Vulnerability database

41,601 results · page 443 of 833

• Jan 21, 2025Picture Gallery – Frontend Image Uploads, AJAX Photo List: Stored Cross-Site ScriptingCVE-2024-13584 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_pictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Picture Gallery – Frontend Image Uploads, AJAX Photo List

  Affected

  up to 1.5.19

  What to do

  Affects up to 1.5.19. Update Picture Gallery – Frontend Image Uploads, AJAX Photo List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 21, 2025WP-Polls: SQL InjectionCVE-2024-13426 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The WP-Polls plugin for WordPress is vulnerable to SQL Injection via COOKIE in all versions up to, and including, 2.77.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries. Those queries are stored and results are not displayed to the attacker, which means they cannot be exploited to obtain any additional information about the database. However, a properly configured payload allows for the injection of malicious JavaScript resulting in Stored Cross-Site Scripting.

  Product

  WP-Polls

  Affected

  up to 2.77.2

  What to do

  Affects up to 2.77.2. Update WP-Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comgithub.com

• Jan 21, 2025WPBot Pro Wordpress Chatbot: Arbitrary file uploadsCVE-2024-13091 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'qcld_wpcfb_file_upload' function in all versions up to, and including, 13.5.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit requires thee ChatBot Conversational Forms plugin and the Conversational Form Builder Pro addon plugin.

  Product

  WPBot Pro Wordpress Chatbot

  Affected

  up to 13.5.4

  What to do

  Affects up to 13.5.4. Update WPBot Pro Wordpress Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordfence.comwpbot.pro

• Jan 21, 2025AnyRoad: Cross-Site Request Forgery (CSRF)CVE-2025-23996 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in AnyRoad AnyRoad anyguide allows Cross Site Request Forgery.This issue affects AnyRoad: from n/a through <= 1.3.2.

  Product

  AnyRoad

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update AnyRoad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Estatebud – Properties & Listings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23994 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatebud Estatebud – Properties & Listings estatebud-properties-listings allows Stored XSS.This issue affects Estatebud – Properties & Listings: from n/a through <= 5.5.0.

  Product

  Estatebud – Properties & Listings

  Affected

  up to 5.5.0

  What to do

  Affects up to 5.5.0. Update Estatebud – Properties & Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025BizLibrary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23580 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthew BizLibrary bizlibrary allows Reflected XSS.This issue affects BizLibrary: from n/a through <= 1.1.

  Product

  BizLibrary

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update BizLibrary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025SexBundle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23551 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in razvypp SexBundle sexbundle allows Reflected XSS.This issue affects SexBundle: from n/a through <= 1.4.

  Product

  SexBundle

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update SexBundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025WP-Announcements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23489 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Messenlehner WP-Announcements wp-announcements allows Reflected XSS.This issue affects WP-Announcements: from n/a through <= 1.8.

  Product

  WP-Announcements

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update WP-Announcements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Realty Workstation: Missing AuthorizationCVE-2025-23477 · WordPress plugins & themes · reported by PatchstackHigh 8.2

  Missing Authorization vulnerability in realtyworkstation Realty Workstation realty-workstation allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Realty Workstation: from n/a through <= 1.0.45.

  Product

  Realty Workstation

  Affected

  up to 1.0.45

  What to do

  Affects up to 1.0.45. Update Realty Workstation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Social2Blog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23461 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xkollsoftware Social2Blog social2blog allows Reflected XSS.This issue affects Social2Blog: from n/a through <= 0.2.990.

  Product

  Social2Blog

  Affected

  up to 0.2.990

  What to do

  Affects up to 0.2.990. Update Social2Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Nature FlipBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23454 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flashmaniac Nature FlipBook vertical-diamond-flipbook-flash allows Reflected XSS.This issue affects Nature FlipBook: from n/a through <= 1.7.

  Product

  Nature FlipBook

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Nature FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Widget Options: Missing AuthorizationCVE-2025-22722 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through <= 4.0.8.

  Product

  Widget Options

  Affected

  up to 4.0.8

  What to do

  Affects up to 4.0.8. Update Widget Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025ApplyOnline: Missing AuthorizationCVE-2025-22721 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Farhan Noor ApplyOnline apply-online allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ApplyOnline: from n/a through <= 2.6.7.1.

  Product

  ApplyOnline

  Affected

  up to 2.6.7.1

  What to do

  Affects up to 2.6.7.1. Update ApplyOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Online Payments – Get Paid with PayPal, Square & Stripe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22661 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Payments – Get Paid with PayPal, Square & Stripe paypal-payment-button-by-vcita allows Stored XSS.This issue affects Online Payments – Get Paid with PayPal, Square & Stripe: from n/a through <= 3.20.0.

  Product

  Online Payments – Get Paid with PayPal, Square & Stripe

  Affected

  up to 3.20.0

  What to do

  Affects up to 3.20.0. Update Online Payments – Get Paid with PayPal, Square & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Related Post Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22276 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enguerranws Related Post Shortcode related-post-shortcode allows Stored XSS.This issue affects Related Post Shortcode: from n/a through <= 1.2.

  Product

  Related Post Shortcode

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Related Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Weaver Themes Shortcode Compatibility: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22267 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Themes Shortcode Compatibility weaver-themes-shortcode-compatibility allows Stored XSS.This issue affects Weaver Themes Shortcode Compatibility: from n/a through <= 1.0.4.

  Product

  Weaver Themes Shortcode Compatibility

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Weaver Themes Shortcode Compatibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025PPO Call To Actions: Cross-Site Request Forgery (CSRF)CVE-2025-24001 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Ngô Thắng IT PPO Call To Actions ppo-call-to-actions allows Cross Site Request Forgery.This issue affects PPO Call To Actions: from n/a through <= 0.1.3.

  Product

  PPO Call To Actions

  Affected

  up to 0.1.3

  What to do

  Affects up to 0.1.3. Update PPO Call To Actions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025UltraLight: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23998 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in raratheme UltraLight the-ultralight allows Reflected XSS.This issue affects UltraLight: from n/a through <= 1.2.

  Product

  UltraLight

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update UltraLight to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Tamara Checkout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23997 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tamara Solution Tamara Checkout tamara-checkout allows Stored XSS.This issue affects Tamara Checkout: from n/a through < 1.9.9.1.

  Product

  Tamara Checkout

  What to do

  Update Tamara Checkout to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Flexible PDF Coupons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22825 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible PDF Coupons flexible-coupons allows Stored XSS.This issue affects Flexible PDF Coupons: from n/a through < 1.10.3.

  Product

  Flexible PDF Coupons

  What to do

  Update Flexible PDF Coupons to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Brizy Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22763 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Brizy Pro allows Reflected XSS. This issue affects Brizy Pro: from n/a through 2.6.1.

  Product

  Brizy Pro

  Affected

  up to 2.6.1

  What to do

  Affects up to 2.6.1. Update Brizy Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025WordPress Tag Cloud Plugin – Tag Groups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22735 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Burge WordPress Tag Cloud Plugin – Tag Groups tag-groups allows Reflected XSS.This issue affects WordPress Tag Cloud Plugin – Tag Groups: from n/a through <= 2.0.4.

  Product

  WordPress Tag Cloud Plugin – Tag Groups

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update WordPress Tag Cloud Plugin – Tag Groups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025My auctions allegro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22733 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Reflected XSS.This issue affects My auctions allegro: from n/a through <= 3.6.18.

  Product

  My auctions allegro

  Affected

  up to 3.6.18

  What to do

  Affects up to 3.6.18. Update My auctions allegro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Ad Blocking Detector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22732 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Admiral Ad Blocking Detector ad-blocking-detector allows Stored XSS.This issue affects Ad Blocking Detector: from n/a through <= 3.6.0.

  Product

  Ad Blocking Detector

  Affected

  up to 3.6.0

  What to do

  Affects up to 3.6.0. Update Ad Blocking Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025MailChimp Subscribe Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22727 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps MailChimp Subscribe Forms mailchimp-subscribe-sm allows Stored XSS.This issue affects MailChimp Subscribe Forms : from n/a through <= 4.1.

  Product

  MailChimp Subscribe Forms

  Affected

  up to 4.1

  What to do

  Affects up to 4.1. Update MailChimp Subscribe Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Barcode Scanner with Inventory & Order Manager: Unrestricted Upload of File with Dangerous TypeCVE-2025-22723 · WordPress plugins & themes · reported by PatchstackCritical 9.1

  Unrestricted Upload of File with Dangerous Type vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Upload a Web Shell to a Web Server.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.6.7.

  Product

  Barcode Scanner with Inventory & Order Manager

  Affected

  up to 1.6.7

  What to do

  Affects up to 1.6.7. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025VikAppointments Services Booking Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22719 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikAppointments Services Booking Calendar vikappointments allows Stored XSS.This issue affects VikAppointments Services Booking Calendar: from n/a through <= 1.2.16.

  Product

  VikAppointments Services Booking Calendar

  Affected

  up to 1.2.16

  What to do

  Affects up to 1.2.16. Update VikAppointments Services Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025FAT Event Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22718 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in roninwp FAT Event Lite fat-event-lite allows Stored XSS.This issue affects FAT Event Lite: from n/a through <= 1.1.

  Product

  FAT Event Lite

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update FAT Event Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025My Tickets: Missing AuthorizationCVE-2025-22717 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in Joe Dolson My Tickets my-tickets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects My Tickets: from n/a through <= 2.0.9.

  Product

  My Tickets

  Affected

  up to 2.0.9

  What to do

  Affects up to 2.0.9. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Taskbuilder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22716 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in taskbuilder Taskbuilder taskbuilder allows SQL Injection.This issue affects Taskbuilder: from n/a through <= 3.0.6.

  Product

  Taskbuilder

  Affected

  up to 3.0.6

  What to do

  Affects up to 3.0.6. Update Taskbuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Image Source Control: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22711 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Maier Image Source Control image-source-control-isc allows Reflected XSS.This issue affects Image Source Control: from n/a through <= 2.29.0.

  Product

  Image Source Control

  Affected

  up to 2.29.0

  What to do

  Affects up to 2.29.0. Update Image Source Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Smart Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22710 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce allows Blind SQL Injection.This issue affects Smart Manager: from n/a through <= 8.52.0.

  Product

  Smart Manager

  Affected

  up to 8.52.0

  What to do

  Affects up to 8.52.0. Update Smart Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Verge3D: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22709 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D verge3d allows Reflected XSS.This issue affects Verge3D: from n/a through <= 4.8.0.

  Product

  Verge3D

  Affected

  up to 4.8.0

  What to do

  Affects up to 4.8.0. Update Verge3D to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Social Pug: Author Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22706 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai Social Pug: Author Box allows Reflected XSS. This issue affects Social Pug: Author Box: from n/a through 1.0.0.

  Product

  Social Pug: Author Box

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Social Pug: Author Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Multiple Carousel: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22553 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in dhananjaysingh Multiple Carousel multicarousel allows SQL Injection.This issue affects Multiple Carousel: from n/a through <= 2.0.

  Product

  Multiple Carousel

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Multiple Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Private Messages for UserPro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22322 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeluxeThemes Private Messages for UserPro userpro-messaging allows Reflected XSS.This issue affects Private Messages for UserPro: from n/a through <= 4.10.0.

  Product

  Private Messages for UserPro

  Affected

  up to 4.10.0

  What to do

  Affects up to 4.10.0. Update Private Messages for UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Standard Box Sizes – for WooCommerce: Missing AuthorizationCVE-2025-22318 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in enituretechnology Standard Box Sizes – for WooCommerce standard-box-sizes.This issue affects Standard Box Sizes – for WooCommerce: from n/a through <= 1.6.13.

  Product

  Standard Box Sizes – for WooCommerce

  Affected

  up to 1.6.13

  What to do

  Affects up to 1.6.13. Update Standard Box Sizes – for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Private Messages for UserPro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22311 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DeluxeThemes Private Messages for UserPro userpro-messaging.This issue affects Private Messages for UserPro: from n/a through <= 4.10.0.

  Product

  Private Messages for UserPro

  Affected

  up to 4.10.0

  What to do

  Affects up to 4.10.0. Update Private Messages for UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Bonjour Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22262 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WittyFolk Bonjour Bar bonjour-bar allows Stored XSS.This issue affects Bonjour Bar: from n/a through <= 1.0.0.

  Product

  Bonjour Bar

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Bonjour Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Poll Maker: Improper Encoding or Escaping of OutputCVE-2024-56277 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Improper Encoding or Escaping of Output vulnerability in Ays Pro Poll Maker poll-maker.This issue affects Poll Maker: from n/a through < 5.5.5.

  Product

  Poll Maker

  Fixed in

  5.5.5

  What to do

  Update Poll Maker to 5.5.5 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Fancy Product Designer: Unrestricted Upload of File with Dangerous TypeCVE-2024-51919 · WordPress plugins & themes · reported by PatchstackCritical 9

  Unrestricted Upload of File with Dangerous Type vulnerability in radykal Fancy Product Designer fancy-product-designer.This issue affects Fancy Product Designer: from n/a through <= 6.4.3.

  Product

  Fancy Product Designer

  Affected

  up to 6.4.3

  What to do

  Affects up to 6.4.3. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Homey Login Register: Incorrect Privilege AssignmentCVE-2024-51888 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Incorrect Privilege Assignment vulnerability in favethemes Homey Login Register homey-login-register allows Privilege Escalation.This issue affects Homey Login Register: from n/a through <= 2.4.0.

  Product

  Homey Login Register

  Affected

  up to 2.4.0

  What to do

  Affects up to 2.4.0. Update Homey Login Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Fancy Product Designer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51818 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in radykal Fancy Product Designer fancy-product-designer.This issue affects Fancy Product Designer: from n/a through <= 6.4.3.

  Product

  Fancy Product Designer

  Affected

  up to 6.4.3

  What to do

  Affects up to 6.4.3. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025ARPrice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49700 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARPrice arprice allows Reflected XSS.This issue affects ARPrice: from n/a through <= 4.1.3.

  Product

  ARPrice

  Affected

  up to 4.1.3

  What to do

  Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025ARPrice: Deserialization of Untrusted DataCVE-2024-49699 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.

  Product

  ARPrice

  Affected

  up to 4.1.3

  What to do

  Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025ARPrice: Deserialization of Untrusted DataCVE-2024-49688 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.

  Product

  ARPrice

  Affected

  up to 4.1.3

  What to do

  Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025ARPrice: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49666 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARPrice arprice allows SQL Injection.This issue affects ARPrice: from n/a through <= 4.1.3.

  Product

  ARPrice

  Affected

  up to 4.1.3

  What to do

  Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025ARPrice: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49655 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARPrice arprice allows SQL Injection.This issue affects ARPrice: from n/a through <= 4.1.3.

  Product

  ARPrice

  Affected

  up to 4.1.3

  What to do

  Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Hero Mega Menu - Responsive WordPress Menu: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49333 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugin allows SQL Injection. This issue affects Hero Mega Menu - Responsive WordPress Menu Plugin: from n/a through 1.16.5.

  Product

  Hero Mega Menu - Responsive WordPress Menu

  Affected

  up to 1.16.5

  What to do

  Affects up to 1.16.5. Update Hero Mega Menu - Responsive WordPress Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Hero Mega Menu - Responsive WordPress Menu: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49303 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugin allows SQL Injection. This issue affects Hero Mega Menu - Responsive WordPress Menu Plugin: from n/a through 1.16.5.

  Product

  Hero Mega Menu - Responsive WordPress Menu

  Affected

  up to 1.16.5

  What to do

  Affects up to 1.16.5. Update Hero Mega Menu - Responsive WordPress Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.