Vulnerability database

41,601 results · page 441 of 833

• Jan 22, 2025Muzaara Google Ads Report: Deserialization of Untrusted DataCVE-2025-23914 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affects Muzaara Google Ads Report: from n/a through <= 3.1.

  Product

  Muzaara Google Ads Report

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update Muzaara Google Ads Report to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Blue Wrench Video Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23809 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sunil Nanda Blue Wrench Video Widget blue-wrench-videos-widget allows Reflected XSS.This issue affects Blue Wrench Video Widget: from n/a through <= 2.1.0.

  Product

  Blue Wrench Video Widget

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Blue Wrench Video Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025a Gateway for Pasargad Bank on WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23966 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ala Falaki a Gateway for Pasargad Bank on WooCommerce a-gateway-for-pasargad-bank-on-woocommerce allows Reflected XSS.This issue affects a Gateway for Pasargad Bank on WooCommerce: from n/a through <= 2.5.2.

  Product

  a Gateway for Pasargad Bank on WooCommerce

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update a Gateway for Pasargad Bank on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Good Old Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23959 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linus Lundahl Good Old Gallery good-old-gallery allows Reflected XSS.This issue affects Good Old Gallery: from n/a through <= 2.1.2.

  Product

  Good Old Gallery

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Good Old Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025user files: Unrestricted Upload of File with Dangerous TypeCVE-2025-23953 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unrestricted Upload of File with Dangerous Type vulnerability in Scriptonite user files user-files allows Upload a Web Shell to a Web Server.This issue affects user files: from n/a through <= 2.4.2.

  Product

  user files

  Affected

  up to 2.4.2

  What to do

  Affects up to 2.4.2. Update user files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Improved Sale Badges – Free Version: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-23949 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dzeriho Improved Sale Badges – Free Version improved-sale-badges-free-version allows PHP Local File Inclusion.This issue affects Improved Sale Badges – Free Version: from n/a through <= 1.0.1.

  Product

  Improved Sale Badges – Free Version

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Improved Sale Badges – Free Version to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Background animation blocks: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-23948 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Webarea Background animation blocks background-animation-blocks allows PHP Local File Inclusion.This issue affects Background animation blocks: from n/a through <= 2.1.5.

  Product

  Background animation blocks

  Affected

  up to 2.1.5

  What to do

  Affects up to 2.1.5. Update Background animation blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025WOOEXIM: Deserialization of Untrusted DataCVE-2025-23944 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Deserialization of Untrusted Data vulnerability in bulktheme WOOEXIM wooexim allows Object Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0.

  Product

  WOOEXIM

  Affected

  up to 5.0.0

  What to do

  Affects up to 5.0.0. Update WOOEXIM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025WP Load Gallery: Unrestricted Upload of File with Dangerous TypeCVE-2025-23942 · WordPress plugins & themes · reported by PatchstackCritical 9.1

  Unrestricted Upload of File with Dangerous Type vulnerability in ngocuct0912 WP Load Gallery wp-load-gallery allows Upload a Web Shell to a Web Server.This issue affects WP Load Gallery: from n/a through <= 2.1.6.

  Product

  WP Load Gallery

  Affected

  up to 2.1.6

  What to do

  Affects up to 2.1.6. Update WP Load Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Image Gallery Box by CRUDLab: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-23938 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CRUDLab Image Gallery Box by CRUDLab image-gallery-box-by-crudlab allows PHP Local File Inclusion.This issue affects Image Gallery Box by CRUDLab: from n/a through <= 1.0.3.

  Product

  Image Gallery Box by CRUDLab

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Image Gallery Box by CRUDLab to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Quick Count: Deserialization of Untrusted DataCVE-2025-23932 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Deserialization of Untrusted Data vulnerability in Marko-M Quick Count quick-count allows Object Injection.This issue affects Quick Count: from n/a through <= 3.00.

  Product

  Quick Count

  Affected

  up to 3.00

  What to do

  Affects up to 3.00. Update Quick Count to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025WordPress Local SEO: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23931 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oliver Fuhrmann WordPress Local SEO dh-local-seo allows Blind SQL Injection.This issue affects WordPress Local SEO: from n/a through <= 2.3.

  Product

  WordPress Local SEO

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update WordPress Local SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Multi Uploader for Gravity Forms: Unrestricted Upload of File with Dangerous TypeCVE-2025-23921 · WordPress plugins & themes · reported by PatchstackCritical 9

  Unrestricted Upload of File with Dangerous Type vulnerability in sh1zen Multi Uploader for Gravity Forms gf-multi-uploader allows Upload a Web Shell to a Web Server.This issue affects Multi Uploader for Gravity Forms: from n/a through <= 1.1.3.

  Product

  Multi Uploader for Gravity Forms

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Multi Uploader for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Smallerik File Browser: Unrestricted Upload of File with Dangerous TypeCVE-2025-23918 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Unrestricted Upload of File with Dangerous Type vulnerability in Enrico Sandoli Smallerik File Browser smallerik-file-browser allows Upload a Web Shell to a Web Server.This issue affects Smallerik File Browser: from n/a through <= 1.1.

  Product

  Smallerik File Browser

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Smallerik File Browser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Menus Plus+: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23910 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in keighl Menus Plus+ menus-plus allows SQL Injection.This issue affects Menus Plus+: from n/a through <= 1.9.6.

  Product

  Menus Plus+

  Affected

  up to 1.9.6

  What to do

  Affects up to 1.9.6. Update Menus Plus+ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025WP Download Codes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23882 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in misanthrop WP Download Codes wp-download-codes allows Reflected XSS.This issue affects WP Download Codes: from n/a through <= 2.5.4.

  Product

  WP Download Codes

  Affected

  up to 2.5.4

  What to do

  Affects up to 2.5.4. Update WP Download Codes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025WP Block Pack: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23874 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FalconTheme Team WP Block Pack wp-block-pack allows Reflected XSS.This issue affects WP Block Pack: from n/a through <= 1.1.6.

  Product

  WP Block Pack

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update WP Block Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025WordPress File Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23867 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markcoker WordPress File Search wpfilesearch allows Reflected XSS.This issue affects WordPress File Search: from n/a through <= 1.2.

  Product

  WordPress File Search

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update WordPress File Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025EU DSGVO Helper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23866 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E. Marten EU DSGVO Helper dsgvo allows Reflected XSS.This issue affects EU DSGVO Helper: from n/a through <= 1.0.6.1.

  Product

  EU DSGVO Helper

  Affected

  up to 1.0.6.1

  What to do

  Affects up to 1.0.6.1. Update EU DSGVO Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Flexible Blogtitle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23846 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thaikolja Flexible Blogtitle flexible-blogtitle allows Reflected XSS.This issue affects Flexible Blogtitle: from n/a through <= 0.1.

  Product

  Flexible Blogtitle

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Flexible Blogtitle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Contact Form 7 Round Robin Lead Distribution: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23812 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Jeffrey Contact Form 7 Round Robin Lead Distribution contact-form-7-round-robin-lead-distribution allows Reflected XSS.This issue affects Contact Form 7 Round Robin Lead Distribution: from n/a through <= 1.2.1.

  Product

  Contact Form 7 Round Robin Lead Distribution

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Contact Form 7 Round Robin Lead Distribution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025WP2APP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23811 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ghasemy14 WP2APP wp2appir allows Reflected XSS.This issue affects WP2APP: from n/a through <= 2.6.2.

  Product

  WP2APP

  Affected

  up to 2.6.2

  What to do

  Affects up to 2.6.2. Update WP2APP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Ultimate Subscribe: Cross-Site Request Forgery (CSRF)CVE-2025-23806 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ThemeFarmer Ultimate Subscribe ultimate-subscribe allows Reflected XSS.This issue affects Ultimate Subscribe: from n/a through <= 1.3.

  Product

  Ultimate Subscribe

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Ultimate Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Snippy: Cross-Site Request Forgery (CSRF)CVE-2025-23803 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Rik Schennink Snippy snippy allows Reflected XSS.This issue affects Snippy: from n/a through <= 1.4.1.

  Product

  Snippy

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Snippy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Mass Messaging in BuddyPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23798 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ElbowRobo Mass Messaging in BuddyPress mass-messaging-in-buddypress allows Reflected XSS.This issue affects Mass Messaging in BuddyPress: from n/a through <= 2.2.1.

  Product

  Mass Messaging in BuddyPress

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update Mass Messaging in BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Contact Form 7 Round Robin Lead Distribution: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23784 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Jeffrey Contact Form 7 Round Robin Lead Distribution contact-form-7-round-robin-lead-distribution allows SQL Injection.This issue affects Contact Form 7 Round Robin Lead Distribution: from n/a through <= 1.2.1.

  Product

  Contact Form 7 Round Robin Lead Distribution

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Contact Form 7 Round Robin Lead Distribution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025WM Options Import Export: Insertion of Sensitive Information Into Sent DataCVE-2025-23781 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Insertion of Sensitive Information Into Sent Data vulnerability in Web Mumbai WM Options Import Export wm-options-import-export allows Retrieve Embedded Sensitive Data.This issue affects WM Options Import Export: from n/a through <= 1.0.1.

  Product

  WM Options Import Export

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update WM Options Import Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025WPDB to Sql: Insertion of Sensitive Information Into Sent DataCVE-2025-23774 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Insertion of Sensitive Information Into Sent Data vulnerability in Niket Joshi WPDB to Sql wpdb-to-sql allows Retrieve Embedded Sensitive Data.This issue affects WPDB to Sql: from n/a through <= 1.2.

  Product

  WPDB to Sql

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update WPDB to Sql to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Fast Tube: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23770 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caspie Fast Tube fast-tube allows Reflected XSS.This issue affects Fast Tube: from n/a through <= 2.3.1.

  Product

  Fast Tube

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update Fast Tube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Content Mirror: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23769 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dreamsofmatter Content Mirror content-mirror allows Reflected XSS.This issue affects Content Mirror: from n/a through <= 1.2.

  Product

  Content Mirror

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Content Mirror to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025InFunding: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23768 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in inwavethemes InFunding infunding allows Reflected XSS.This issue affects InFunding: from n/a through <= 1.0.

  Product

  InFunding

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update InFunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Pootle button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23758 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pootlepress Pootle button pootle-button allows Reflected XSS.This issue affects Pootle button: from n/a through <= 1.2.0.

  Product

  Pootle button

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Pootle button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025CMC MIGRATE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23746 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edem CMC MIGRATE cmc-migrate allows Reflected XSS.This issue affects CMC MIGRATE: from n/a through <= 0.0.3.

  Product

  CMC MIGRATE

  Affected

  up to 0.0.3

  What to do

  Affects up to 0.0.3. Update CMC MIGRATE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Easy Filtering: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23732 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in franciscopalacios Easy Filtering easy-filtering allows Reflected XSS.This issue affects Easy Filtering: from n/a through <= 2.5.0.

  Product

  Easy Filtering

  Affected

  up to 2.5.0

  What to do

  Affects up to 2.5.0. Update Easy Filtering to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Formatted post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23709 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kiroro Formatted post formatted-post allows Reflected XSS.This issue affects Formatted post: from n/a through <= 1.01.

  Product

  Formatted post

  Affected

  up to 1.01

  What to do

  Affects up to 1.01. Update Formatted post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Jet Skinner for BuddyPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23706 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in milordk Jet Skinner for BuddyPress jet-skinner-for-buddypress allows Reflected XSS.This issue affects Jet Skinner for BuddyPress: from n/a through <= 1.2.5.

  Product

  Jet Skinner for BuddyPress

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Jet Skinner for BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Lime Developer Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23701 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in limesquare Lime Developer Login lime-developer-login allows Reflected XSS.This issue affects Lime Developer Login: from n/a through <= 1.4.0.

  Product

  Lime Developer Login

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Lime Developer Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025yCyclista: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23700 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonisink yCyclista ycyclista allows Reflected XSS.This issue affects yCyclista: from n/a through <= 1.2.3.

  Product

  yCyclista

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update yCyclista to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Podčlánková inzerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23697 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webdeal Podčlánková inzerce podclankova-inzerce allows Reflected XSS.This issue affects Podčlánková inzerce: from n/a through <= 2.4.0.

  Product

  Podčlánková inzerce

  Affected

  up to 2.4.0

  What to do

  Affects up to 2.4.0. Update Podčlánková inzerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Staging CDN: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23696 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronan Mockett Staging CDN staging-cdn allows Reflected XSS.This issue affects Staging CDN: from n/a through <= 1.0.0.

  Product

  Staging CDN

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Staging CDN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025CtyGrid Hyp3rL0cal Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23695 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kinlane CtyGrid Hyp3rL0cal Search hyp3rl0cal-city-search allows Reflected XSS.This issue affects CtyGrid Hyp3rL0cal Search: from n/a through <= 0.1.1.1.

  Product

  CtyGrid Hyp3rL0cal Search

  Affected

  up to 0.1.1.1

  What to do

  Affects up to 0.1.1.1. Update CtyGrid Hyp3rL0cal Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Admin Menu Organizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23686 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phpdevca Admin Menu Organizer admin-menu-organizer allows Reflected XSS.This issue affects Admin Menu Organizer: from n/a through <= 1.0.1.

  Product

  Admin Menu Organizer

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Admin Menu Organizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Debug Tool: Missing AuthorizationCVE-2025-23684 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Eugen Bobrowski Debug Tool debug-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Debug Tool: from n/a through <= 2.2.

  Product

  Debug Tool

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Debug Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025MACME: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23683 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xdxdVSxdxd MACME macme allows Reflected XSS.This issue affects MACME: from n/a through <= 1.2.

  Product

  MACME

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update MACME to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Preloader Quotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23682 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bhuvnesh Gupta Preloader Quotes preloader-quotes allows Reflected XSS.This issue affects Preloader Quotes: from n/a through <= 1.0.0.

  Product

  Preloader Quotes

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Preloader Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025REDIRECTION PLUS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23681 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat REDIRECTION PLUS redirection-plus allows Reflected XSS.This issue affects REDIRECTION PLUS: from n/a through <= 2.0.0.

  Product

  REDIRECTION PLUS

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update REDIRECTION PLUS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025FP RSS Category Excluder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23679 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flourish Pixel FP RSS Category Excluder fp-rss-category-excluder allows Reflected XSS.This issue affects FP RSS Category Excluder: from n/a through <= 1.0.0.

  Product

  FP RSS Category Excluder

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update FP RSS Category Excluder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025LocalGrid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23678 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Imranur Rahman LocalGrid localgrid allows Reflected XSS.This issue affects LocalGrid: from n/a through <= 1.0.1.

  Product

  LocalGrid

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update LocalGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025LH Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23676 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH Email lh-email allows Reflected XSS.This issue affects LH Email: from n/a through <= 1.12.

  Product

  LH Email

  Affected

  up to 1.12

  What to do

  Affects up to 1.12. Update LH Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Bit.ly linker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23674 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andygauk Bit.ly linker bitly-linker allows Reflected XSS.This issue affects Bit.ly linker: from n/a through <= 1.1.

  Product

  Bit.ly linker

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Bit.ly linker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.