Updated 7 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

557new WordPress flaws this week

391,528entries in the database

9,243 results · page 64 of 185

Aug 11, 2025Simple Responsive Slider: Stored Cross-Site ScriptingCVE-2025-8690 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Responsive Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Responsive Slider
Affected
up to 2.0
What to do
Affects up to 2.0. Update Simple Responsive Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Aug 5, 2025WP Import Export Lite: Arbitrary file uploadsCVE-2025-6207 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_tempalte_import' function in all versions up to, and including, 3.9.28. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WP Import Export Lite
Affected
up to 3.9.28
What to do
Affects up to 3.9.28. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025WP Import Export Lite: Arbitrary file uploadsCVE-2025-5061 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 3.9.29.
Product
WP Import Export Lite
Affected
up to 3.9.29
What to do
Affects up to 3.9.29. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2025The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site ImportsCVE-2025-4684 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of Image Carousel and Image Slider widgets in all versions up to, and including, 3.2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.2.13.1
What to do
Affects up to 3.2.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 26, 2025WoodMart: Improper Input ValidationCVE-2025-8097 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation of the qty parameter in the woodmart_update_cart_item function. This makes it possible for unauthenticated attackers to manipulate cart quantities using fractional values, allowing them to obtain products for free by setting extremely small quantities (e.g., 0.00001) that round cart totals to $0.00, effectively bypassing payment requirements and allowing unauthorized acquisition of virtual or downloadable products.
Product
WoodMart
Affected
up to 8.2.6
What to do
Affects up to 8.2.6. Update WoodMart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jul 19, 2025Simple Backup: Arbitrary File DownloadCVE-2015-10134 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Simple Backup plugin for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.7.10. via the download_backup_file function. This is due to a lack of capability checks and file type validation. This makes it possible for attackers to download sensitive files such as the wp-config.php file from the affected site.
Product
Simple Backup
Affected
up to 2.7.10
What to do
Affects up to 2.7.10. Update Simple Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordfence.com
Jul 16, 2025Pakke Envíos: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52819 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pakkemx Pakke Envíos pakke allows SQL Injection.This issue affects Pakke Envíos: from n/a through <= 1.0.2.
Product
Pakke Envíos
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Pakke Envíos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Tennis Court Bookings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52787 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EZiHosting Tennis Court Bookings tennis-court-bookings allows Reflected XSS.This issue affects Tennis Court Bookings: from n/a through <= 1.2.7.
Product
Tennis Court Bookings
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Tennis Court Bookings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Media Folder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52786 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kingdom Creation Media Folder media-folder allows Reflected XSS.This issue affects Media Folder: from n/a through <= 1.0.0.
Product
Media Folder
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Media Folder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Dot html,php,xml etc pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52779 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc-pages allows Reflected XSS.This issue affects Dot html,php,xml etc pages: from n/a through <= 1.0.
Product
Dot html,php,xml etc pages
Affected
up to 1.0
What to do
Affects up to 1.0. Update Dot html,php,xml etc pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Pay with Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52777 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Reflected XSS.This issue affects Pay with Contact Form 7: from n/a through <= 1.0.4.
Product
Pay with Contact Form 7
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Pay with Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52714 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows SQL Injection.This issue affects Traveler: from n/a through < 3.2.2.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025ProfileGrid: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49876 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows SQL Injection.This issue affects ProfileGrid : from n/a through <= 5.9.5.2.
Product
ProfileGrid
Affected
up to 5.9.5.2
What to do
Affects up to 5.9.5.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Funnel Builder by FunnelKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49034 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows SQL Injection.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.10.2.
Product
Funnel Builder by FunnelKit
Affected
up to 3.10.2
What to do
Affects up to 3.10.2. Update Funnel Builder by FunnelKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025SMu Manual DoFollow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49031 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefan M. SMu Manual DoFollow manuall-dofollow allows Reflected XSS.This issue affects SMu Manual DoFollow: from n/a through <= 1.8.1.
Product
SMu Manual DoFollow
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update SMu Manual DoFollow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Contact Form 7 Editor Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48345 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arisoft Contact Form 7 Editor Button cf7-editor-button allows Reflected XSS.This issue affects Contact Form 7 Editor Button: from n/a through <= 1.0.0.
Product
Contact Form 7 Editor Button
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Contact Form 7 Editor Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Contest Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48291 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through <= 26.0.6.
Product
Contest Gallery
Affected
up to 26.0.6
What to do
Affects up to 26.0.6. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Infility Global: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47652 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Reflected XSS.This issue affects Infility Global: from n/a through <= 2.13.4.
Product
Infility Global
Affected
up to 2.13.4
What to do
Affects up to 2.13.4. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47645 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through <= 1.4.9.
Product
ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025CSS3 Compare Pricing Tables for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47554 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress css3_web_pricing_tables_grids allows Reflected XSS.This issue affects CSS3 Compare Pricing Tables for WordPress: from n/a through <= 11.6.
Product
CSS3 Compare Pricing Tables for
Affected
up to 11.6
What to do
Affects up to 11.6. Update CSS3 Compare Pricing Tables for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Wordpress Auto Spinner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46500 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Reflected XSS.This issue affects Wordpress Auto Spinner: from n/a through <= 3.26.0.
Product
Wordpress Auto Spinner
Affected
up to 3.26.0
What to do
Affects up to 3.26.0. Update Wordpress Auto Spinner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025WPGYM: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32574 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPGYM allows SQL Injection. This issue affects WPGYM: from n/a through 65.0.
Product
WPGYM
Affected
up to 65.0
What to do
Affects up to 65.0. Update WPGYM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Invico - WordPress Consulting Business: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31427 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Invico - WordPress Consulting Business Theme invico allows Reflected XSS.This issue affects Invico - WordPress Consulting Business Theme: from n/a through <= 1.9.
Product
Invico - WordPress Consulting Business
Affected
up to 1.9
What to do
Affects up to 1.9. Update Invico - WordPress Consulting Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Ofiz - WordPress Business Consulting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31072 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Ofiz - WordPress Business Consulting Theme ofiz allows Reflected XSS.This issue affects Ofiz - WordPress Business Consulting Theme: from n/a through <= 2.0.
Product
Ofiz - WordPress Business Consulting
Affected
up to 2.0
What to do
Affects up to 2.0. Update Ofiz - WordPress Business Consulting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025HTML5 Radio Player - WPBakery Page Builder Addon: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31070 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon lbg-cleverbakery allows Path Traversal.This issue affects HTML5 Radio Player - WPBakery Page Builder Addon: from n/a through <= 2.5.
Product
HTML5 Radio Player - WPBakery Page Builder Addon
Affected
up to 2.5
What to do
Affects up to 2.5. Update HTML5 Radio Player - WPBakery Page Builder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Electrician - Electrical Service: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31055 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vergatheme Electrician - Electrical Service WordPress electrician allows Reflected XSS.This issue affects Electrician - Electrical Service WordPress: from n/a through <= 1.0.
Product
Electrician - Electrical Service
Affected
up to 1.0
What to do
Affects up to 1.0. Update Electrician - Electrical Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025ListingEasy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30955 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes ListingEasy listingeasy allows Reflected XSS.This issue affects ListingEasy: from n/a through <= 1.9.2.
Product
ListingEasy
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update ListingEasy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Torod: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30936 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Torod Company for Information Technology Torod torod allows SQL Injection.This issue affects Torod: from n/a through <= 2.1.
Product
Torod
Affected
up to 2.1
What to do
Affects up to 2.1. Update Torod to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025WP Pipes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28982 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress WP Pipes allows SQL Injection. This issue affects WP Pipes: from n/a through 1.4.3.
Product
WP Pipes
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update WP Pipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025URL Shortener: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28959 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows SQL Injection.This issue affects URL Shortener: from n/a through <= 3.0.7.
Product
URL Shortener
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update URL Shortener to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Easy Video Player Wordpress & WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-28955 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in FWDesign Easy Video Player Wordpress & WooCommerce fwdevp allows Path Traversal.This issue affects Easy Video Player Wordpress & WooCommerce: from n/a through <= 10.0.
Product
Easy Video Player Wordpress & WooCommerce
Affected
up to 10.0
What to do
Affects up to 10.0. Update Easy Video Player Wordpress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025WP-BusinessDirectory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24759 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Blind SQL Injection.This issue affects WP-BusinessDirectory: from n/a through <= 3.1.4.
Product
WP-BusinessDirectory
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update WP-BusinessDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025LightBox Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54051 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through <= 1.1.30.
Product
LightBox Block
Affected
up to 1.1.30
What to do
Affects up to 1.1.30. Update LightBox Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Responsive Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54050 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Stored XSS.This issue affects Responsive Addons for Elementor: from n/a through <= 1.7.3.
Product
Responsive Addons for Elementor
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Responsive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025SMTP for Amazon SES: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-54043 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce SMTP for Amazon SES smtp-amazon-ses allows SQL Injection.This issue affects SMTP for Amazon SES: from n/a through <= 1.9.
Product
SMTP for Amazon SES
Affected
up to 1.9
What to do
Affects up to 1.9. Update SMTP for Amazon SES to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025GymBase Theme Classes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-54026 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuanticaLabs GymBase Theme Classes gymbase_classes allows SQL Injection.This issue affects GymBase Theme Classes: from n/a through <= 1.4.
Product
GymBase Theme Classes
Affected
up to 1.4
What to do
Affects up to 1.4. Update GymBase Theme Classes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025WPAdverts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54024 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.This issue affects WPAdverts: from n/a through <= 2.2.5.
Product
WPAdverts
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update WPAdverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025WP Delicious: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54023 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows DOM-Based XSS.This issue affects WP Delicious: from n/a through <= 1.8.4.
Product
WP Delicious
Affected
up to 1.8.4
What to do
Affects up to 1.8.4. Update WP Delicious to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Videopack: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54016 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Gilman Videopack video-embed-thumbnail-generator allows DOM-Based XSS.This issue affects Videopack: from n/a through <= 4.10.3.
Product
Videopack
Affected
up to 4.10.3
What to do
Affects up to 4.10.3. Update Videopack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025HT Contact Form 7: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-54015 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows PHP Local File Inclusion.This issue affects HT Contact Form 7: from n/a through <= 2.0.0.
Product
HT Contact Form 7
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update HT Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54013 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through <= 2.11.16.
Product
Welcart e-Commerce
Affected
up to 2.11.16
What to do
Affects up to 2.11.16. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetSmartFilters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54009 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through <= 3.6.8.
Product
JetSmartFilters
Affected
up to 3.6.8
What to do
Affects up to 3.6.8. Update JetSmartFilters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54006 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.4.1.
Product
Bold Page Builder
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53996 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows Stored XSS.This issue affects JetSearch: from n/a through <= 3.5.10.1.
Product
JetSearch
Affected
up to 3.5.10.1
What to do
Affects up to 3.5.10.1. Update JetSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetPopup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53995 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetPopup jet-popup allows Stored XSS.This issue affects JetPopup: from n/a through <= 2.0.15.1.
Product
JetPopup
Affected
up to 2.0.15.1
What to do
Affects up to 2.0.15.1. Update JetPopup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetPopup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53994 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetPopup jet-popup allows DOM-Based XSS.This issue affects JetPopup: from n/a through <= 2.0.15.
Product
JetPopup
Affected
up to 2.0.15
What to do
Affects up to 2.0.15. Update JetPopup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetTricks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTricks jet-tricks allows Stored XSS.This issue affects JetTricks: from n/a through <= 1.5.4.1.
Product
JetTricks
Affected
up to 1.5.4.1
What to do
Affects up to 1.5.4.1. Update JetTricks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetBlocks For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53989 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.19.
Product
JetBlocks For Elementor
Affected
up to 1.3.19
What to do
Affects up to 1.3.19. Update JetBlocks For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetTabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53984 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through <= 2.2.9.
Product
JetTabs
Affected
up to 2.2.9
What to do
Affects up to 2.2.9. Update JetTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53982 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.7.
Product
JetElements For Elementor
Affected
up to 2.7.7
What to do
Affects up to 2.7.7. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.