591 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in tuyennv Music Press Pro music-press-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Music Press Pro: from n/a through <= 1.4.6.

  Product

  Music Press Pro

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update Music Press Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Flickr set slideshows: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30590 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dourou Flickr set slideshows flickr-set-slideshows allows SQL Injection.This issue affects Flickr set slideshows: from n/a through <= 0.9.

  Product

  Flickr set slideshows

  Affected

  up to 0.9

  What to do

  Affects up to 0.9. Update Flickr set slideshows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Map Contact: Cross-Site Request Forgery (CSRF)CVE-2025-30588 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ryan_xantoo Map Contact map-contact allows Stored XSS.This issue affects Map Contact: from n/a through <= 3.0.4.

  Product

  Map Contact

  Affected

  up to 3.0.4

  What to do

  Affects up to 3.0.4. Update Map Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025LH OGP Meta: Cross-Site Request Forgery (CSRF)CVE-2025-30587 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in shawfactor LH OGP Meta lh-ogp-meta-tags allows Stored XSS.This issue affects LH OGP Meta: from n/a through <= 1.73.

  Product

  LH OGP Meta

  Affected

  up to 1.73

  What to do

  Affects up to 1.73. Update LH OGP Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025cTabs: Cross-Site Request Forgery (CSRF)CVE-2025-30586 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in bbodine1 cTabs ctabs allows Stored XSS.This issue affects cTabs: from n/a through <= 1.3.

  Product

  cTabs

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update cTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Generate Post Thumbnails: Cross-Site Request Forgery (CSRF)CVE-2025-30585 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in marynixie Generate Post Thumbnails generate-post-thumbnails allows Cross Site Request Forgery.This issue affects Generate Post Thumbnails: from n/a through <= 0.8.

  Product

  Generate Post Thumbnails

  Affected

  up to 0.8

  What to do

  Affects up to 0.8. Update Generate Post Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025AlphaOmega Captcha & Anti-Spam Filter: Cross-Site Request Forgery (CSRF)CVE-2025-30584 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in alphaomegaplugins AlphaOmega Captcha & Anti-Spam Filter alphaomega-captcha-anti-spam allows Stored XSS.This issue affects AlphaOmega Captcha & Anti-Spam Filter: from n/a through <= 3.3.

  Product

  AlphaOmega Captcha & Anti-Spam Filter

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update AlphaOmega Captcha & Anti-Spam Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Pro Rank Tracker: Cross-Site Request Forgery (CSRF)CVE-2025-30583 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ProRankTracker Pro Rank Tracker proranktracker allows Stored XSS.This issue affects Pro Rank Tracker: from n/a through <= 1.0.0.

  Product

  Pro Rank Tracker

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Pro Rank Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Top Bar: Missing AuthorizationCVE-2025-30581 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in PluginOps Top Bar ultimate-bar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Top Bar: from n/a through <= 3.3.

  Product

  Top Bar

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update Top Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025AdSense Privacy Policy: Cross-Site Request Forgery (CSRF)CVE-2025-30578 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in hotvanrod AdSense Privacy Policy adsense-privacy-policy allows Stored XSS.This issue affects AdSense Privacy Policy: from n/a through <= 1.1.1.

  Product

  AdSense Privacy Policy

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update AdSense Privacy Policy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Browser Address Bar Color: Cross-Site Request Forgery (CSRF)CVE-2025-30577 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mendibass Browser Address Bar Color browser-address-bar-color allows Stored XSS.This issue affects Browser Address Bar Color: from n/a through <= 3.3.

  Product

  Browser Address Bar Color

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update Browser Address Bar Color to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Hacklog Remote Image Autosave: Cross-Site Request Forgery (CSRF)CVE-2025-30576 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Image Autosave hacklog-remote-image-autosave allows Cross Site Request Forgery.This issue affects Hacklog Remote Image Autosave: from n/a through <= 2.1.0.

  Product

  Hacklog Remote Image Autosave

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Hacklog Remote Image Autosave to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Login Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30575 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly Login Redirect login-redirect allows Stored XSS.This issue affects Login Redirect: from n/a through <= 1.0.5.

  Product

  Login Redirect

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Mobile Navigation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30574 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jenst Mobile Navigation mobile-navigation allows Stored XSS.This issue affects Mobile Navigation: from n/a through <= 1.5.

  Product

  Mobile Navigation

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Mobile Navigation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025My Default Post Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30573 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mrdenny My Default Post Content my-default-post-content allows Stored XSS.This issue affects My Default Post Content: from n/a through <= 0.7.3.

  Product

  My Default Post Content

  Affected

  up to 0.7.3

  What to do

  Affects up to 0.7.3. Update My Default Post Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Simple Rating: Cross-Site Request Forgery (CSRF)CVE-2025-30572 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Igor Yavych Simple Rating simple-rating allows Stored XSS.This issue affects Simple Rating: from n/a through <= 1.4.

  Product

  Simple Rating

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Simple Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025STEdb Forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30571 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in STEdb Corp. STEdb Forms stedb-forms allows SQL Injection.This issue affects STEdb Forms: from n/a through <= 1.0.4.

  Product

  STEdb Forms

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update STEdb Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025دکمه، شبکه اجتماعی خرید: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30570 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AliRezaMohammadi دکمه، شبکه اجتماعی خرید dokme allows SQL Injection.This issue affects دکمه، شبکه اجتماعی خرید: from n/a through <= 2.0.6.

  Product

  دکمه، شبکه اجتماعی خرید

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update دکمه، شبکه اجتماعی خرید to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WP Featured Entries: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30569 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jahertor WP Featured Entries wp-featured-entries allows SQL Injection.This issue affects WP Featured Entries: from n/a through <= 1.0.

  Product

  WP Featured Entries

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP Featured Entries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Super Static Cache: Cross-Site Request Forgery (CSRF)CVE-2025-30568 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in hitoy Super Static Cache super-static-cache allows Cross Site Request Forgery.This issue affects Super Static Cache: from n/a through <= 3.3.5.

  Product

  Super Static Cache

  Affected

  up to 3.3.5

  What to do

  Affects up to 3.3.5. Update Super Static Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Clink: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30566 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aryan Themes Clink clink allows DOM-Based XSS.This issue affects Clink: from n/a through <= 1.2.2.

  Product

  Clink

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Clink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025banner-manager: Cross-Site Request Forgery (CSRF)CVE-2025-30565 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in karrikas banner-manager banner-manager allows Stored XSS.This issue affects banner-manager: from n/a through <= 16.04.19.

  Product

  banner-manager

  Affected

  up to 16.04.19

  What to do

  Affects up to 16.04.19. Update banner-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Custom Script Integration: Cross-Site Request Forgery (CSRF)CVE-2025-30564 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in wpwox Custom Script Integration custom-script-integration allows Stored XSS.This issue affects Custom Script Integration: from n/a through <= 2.1.

  Product

  Custom Script Integration

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Custom Script Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025CAS Maestro: Cross-Site Request Forgery (CSRF)CVE-2025-30561 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Henrique Mouta CAS Maestro cas-maestro allows Stored XSS.This issue affects CAS Maestro: from n/a through <= 1.1.3.

  Product

  CAS Maestro

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update CAS Maestro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025jQuery Dropdown Menu: Cross-Site Request Forgery (CSRF)CVE-2025-30560 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Sana Ullah jQuery Dropdown Menu jquery-drop-down-menu-plugin allows Stored XSS.This issue affects jQuery Dropdown Menu: from n/a through <= 3.0.

  Product

  jQuery Dropdown Menu

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update jQuery Dropdown Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025ANAC XML Render: Cross-Site Request Forgery (CSRF)CVE-2025-30558 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in EnzoCostantini55 ANAC XML Render anac-xml-render allows Stored XSS.This issue affects ANAC XML Render: from n/a through <= 1.5.7.

  Product

  ANAC XML Render

  Affected

  up to 1.5.7

  What to do

  Affects up to 1.5.7. Update ANAC XML Render to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Easy 301 Redirects: Cross-Site Request Forgery (CSRF)CVE-2025-30557 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in odihost Easy 301 Redirects odihost-easy-redirect-301 allows Cross Site Request Forgery.This issue affects Easy 301 Redirects: from n/a through <= 1.33.

  Product

  Easy 301 Redirects

  Affected

  up to 1.33

  What to do

  Affects up to 1.33. Update Easy 301 Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Fix Rss Feeds: Cross-Site Request Forgery (CSRF)CVE-2025-30556 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in flyaga Fix Rss Feeds fix-rss-feed allows Cross Site Request Forgery.This issue affects Fix Rss Feeds: from n/a through <= 3.1.

  Product

  Fix Rss Feeds

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update Fix Rss Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.