Vulnerability database

8,915 results · page 57 of 179

• Sep 5, 2025Elementor Element Condition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58796 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dudaster Elementor Element Condition ele-conditions allows Stored XSS.This issue affects Elementor Element Condition: from n/a through <= 1.0.5.

  Product

  Elementor Element Condition

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Elementor Element Condition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025WPB Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58793 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean WPB Elementor Addons wpb-elementor-addons allows Stored XSS.This issue affects WPB Elementor Addons: from n/a through <= 1.7.

  Product

  WPB Elementor Addons

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update WPB Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025SEO Auto Linker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58791 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arjan Olsder SEO Auto Linker wpa-seo-auto-linker allows Stored XSS.This issue affects SEO Auto Linker: from n/a through <= 1.5.3.

  Product

  SEO Auto Linker

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update SEO Auto Linker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Kiwi: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58790 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Kiwi kiwi-social-share allows Stored XSS.This issue affects Kiwi: from n/a through <= 2.1.8.

  Product

  Kiwi

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update Kiwi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025WP Full Stripe Free: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58789 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle WP Full Stripe Free wp-full-stripe-free allows SQL Injection.This issue affects WP Full Stripe Free: from n/a through <= 8.2.5.

  Product

  WP Full Stripe Free

  Affected

  up to 8.2.5

  What to do

  Affects up to 8.2.5. Update WP Full Stripe Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025License Manager for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58788 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Blind SQL Injection.This issue affects License Manager for WooCommerce: from n/a through <= 3.0.12.

  Product

  License Manager for WooCommerce

  Affected

  up to 3.0.12

  What to do

  Affects up to 3.0.12. Update License Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Themify Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58787 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Popup themify-popup allows Stored XSS.This issue affects Themify Popup: from n/a through <= 1.4.2.

  Product

  Themify Popup

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update Themify Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Ibtana – Ecommerce Product Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58786 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VW THEMES Ibtana – Ecommerce Product Addons ibtana-ecommerce-product-addons allows DOM-Based XSS.This issue affects Ibtana – Ecommerce Product Addons: from n/a through <= 0.4.7.6.

  Product

  Ibtana – Ecommerce Product Addons

  Affected

  up to 0.4.7.6

  What to do

  Affects up to 0.4.7.6. Update Ibtana – Ecommerce Product Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025ARI Fancy Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58784 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arisoft ARI Fancy Lightbox ari-fancy-lightbox allows Stored XSS.This issue affects ARI Fancy Lightbox: from n/a through <= 1.4.0.

  Product

  ARI Fancy Lightbox

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update ARI Fancy Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Document Engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58640 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MatrixAddons Document Engine document-engine allows Stored XSS.This issue affects Document Engine: from n/a through <= 1.2.

  Product

  Document Engine

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Document Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025immonex Kickstart: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58637 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in immonex immonex Kickstart immonex-kickstart allows PHP Local File Inclusion.This issue affects immonex Kickstart: from n/a through <= 1.11.6.

  Product

  immonex Kickstart

  Affected

  up to 1.11.6

  What to do

  Affects up to 1.11.6. Update immonex Kickstart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Booking Ultra Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58633 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Stored XSS.This issue affects Booking Ultra Pro: from n/a through <= 1.1.21.

  Product

  Booking Ultra Pro

  Affected

  up to 1.1.21

  What to do

  Affects up to 1.1.21. Update Booking Ultra Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Dadevarzan WordPress Common: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58632 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dadevarzan Dadevarzan WordPress Common dadevarzan-common allows Stored XSS.This issue affects Dadevarzan WordPress Common: from n/a through <= 2.2.2.

  Product

  Dadevarzan WordPress Common

  Affected

  up to 2.2.2

  What to do

  Affects up to 2.2.2. Update Dadevarzan WordPress Common to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025IssueM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58631 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZEEN101 IssueM issuem allows DOM-Based XSS.This issue affects IssueM: from n/a through <= 2.9.0.

  Product

  IssueM

  Affected

  up to 2.9.0

  What to do

  Affects up to 2.9.0. Update IssueM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Simple Matomo Tracking Code: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58630 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rbaer Simple Matomo Tracking Code simple-matomo-tracking-code allows Stored XSS.This issue affects Simple Matomo Tracking Code: from n/a through <= 1.1.0.

  Product

  Simple Matomo Tracking Code

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Simple Matomo Tracking Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025RumbleTalk Live Group Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58626 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Stored XSS.This issue affects RumbleTalk Live Group Chat: from n/a through <= 6.3.5.

  Product

  RumbleTalk Live Group Chat

  Affected

  up to 6.3.5

  What to do

  Affects up to 6.3.5. Update RumbleTalk Live Group Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025WP Flow Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58625 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through <= 5.2.5.

  Product

  WP Flow Plus

  Affected

  up to 5.2.5

  What to do

  Affects up to 5.2.5. Update WP Flow Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Exchange Rates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58624 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in falselight Exchange Rates exchange-rates allows Stored XSS.This issue affects Exchange Rates: from n/a through <= 1.2.5.

  Product

  Exchange Rates

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Exchange Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Event Feed for Eventbrite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58623 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bohemia Plugins Event Feed for Eventbrite event-feed-for-eventbrite allows DOM-Based XSS.This issue affects Event Feed for Eventbrite: from n/a through <= 1.3.2.

  Product

  Event Feed for Eventbrite

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update Event Feed for Eventbrite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025PuzzleMe for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58621 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amuse Labs PuzzleMe for WordPress puzzleme allows Stored XSS.This issue affects PuzzleMe for WordPress: from n/a through <= 1.2.0.

  Product

  PuzzleMe for

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update PuzzleMe for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025PDF for WPForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58620 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Stored XSS.This issue affects PDF for WPForms: from n/a through <= 6.2.1.

  Product

  PDF for WPForms

  Affected

  up to 6.2.1

  What to do

  Affects up to 6.2.1. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Pie Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58618 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Jernigan Pie Calendar pie-calendar allows DOM-Based XSS.This issue affects Pie Calendar: from n/a through <= 1.2.8.

  Product

  Pie Calendar

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update Pie Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Tooltipy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58614 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows Stored XSS.This issue affects Tooltipy: from n/a through <= 5.5.6.

  Product

  Tooltipy

  Affected

  up to 5.5.6

  What to do

  Affects up to 5.5.6. Update Tooltipy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025PropertyHive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58612 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Stored XSS.This issue affects PropertyHive: from n/a through <= 2.1.5.

  Product

  PropertyHive

  Affected

  up to 2.1.5

  What to do

  Affects up to 2.1.5. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Gallery PhotoBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58610 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through <= 1.3.1.

  Product

  Gallery PhotoBlocks

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Gallery PhotoBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Latest Post Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58609 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Stored XSS.This issue affects Latest Post Shortcode: from n/a through <= 14.0.3.

  Product

  Latest Post Shortcode

  Affected

  up to 14.0.3

  What to do

  Affects up to 14.0.3. Update Latest Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025MediaPress: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58608 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuddyDev MediaPress mediapress allows PHP Local File Inclusion.This issue affects MediaPress: from n/a through <= 1.5.9.1.

  Product

  MediaPress

  Affected

  up to 1.5.9.1

  What to do

  Affects up to 1.5.9.1. Update MediaPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Cookie Notice & Consent Banner for GDPR & CCPA Compliance: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58607 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA Compliance cookie-notice-and-consent-banner allows Stored XSS.This issue affects Cookie Notice & Consent Banner for GDPR & CCPA Compliance: from n/a through <= 1.7.11.

  Product

  Cookie Notice & Consent Banner for GDPR & CCPA Compliance

  Affected

  up to 1.7.11

  What to do

  Affects up to 1.7.11. Update Cookie Notice & Consent Banner for GDPR & CCPA Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025WP Delicious: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58605 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows Stored XSS.This issue affects WP Delicious: from n/a through <= 1.8.7.

  Product

  WP Delicious

  Affected

  up to 1.8.7

  What to do

  Affects up to 1.8.7. Update WP Delicious to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Mail Mint: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58604 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint mail-mint allows SQL Injection.This issue affects Mail Mint: from n/a through <= 1.18.5.

  Product

  Mail Mint

  Affected

  up to 1.18.5

  What to do

  Affects up to 1.18.5. Update Mail Mint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025If-So Dynamic Content Personalization: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58602 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Stored XSS.This issue affects If-So Dynamic Content Personalization: from n/a through <= 1.9.4.

  Product

  If-So Dynamic Content Personalization

  Affected

  up to 1.9.4

  What to do

  Affects up to 1.9.4. Update If-So Dynamic Content Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025MailOptin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58596 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in properfraction MailOptin mailoptin allows Stored XSS.This issue affects MailOptin: from n/a through <= 1.2.75.0.

  Product

  MailOptin

  Affected

  up to 1.2.75.0

  What to do

  Affects up to 1.2.75.0. Update MailOptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Orbit Fox by ThemeIsle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58593 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allows Stored XSS.This issue affects Orbit Fox by ThemeIsle: from n/a through <= 3.0.0.

  Product

  Orbit Fox by ThemeIsle

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update Orbit Fox by ThemeIsle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 31, 2025Blog Designer PRO: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47696 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.

  Product

  Blog Designer PRO

  Affected

  up to 3.4.7

  What to do

  Affects up to 3.4.7. Update Blog Designer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025YouTube Showcase: Improper Control of Generation of Code ('Code Injection')CVE-2025-54731 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Generation of Code ('Code Injection') vulnerability in emarket-design YouTube Showcase youtube-showcase allows Object Injection.This issue affects YouTube Showcase: from n/a through <= 3.5.1.

  Product

  YouTube Showcase

  Affected

  up to 3.5.1

  What to do

  Affects up to 3.5.1. Update YouTube Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Golo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54724 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Golo golo allows Reflected XSS.This issue affects Golo: from n/a through <= 1.7.1.

  Product

  Golo

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update Golo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Nest Addons: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-54720 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SteelThemes Nest Addons nest-addons allows SQL Injection.This issue affects Nest Addons: from n/a through <= 1.6.3.

  Product

  Nest Addons

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update Nest Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Ireca: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-54716 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Ireca ireca allows PHP Local File Inclusion.This issue affects Ireca: from n/a through <= 1.8.5.

  Product

  Ireca

  Affected

  up to 1.8.5

  What to do

  Affects up to 1.8.5. Update Ireca to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025WooCommerce csv import export: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-54029 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in extendons WooCommerce csv import export extendons-eo-wooimport-export allows Path Traversal.This issue affects WooCommerce csv import export: from n/a through <= 2.0.6.

  Product

  WooCommerce csv import export

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update WooCommerce csv import export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025UPC/EAN/GTIN Code Generator: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-53588 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator upc-ean-barcode-generator allows Path Traversal.This issue affects UPC/EAN/GTIN Code Generator: from n/a through <= 2.0.2.

  Product

  UPC/EAN/GTIN Code Generator

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update UPC/EAN/GTIN Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Captcha.eu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53579 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captcha.eu Captcha.eu captcha-eu allows Reflected XSS.This issue affects Captcha.eu: from n/a through < 1.0.61.

  Product

  Captcha.eu

  What to do

  Update Captcha.eu to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Kipso: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53578 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kipso kipso allows PHP Local File Inclusion.This issue affects Kipso: from n/a through <= 1.3.4.

  Product

  Kipso

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update Kipso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Ovatheme Events: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53576 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Ovatheme Events ova-events allows PHP Local File Inclusion.This issue affects Ovatheme Events: from n/a through <= 1.2.8.

  Product

  Ovatheme Events

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update Ovatheme Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Jannah: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53334 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TieLabs Jannah jannah allows PHP Local File Inclusion.This issue affects Jannah: from n/a through < 7.5.1.

  Product

  Jannah

  What to do

  Update Jannah to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Poll, Survey & Quiz Maker Plugin by Opinion Stage: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53328 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Opinion Stage Poll, Survey & Quiz Maker Plugin by Opinion Stage social-polls-by-opinionstage allows PHP Local File Inclusion.This issue affects Poll, Survey & Quiz Maker Plugin by Opinion Stage: from n/a through <= 19.11.0.

  Product

  Poll, Survey & Quiz Maker Plugin by Opinion Stage

  Affected

  up to 19.11.0

  What to do

  Affects up to 19.11.0. Update Poll, Survey & Quiz Maker Plugin by Opinion Stage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Gutenify: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53326 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodeYatri Gutenify gutenify allows PHP Local File Inclusion.This issue affects Gutenify: from n/a through <= 1.5.4.

  Product

  Gutenify

  Affected

  up to 1.5.4

  What to do

  Affects up to 1.5.4. Update Gutenify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Theme Blvd Widget Areas: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53289 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Theme Blvd Widget Areas theme-blvd-widget-areas allows Reflected XSS.This issue affects Theme Blvd Widget Areas: from n/a through <= 1.3.0.

  Product

  Theme Blvd Widget Areas

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Theme Blvd Widget Areas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Magazine: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53248 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magazine eximious-magazine allows PHP Local File Inclusion.This issue affects Magazine: from n/a through <= 1.2.2.

  Product

  Magazine

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025BlogMarks: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53247 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpinterface BlogMarks blogmarks allows PHP Local File Inclusion.This issue affects BlogMarks: from n/a through <= 1.0.8.

  Product

  BlogMarks

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update BlogMarks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Magazine Elite: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53244 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magazine Elite magazine-elite allows PHP Local File Inclusion.This issue affects Magazine Elite: from n/a through <= 1.2.4.

  Product

  Magazine Elite

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update Magazine Elite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.