Vulnerability database

5,819 results · page 60 of 117

• Feb 24, 2025Quotes llama: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27307 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oooorgle Quotes llama quotes-llama allows Reflected XSS.This issue affects Quotes llama: from n/a through <= 3.0.1.

  Product

  Quotes llama

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update Quotes llama to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Pathomation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27306 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pathomation Pathomation pathomation allows Stored XSS.This issue affects Pathomation: from n/a through <= 2.5.1.

  Product

  Pathomation

  Affected

  up to 2.5.1

  What to do

  Affects up to 2.5.1. Update Pathomation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Table of Contents Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27305 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Achal Jain Table of Contents Block table-of-contents allows Stored XSS.This issue affects Table of Contents Block: from n/a through <= 1.0.2.

  Product

  Table of Contents Block

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Table of Contents Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Contact Form 7 Star Rating with font Awesome: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27304 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelogger Contact Form 7 Star Rating with font Awesome contact-form-7-star-rating-with-font-awersome allows Stored XSS.This issue affects Contact Form 7 Star Rating with font Awesome: from n/a through <= 1.3.

  Product

  Contact Form 7 Star Rating with font Awesome

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Contact Form 7 Star Rating with font Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Contact Form 7 Star Rating: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27303 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelogger Contact Form 7 Star Rating contact-form-7-star-rating allows Stored XSS.This issue affects Contact Form 7 Star Rating: from n/a through <= 1.10.

  Product

  Contact Form 7 Star Rating

  Affected

  up to 1.10

  What to do

  Affects up to 1.10. Update Contact Form 7 Star Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Erima Zarinpal Donate: Cross-Site Request Forgery (CSRF)CVE-2025-27290 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in seyyed-amir Erima Zarinpal Donate erima-zarinpal-donate allows Cross Site Request Forgery.This issue affects Erima Zarinpal Donate: from n/a through <= 1.0.

  Product

  Erima Zarinpal Donate

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Erima Zarinpal Donate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Archive Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27280 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alobaidi Archive Page archive-page allows DOM-Based XSS.This issue affects Archive Page: from n/a through <= 1.0.2.

  Product

  Archive Page

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Archive Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Hover Image Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27266 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ignacio Perez Hover Image Button hover-image-button allows DOM-Based XSS.This issue affects Hover Image Button: from n/a through <= 1.1.2.

  Product

  Hover Image Button

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Hover Image Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Google Maps for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27265 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aaron D. Campbell Google Maps for WordPress google-maps-for-wordpress allows DOM-Based XSS.This issue affects Google Maps for WordPress: from n/a through <= 1.0.3.

  Product

  Google Maps for

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Google Maps for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 23, 2025Eventer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22635 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes Eventer eventer allows Reflected XSS.This issue affects Eventer: from n/a through < 3.9.9.

  Product

  Eventer

  Fixed in

  3.9.9

  What to do

  Update Eventer to 3.9.9 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Feb 23, 2025WooCommerce Pricing – Product Pricing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22632 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalsoft WooCommerce Pricing – Product Pricing woo-pricing-table allows Stored XSS.This issue affects WooCommerce Pricing – Product Pricing: from n/a through <= 1.0.9.

  Product

  WooCommerce Pricing – Product Pricing

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update WooCommerce Pricing – Product Pricing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 23, 2025Marketing Automation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22631 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vbout Marketing Automation marketing-automation allows Reflected XSS.This issue affects Marketing Automation: from n/a through <= 1.2.6.8.

  Product

  Marketing Automation

  Affected

  up to 1.2.6.8

  What to do

  Affects up to 1.2.6.8. Update Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 22, 2025Social Warfare: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26973 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WarfarePlugins Social Warfare social-warfare allows DOM-Based XSS.This issue affects Social Warfare: from n/a through <= 4.5.5.

  Product

  Social Warfare

  Affected

  up to 4.5.5

  What to do

  Affects up to 4.5.5. Update Social Warfare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 22, 2025Responsive Modal Builder for High Conversion – Easy Popups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26774 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rock Solid Responsive Modal Builder for High Conversion – Easy Popups easy-popups allows Reflected XSS.This issue affects Responsive Modal Builder for High Conversion – Easy Popups: from n/a through <= 1.5.0.

  Product

  Responsive Modal Builder for High Conversion – Easy Popups

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update Responsive Modal Builder for High Conversion – Easy Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 22, 2025Magic the Gathering Card Tooltips: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26756 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grimdonkey Magic the Gathering Card Tooltips magic-the-gathering-card-tooltips allows Stored XSS.This issue affects Magic the Gathering Card Tooltips: from n/a through <= 3.5.0.

  Product

  Magic the Gathering Card Tooltips

  Affected

  up to 3.5.0

  What to do

  Affects up to 3.5.0. Update Magic the Gathering Card Tooltips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2025Pinpoint Booking System – #1 WordPress Booking: SQL InjectionCVE-2024-13235 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'language' parameter in all versions up to, and including, 2.9.9.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  Product

  Pinpoint Booking System – #1 WordPress Booking

  Affected

  up to 2.9.9.5.4

  What to do

  Affects up to 2.9.9.5.4. Update Pinpoint Booking System – #1 WordPress Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 18, 2025Drivr Lite – Google Drive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27016 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Drivr Lite – Google Drive Plugin allows Stored XSS. This issue affects Drivr Lite – Google Drive Plugin: from n/a through 1.0.1.

  Product

  Drivr Lite – Google Drive

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Drivr Lite – Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 18, 2025Smartarget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22650 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Erez Hadas-Sonnenschein Smartarget smartarget-contact-us allows Stored XSS.This issue affects Smartarget: from n/a through <= 1.5.3.

  Product

  Smartarget

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update Smartarget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 17, 2025Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26778 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Gallery gallery allows Stored XSS.This issue affects Gallery: from n/a through <= 2.2.1.

  Product

  Gallery

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 17, 2025BEAR: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26775 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 BEAR woo-bulk-editor allows Stored XSS.This issue affects BEAR: from n/a through <= 1.1.4.4.

  Product

  BEAR

  Affected

  up to 1.1.4.4

  What to do

  Affects up to 1.1.4.4. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 17, 2025DethemeKit For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26772 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through <= 2.1.8.

  Product

  DethemeKit For Elementor

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update DethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 17, 2025SKT Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26771 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This issue affects SKT Blocks: from n/a through <= 1.7.

  Product

  SKT Blocks

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update SKT Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 17, 2025Waymark: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26770 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Waymark waymark allows Stored XSS.This issue affects Waymark: from n/a through <= 1.5.0.

  Product

  Waymark

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update Waymark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 17, 2025Vertex Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26769 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webilia Inc. Vertex Addons for Elementor addons-for-elementor-builder allows Stored XSS.This issue affects Vertex Addons for Elementor: from n/a through <= 1.2.0.

  Product

  Vertex Addons for Elementor

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Vertex Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 17, 2025Timeline Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26754 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Timeline Block timeline-block-block allows Stored XSS.This issue affects Timeline Block: from n/a through <= 1.1.1.

  Product

  Timeline Block

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Timeline Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 17, 2025ImageMeta: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23845 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 ImageMeta imagemeta allows Reflected XSS.This issue affects ImageMeta: from n/a through <= 1.1.2.

  Product

  ImageMeta

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update ImageMeta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 17, 2025WP-NOTCAPTCHA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23840 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webjema WP-NOTCAPTCHA wp-notcaptcha allows Reflected XSS.This issue affects WP-NOTCAPTCHA: from n/a through <= 1.3.1.

  Product

  WP-NOTCAPTCHA

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update WP-NOTCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 16, 2025Qubely: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26767 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through <= 1.8.12.

  Product

  Qubely

  Affected

  up to 1.8.12

  What to do

  Affects up to 1.8.12. Update Qubely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 16, 2025Leyka: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26766 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka leyka allows Stored XSS.This issue affects Leyka: from n/a through <= 3.31.8.

  Product

  Leyka

  Affected

  up to 3.31.8

  What to do

  Affects up to 3.31.8. Update Leyka to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 16, 2025Easy Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26761 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows DOM-Based XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.1.5.

  Product

  Easy Elementor Addons

  Affected

  up to 2.1.5

  What to do

  Affects up to 2.1.5. Update Easy Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 16, 2025Botnet Attack Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23975 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cheesefather Botnet Attack Blocker botnet-attack-blocker allows Stored XSS.This issue affects Botnet Attack Blocker: from n/a through <= 2.0.0.

  Product

  Botnet Attack Blocker

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Botnet Attack Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 16, 2025Forex Calculators: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22689 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Levan Tarbor Forex Calculators fx-calculators allows Stored XSS.This issue affects Forex Calculators: from n/a through <= 1.3.6.

  Product

  Forex Calculators

  Affected

  up to 1.3.6

  What to do

  Affects up to 1.3.6. Update Forex Calculators to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 16, 2025Ad Inserter Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22680 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Ad Inserter Pro allows Reflected XSS. This issue affects Ad Inserter Pro: from n/a through 2.7.39.

  Product

  Ad Inserter Pro

  Affected

  up to 2.7.39

  What to do

  Affects up to 2.7.39. Update Ad Inserter Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 16, 2025AWS S3 for WordPress Plugin – Upcasted: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22676 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in upcasted AWS S3 for WordPress Plugin – Upcasted upcasted-s3-offload allows Stored XSS.This issue affects AWS S3 for WordPress Plugin – Upcasted: from n/a through <= 3.0.3.

  Product

  AWS S3 for WordPress Plugin – Upcasted

  Affected

  up to 3.0.3

  What to do

  Affects up to 3.0.3. Update AWS S3 for WordPress Plugin – Upcasted to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 16, 2025LTL Freight Quotes – Worldwide Express Edition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22286 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows Reflected XSS.This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through <= 5.0.21.

  Product

  LTL Freight Quotes – Worldwide Express Edition

  Affected

  up to 5.0.21

  What to do

  Affects up to 5.0.21. Update LTL Freight Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 16, 2025LTL Freight Quotes – Unishippers Edition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22284 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology LTL Freight Quotes – Unishippers Edition ltl-freight-quotes-unishippers-edition allows Reflected XSS.This issue affects LTL Freight Quotes – Unishippers Edition: from n/a through <= 2.5.8.

  Product

  LTL Freight Quotes – Unishippers Edition

  Affected

  up to 2.5.8

  What to do

  Affects up to 2.5.8. Update LTL Freight Quotes – Unishippers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 16, 2025Oshine Modules: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44044 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandexponents Oshine Modules oshine-modules allows Reflected XSS.This issue affects Oshine Modules: from n/a through < 3.3.8.

  Product

  Oshine Modules

  What to do

  Update Oshine Modules to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Feb 14, 2025WP Event Aggregator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24700 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator wp-event-aggregator allows Reflected XSS.This issue affects WP Event Aggregator: from n/a through <= 1.8.2.

  Product

  WP Event Aggregator

  Affected

  up to 1.8.2

  What to do

  Affects up to 1.8.2. Update WP Event Aggregator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 14, 2025WP Mailster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24688 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.This issue affects WP Mailster: from n/a through <= 1.8.20.0.

  Product

  WP Mailster

  Affected

  up to 1.8.20.0

  What to do

  Affects up to 1.8.20.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 14, 2025Better WishList API: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24641 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rickonline_nl Better WishList API better-wlm-api allows Stored XSS.This issue affects Better WishList API: from n/a through <= 1.1.3.

  Product

  Better WishList API

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Better WishList API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 14, 2025AcyMailing SMTP Newsletter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24617 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through < 9.11.1.

  Product

  AcyMailing SMTP Newsletter

  What to do

  Update AcyMailing SMTP Newsletter to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Feb 14, 2025Uix Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24616 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UIUX Lab Uix Page Builder uix-page-builder allows Reflected XSS.This issue affects Uix Page Builder: from n/a through <= 1.7.3.

  Product

  Uix Page Builder

  Affected

  up to 1.7.3

  What to do

  Affects up to 1.7.3. Update Uix Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 14, 2025Analytics Cat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24615 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Analytics Cat analytics-cat allows Reflected XSS.This issue affects Analytics Cat: from n/a through <= 1.1.2.

  Product

  Analytics Cat

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Analytics Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 14, 2025Post Timeline: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24614 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agile Logix Post Timeline post-timeline allows Reflected XSS.This issue affects Post Timeline: from n/a through <= 2.3.9.

  Product

  Post Timeline

  Affected

  up to 2.3.9

  What to do

  Affects up to 2.3.9. Update Post Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 14, 2025Customize My Account for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24592 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SysBasics Customize My Account for WooCommerce customize-my-account-for-woocommerce allows Reflected XSS.This issue affects Customize My Account for WooCommerce: from n/a through <= 2.8.22.

  Product

  Customize My Account for WooCommerce

  Affected

  up to 2.8.22

  What to do

  Affects up to 2.8.22. Update Customize My Account for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 14, 2025Intro Tour Tutorial DeepPresentation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24566 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomáš Groulík Intro Tour Tutorial DeepPresentation dp-intro-tours allows Reflected XSS.This issue affects Intro Tour Tutorial DeepPresentation: from n/a through <= 6.5.2.

  Product

  Intro Tour Tutorial DeepPresentation

  Affected

  up to 6.5.2

  What to do

  Affects up to 6.5.2. Update Intro Tour Tutorial DeepPresentation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 14, 2025WP2LEADS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24565 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through <= 3.3.3.

  Product

  WP2LEADS

  Affected

  up to 3.3.3

  What to do

  Affects up to 3.3.3. Update WP2LEADS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 14, 2025Contact Form With Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24564 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Contact Form With Shortcode contact-form-with-shortcode allows Reflected XSS.This issue affects Contact Form With Shortcode: from n/a through <= 4.2.5.

  Product

  Contact Form With Shortcode

  Affected

  up to 4.2.5

  What to do

  Affects up to 4.2.5. Update Contact Form With Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 14, 2025CRM Perks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24558 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks support-x allows Reflected XSS.This issue affects CRM Perks: from n/a through <= 1.1.5.

  Product

  CRM Perks

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update CRM Perks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 14, 2025AWcode Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24554 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode AWcode Toolkit awcode-toolkit allows Reflected XSS.This issue affects AWcode Toolkit: from n/a through <= 1.0.14.

  Product

  AWcode Toolkit

  Affected

  up to 1.0.14

  What to do

  Affects up to 1.0.14. Update AWcode Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.