Vulnerability database

41,601 results · page 445 of 833

• Jan 17, 2025Checkout for PayPal: Stored Cross-Site ScriptingCVE-2024-13398 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Checkout for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'checkout_for_paypal' shortcode in all versions up to, and including, 1.0.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Checkout for PayPal

  Affected

  up to 1.0.32

  What to do

  Affects up to 1.0.32. Update Checkout for PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 16, 2025Kopa Nictitate Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23965 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kopatheme Kopa Nictitate Toolkit kopa-nictitate-toolkit allows Stored XSS.This issue affects Kopa Nictitate Toolkit: from n/a through <= 1.0.2.

  Product

  Kopa Nictitate Toolkit

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Kopa Nictitate Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Mark Posts: Missing AuthorizationCVE-2025-23963 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in flymke Mark Posts mark-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mark Posts: from n/a through <= 2.2.4.

  Product

  Mark Posts

  Affected

  up to 2.2.4

  What to do

  Affects up to 2.2.4. Update Mark Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Goldstar: Missing AuthorizationCVE-2025-23962 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in jjtrabucco Goldstar goldstar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Goldstar: from n/a through <= 2.1.1.

  Product

  Goldstar

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update Goldstar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WordPress Graphs & Charts: Missing AuthorizationCVE-2025-23961 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in wptasker WordPress Graphs & Charts graph-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Graphs & Charts: from n/a through <= 2.0.8.

  Product

  WordPress Graphs & Charts

  Affected

  up to 2.0.8

  What to do

  Affects up to 2.0.8. Update WordPress Graphs & Charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Sur.ly: Missing AuthorizationCVE-2025-23957 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in surdotly Sur.ly surly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sur.ly: from n/a through <= 3.0.3.

  Product

  Sur.ly

  Affected

  up to 3.0.3

  What to do

  Affects up to 3.0.3. Update Sur.ly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Xola: Missing AuthorizationCVE-2025-23955 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in xola Xola xola-bookings-for-tours-activities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xola: from n/a through <= 1.6.

  Product

  Xola

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Xola to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Salvador – AI Image Generator: Missing AuthorizationCVE-2025-23954 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in awcode Salvador – AI Image Generator salvador-ai-image-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salvador – AI Image Generator: from n/a through <= 1.0.11.

  Product

  Salvador – AI Image Generator

  Affected

  up to 1.0.11

  What to do

  Affects up to 1.0.11. Update Salvador – AI Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Gallery: Hybrid – Advanced Visual Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23951 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DIVENGINE Gallery: Hybrid – Advanced Visual Gallery hybrid-gallery allows Stored XSS.This issue affects Gallery: Hybrid – Advanced Visual Gallery: from n/a through <= 1.4.0.2.

  Product

  Gallery: Hybrid – Advanced Visual Gallery

  Affected

  up to 1.4.0.2

  What to do

  Affects up to 1.4.0.2. Update Gallery: Hybrid – Advanced Visual Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025EZPlayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23950 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ezmarketing EZPlayer ezplayer allows Stored XSS.This issue affects EZPlayer: from n/a through <= 1.0.10.

  Product

  EZPlayer

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update EZPlayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP-Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23947 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M.J WP-Player wp-player allows Stored XSS.This issue affects WP-Player: from n/a through <= 2.6.1.

  Product

  WP-Player

  Affected

  up to 2.6.1

  What to do

  Affects up to 2.6.1. Update WP-Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Enhanced YouTube Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23946 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Le-Pixel-Solitaire Enhanced YouTube Shortcode enhanced-youtube-shortcode allows Stored XSS.This issue affects Enhanced YouTube Shortcode: from n/a through <= 2.0.1.

  Product

  Enhanced YouTube Shortcode

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Enhanced YouTube Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025PDF.js Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23943 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aruvi PDF.js Shortcode pdfjs-shortcode allows Stored XSS.This issue affects PDF.js Shortcode: from n/a through <= 1.0.

  Product

  PDF.js Shortcode

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update PDF.js Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025MeinTurnierplan.de Widget Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23941 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in meinturnierplan MeinTurnierplan.de Widget Viewer meinturnierplande-widget-viewer allows Stored XSS.This issue affects MeinTurnierplan.de Widget Viewer: from n/a through <= 1.1.

  Product

  MeinTurnierplan.de Widget Viewer

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update MeinTurnierplan.de Widget Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Image Switcher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23940 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in horiyuki Image Switcher image-switcher allows Stored XSS.This issue affects Image Switcher: from n/a through <= 0.1.1.

  Product

  Image Switcher

  Affected

  up to 0.1.1

  What to do

  Affects up to 0.1.1. Update Image Switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Image Switcher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23939 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KHAN-IT Image Switcher image-switcher allows Stored XSS.This issue affects Image Switcher: from n/a through <= 1.1.

  Product

  Image Switcher

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Image Switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025CC Circle Progress Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23936 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harun R. Rayhan(thecrazycoder) CC Circle Progress Bar cc-circle-progress-bar allows Stored XSS.This issue affects CC Circle Progress Bar: from n/a through <= 1.0.0.

  Product

  CC Circle Progress Bar

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update CC Circle Progress Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Magic Google Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23935 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fengler Magic Google Maps magic-google-maps allows Stored XSS.This issue affects Magic Google Maps: from n/a through <= 1.0.4.

  Product

  Magic Google Maps

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Magic Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Giveaways and Contests by PromoSimple: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23934 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sam Brodie Giveaways and Contests by PromoSimple giveaways-contests-by-promosimple allows Stored XSS.This issue affects Giveaways and Contests by PromoSimple: from n/a through <= 1.24.

  Product

  Giveaways and Contests by PromoSimple

  Affected

  up to 1.24

  What to do

  Affects up to 1.24. Update Giveaways and Contests by PromoSimple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WpF Ultimate Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23933 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpfreeware WpF Ultimate Carousel wpf-ultimate-carousel allows Stored XSS.This issue affects WpF Ultimate Carousel: from n/a through <= 1.0.11.

  Product

  WpF Ultimate Carousel

  Affected

  up to 1.0.11

  What to do

  Affects up to 1.0.11. Update WpF Ultimate Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025PayPal Marketing Solutions: Missing AuthorizationCVE-2025-23930 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in paypalmuse PayPal Marketing Solutions paypal-promotions-and-insights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Marketing Solutions: from n/a through <= 1.2.

  Product

  PayPal Marketing Solutions

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update PayPal Marketing Solutions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Email Capture & Lead Generation: Missing AuthorizationCVE-2025-23929 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in wishfulthemes Email Capture & Lead Generation email-capture-lead-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Email Capture & Lead Generation: from n/a through <= 1.0.2.

  Product

  Email Capture & Lead Generation

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Email Capture & Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Google Org Chart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23928 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Arsovski Google Org Chart google-org-chart allows Stored XSS.This issue affects Google Org Chart: from n/a through <= 1.0.1.

  Product

  Google Org Chart

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Google Org Chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Incredible Font Awesome: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23927 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in massimo.serpilli Incredible Font Awesome incredible-font-awesome allows Stored XSS.This issue affects Incredible Font Awesome: from n/a through <= 1.0.

  Product

  Incredible Font Awesome

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Incredible Font Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Ajax WP Query Search Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23926 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TC.K Ajax WP Query Search Filter ajax-wp-query-search-filter allows Stored XSS.This issue affects Ajax WP Query Search Filter: from n/a through <= 1.0.7.

  Product

  Ajax WP Query Search Filter

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Ajax WP Query Search Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Feedburner Optin Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23925 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jp2112 Feedburner Optin Form feedburner-optin-form allows Stored XSS.This issue affects Feedburner Optin Form: from n/a through <= 0.2.8.

  Product

  Feedburner Optin Form

  Affected

  up to 0.2.8

  What to do

  Affects up to 0.2.8. Update Feedburner Optin Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP Photo Sphere: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23924 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeremy WP Photo Sphere wp-photo-sphere allows Stored XSS.This issue affects WP Photo Sphere: from n/a through <= 3.8.

  Product

  WP Photo Sphere

  Affected

  up to 3.8

  What to do

  Affects up to 3.8. Update WP Photo Sphere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025iSpring Embedder: Cross-Site Request Forgery (CSRF)CVE-2025-23922 · WordPress plugins & themes · reported by PatchstackCritical 10

  Cross-Site Request Forgery (CSRF) vulnerability in Harsh iSpring Embedder embed-ispring allows Upload a Web Shell to a Web Server.This issue affects iSpring Embedder: from n/a through <= 1.0.

  Product

  iSpring Embedder

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update iSpring Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Slides & Presentations: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-23919 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Ella Van Durpe Slides & Presentations slide allows Code Injection.This issue affects Slides & Presentations: from n/a through <= 0.0.39.

  Product

  Slides & Presentations

  Affected

  up to 0.0.39

  What to do

  Affects up to 0.0.39. Update Slides & Presentations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Chamber Dashboard Business Directory: Missing AuthorizationCVE-2025-23917 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Chandrika Guntur, Morgan Kay Chamber Dashboard Business Directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chamber Dashboard Business Directory: from n/a through 3.3.8.

  Product

  Chamber Dashboard Business Directory

  Affected

  up to 3.3.8

  What to do

  Affects up to 3.3.8. Update Chamber Dashboard Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP Meetup: Missing AuthorizationCVE-2025-23916 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Nuanced Media WP Meetup wp-meetup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Meetup: from n/a through <= 2.3.0.

  Product

  WP Meetup

  Affected

  up to 2.3.0

  What to do

  Affects up to 2.3.0. Update WP Meetup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025FAT Event Lite: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-23915 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in roninwp FAT Event Lite fat-event-lite allows PHP Local File Inclusion.This issue affects FAT Event Lite: from n/a through <= 1.1.

  Product

  FAT Event Lite

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update FAT Event Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WordPress Google Map Professional: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23913 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pankajpragma WordPress Google Map Professional google-map-professional allows SQL Injection.This issue affects WordPress Google Map Professional: from n/a through <= 1.0.

  Product

  WordPress Google Map Professional

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WordPress Google Map Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WordPress Custom Sidebar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23912 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Philipp Speck WordPress Custom Sidebar wordpress-custom-sidebar allows Blind SQL Injection.This issue affects WordPress Custom Sidebar: from n/a through <= 2.3.

  Product

  WordPress Custom Sidebar

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update WordPress Custom Sidebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Solidres – Hotel booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23911 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in solidres Solidres – Hotel booking plugin solidres allows SQL Injection.This issue affects Solidres – Hotel booking plugin: from n/a through <= 0.9.4.

  Product

  Solidres – Hotel booking

  Affected

  up to 0.9.4

  What to do

  Affects up to 0.9.4. Update Solidres – Hotel booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Compare Ninja: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23909 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Common Ninja Compare Ninja compare-ninja-comparison-tables allows Stored XSS.This issue affects Compare Ninja: from n/a through <= 2.1.0.

  Product

  Compare Ninja

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Compare Ninja to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Pastebin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23908 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rami Yushuvaev Pastebin pastebin-embed allows Stored XSS.This issue affects Pastebin: from n/a through <= 1.5.

  Product

  Pastebin

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Pastebin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025SOCIAL.NINJA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23907 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in closed SOCIAL.NINJA allows Stored XSS. This issue affects SOCIAL.NINJA: from n/a through 0.2.

  Product

  SOCIAL.NINJA

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update SOCIAL.NINJA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Error Notification: Cross-Site Request Forgery (CSRF)CVE-2025-23902 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Taras Dashkevych Error Notification error-notification allows Cross Site Request Forgery.This issue affects Error Notification: from n/a through <= 0.2.7.

  Product

  Error Notification

  Affected

  up to 0.2.7

  What to do

  Affects up to 0.2.7. Update Error Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025GravatarLocalCache: Cross-Site Request Forgery (CSRF)CVE-2025-23901 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in cybio GravatarLocalCache gravatarlocalcache allows Cross Site Request Forgery.This issue affects GravatarLocalCache: from n/a through <= 1.1.2.

  Product

  GravatarLocalCache

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update GravatarLocalCache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Genki Announcement: Cross-Site Request Forgery (CSRF)CVE-2025-23900 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in genkisan Genki Announcement genki-announcement allows Cross Site Request Forgery.This issue affects Genki Announcement: from n/a through <= 1.4.1.

  Product

  Genki Announcement

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Genki Announcement to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Bookalet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23899 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bookalet Bookalet bookalet allows Stored XSS.This issue affects Bookalet: from n/a through <= 1.0.3.

  Product

  Bookalet

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Bookalet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Apply with LinkedIn buttons: Cross-Site Request Forgery (CSRF)CVE-2025-23898 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ivobrett Apply with LinkedIn buttons apply-with-linkedin-buttons allows Stored XSS.This issue affects Apply with LinkedIn buttons: from n/a through <= 2.3.

  Product

  Apply with LinkedIn buttons

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Apply with LinkedIn buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Apply with LinkedIn buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23897 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ivobrett Apply with LinkedIn buttons apply-with-linkedin-buttons allows DOM-Based XSS.This issue affects Apply with LinkedIn buttons: from n/a through <= 2.3.

  Product

  Apply with LinkedIn buttons

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Apply with LinkedIn buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Mindmeister Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23896 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thom4 Mindmeister Shortcode mindmeister-shortcode allows DOM-Based XSS.This issue affects Mindmeister Shortcode: from n/a through <= 1.0.

  Product

  Mindmeister Shortcode

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Mindmeister Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Add RSS: Cross-Site Request Forgery (CSRF)CVE-2025-23895 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Dan Cameron Add RSS add-rss allows Stored XSS.This issue affects Add RSS: from n/a through <= 1.5.

  Product

  Add RSS

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Add RSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025GMap Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23893 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Manny Costales GMap Shortcode gmap-shortcode allows DOM-Based XSS.This issue affects GMap Shortcode: from n/a through <= 2.0.

  Product

  GMap Shortcode

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update GMap Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Progress Tracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23892 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Furr Progress Tracker progress-tracker allows DOM-Based XSS.This issue affects Progress Tracker: from n/a through <= 0.9.3.

  Product

  Progress Tracker

  Affected

  up to 0.9.3

  What to do

  Affects up to 0.9.3. Update Progress Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Yet Another Countdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23891 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Loy Yet Another Countdown yacp allows DOM-Based XSS.This issue affects Yet Another Countdown: from n/a through <= 1.0.1.

  Product

  Yet Another Countdown

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Yet Another Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Easy Tweet Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23890 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tom Ewer Easy Tweet Embed easy-tweet-embed allows DOM-Based XSS.This issue affects Easy Tweet Embed: from n/a through <= 1.7.

  Product

  Easy Tweet Embed

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Easy Tweet Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.