Vulnerability database

9,243 results · page 65 of 185

• Jul 16, 2025SMTP for SendGrid – YaySMTP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48301 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce SMTP for SendGrid – YaySMTP smtp-sendgrid allows SQL Injection.This issue affects SMTP for SendGrid – YaySMTP: from n/a through <= 1.5.

  Product

  SMTP for SendGrid – YaySMTP

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update SMTP for SendGrid – YaySMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025YayExtra: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48299 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayExtra yayextra allows SQL Injection.This issue affects YayExtra: from n/a through <= 1.5.5.

  Product

  YayExtra

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update YayExtra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Easy Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48295 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Stored XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.2.5.

  Product

  Easy Elementor Addons

  Affected

  up to 2.2.5

  What to do

  Affects up to 2.2.5. Update Easy Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025YaySMTP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48161 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP smtp-sendinblue allows SQL Injection.This issue affects YaySMTP: from n/a through <= 1.3.

  Product

  YaySMTP

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update YaySMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Image Wall: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48156 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Parakoos Image Wall image-wall allows Stored XSS.This issue affects Image Wall: from n/a through <= 3.1.

  Product

  Image Wall

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update Image Wall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Import CDN-Remote Images: Cross-Site Request Forgery (CSRF)CVE-2025-48153 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au Import CDN-Remote Images import-cdn-remote-images allows Stored XSS.This issue affects Import CDN-Remote Images: from n/a through <= 2.1.2.

  Product

  Import CDN-Remote Images

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Import CDN-Remote Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 12, 2025AIT CSV import/export: Arbitrary file uploadsCVE-2020-36849 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-content/plugins/ait-csv-import-export/admin/upload-handler.php file in versions up to, and including, 3.0.3. This makes it possible for unauthorized attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

  Product

  AIT CSV import/export

  Affected

  up to 3.0.3

  What to do

  Affects up to 3.0.3. Update AIT CSV import/export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comraw.githubusercontent.com

• Jul 12, 2025Simple-File-List: Remote Code ExecutionCVE-2020-36847 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.

  Product

  Simple-File-List

  Affected

  up to 4.2.2

  What to do

  Affects up to 4.2.2. Update Simple-File-List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org

• Jul 9, 2025Simple Featured Image: Stored Cross-Site ScriptingCVE-2025-7059 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Simple Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slideshow’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Simple Featured Image

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Simple Featured Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Jul 8, 2025An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary userCVE-2025-34077 · WordPress plugins & themes · reported by VulnCheckCritical 10

  An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordgithub.comgithub.com

• Jul 7, 2025Zilom: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43334 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gavias Zilom zilom allows Reflected XSS.This issue affects Zilom: from n/a through < 1.4.5.

  Product

  Zilom

  What to do

  Update Zilom to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52833 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in designthemes LMS lms allows SQL Injection.This issue affects LMS: from n/a through <= 9.2.

  Product

  LMS

  Affected

  up to 9.2

  What to do

  Affects up to 9.2. Update LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025NGG Smart Image Search: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52832 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows SQL Injection.This issue affects NGG Smart Image Search: from n/a through <= 3.4.1.

  Product

  NGG Smart Image Search

  Affected

  up to 3.4.1

  What to do

  Affects up to 3.4.1. Update NGG Smart Image Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Video List Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52831 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in thanhtungtnt Video List Manager video-list-manager allows SQL Injection.This issue affects Video List Manager: from n/a through <= 1.7.

  Product

  Video List Manager

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Video List Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025bSecure – Your Universal Checkout: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52830 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bSecure – Your Universal Checkout bSecure – Your Universal Checkout bsecure allows Blind SQL Injection.This issue affects bSecure – Your Universal Checkout: from n/a through <= 1.7.9.

  Product

  bSecure – Your Universal Checkout

  Affected

  up to 1.7.9

  What to do

  Affects up to 1.7.9. Update bSecure – Your Universal Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Kossy - Minimalist eCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52807 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusWP Kossy - Minimalist eCommerce WordPress Theme kossy allows PHP Local File Inclusion.This issue affects Kossy - Minimalist eCommerce WordPress Theme: from n/a through <= 1.45.

  Product

  Kossy - Minimalist eCommerce

  Affected

  up to 1.45

  What to do

  Affects up to 1.45. Update Kossy - Minimalist eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025JobSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52798 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.This issue affects JobSearch: from n/a through < 3.0.6.

  Product

  JobSearch

  What to do

  Update JobSearch to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025WP-Recall: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52796 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tggfref WP-Recall allows Reflected XSS. This issue affects WP-Recall: from n/a through 16.26.14.

  Product

  WP-Recall

  Affected

  up to 16.26.14

  What to do

  Affects up to 16.26.14. Update WP-Recall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Video List Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52776 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thanhtungtnt Video List Manager video-list-manager allows Stored XSS.This issue affects Video List Manager: from n/a through <= 1.7.

  Product

  Video List Manager

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Video List Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Alone: Improper Control of Generation of Code ('Code Injection')CVE-2025-52718 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Remote Code Inclusion.This issue affects Alone: from n/a through <= 7.8.2.

  Product

  Alone

  Affected

  up to 7.8.2

  What to do

  Affects up to 7.8.2. Update Alone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025CMSMasters Content Composer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-4414 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows PHP Local File Inclusion.This issue affects CMSMasters Content Composer: from n/a through < 2.5.7.

  Product

  CMSMasters Content Composer

  What to do

  Update CMSMasters Content Composer to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Paid Member Subscriptions: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49870 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows SQL Injection.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.1.

  Product

  Paid Member Subscriptions

  Affected

  up to 2.15.1

  What to do

  Affects up to 2.15.1. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Beautiful Cookie Consent Banner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49866 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikel Beautiful Cookie Consent Banner beautiful-and-responsive-cookie-consent allows Reflected XSS.This issue affects Beautiful Cookie Consent Banner: from n/a through <= 4.6.1.

  Product

  Beautiful Cookie Consent Banner

  Affected

  up to 4.6.1

  What to do

  Affects up to 4.6.1. Update Beautiful Cookie Consent Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Frontend Admin by DynamiApps: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-49303 · WordPress plugins & themes · reported by PatchstackMedium 6.8

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Path Traversal.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.28.7.

  Product

  Frontend Admin by DynamiApps

  Affected

  up to 3.28.7

  What to do

  Affects up to 3.28.7. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Easy Stripe: Improper Control of Generation of Code ('Code Injection')CVE-2025-49302 · WordPress plugins & themes · reported by PatchstackCritical 10

  Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson Easy Stripe easy-stripe allows Remote Code Inclusion.This issue affects Easy Stripe: from n/a through <= 1.1.

  Product

  Easy Stripe

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Easy Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Neom Blog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49274 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awordpresslife Neom Blog neom-blog allows Reflected XSS.This issue affects Neom Blog: from n/a through <= 0.0.9.

  Product

  Neom Blog

  Affected

  up to 0.0.9

  What to do

  Affects up to 0.0.9. Update Neom Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Team Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49247 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmoreira Team Showcase team-showcase-cm allows DOM-Based XSS.This issue affects Team Showcase: from n/a through < 25.05.13.

  Product

  Team Showcase

  What to do

  Update Team Showcase to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Testimonials Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49245 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmoreira Testimonials Showcase testimonials-showcase allows Reflected XSS.This issue affects Testimonials Showcase: from n/a through <= 1.9.16.

  Product

  Testimonials Showcase

  Affected

  up to 1.9.16

  What to do

  Affects up to 1.9.16. Update Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Elessi: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49070 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Elessi elessi-theme allows PHP Local File Inclusion.This issue affects Elessi: from n/a through < 6.4.1.

  Product

  Elessi

  What to do

  Update Elessi to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Booking Calendar Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48231 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through <= 1.2.58.

  Product

  Booking Calendar Contact Form

  Affected

  up to 1.2.58

  What to do

  Affects up to 1.2.58. Update Booking Calendar Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025PrivateContent - Mail Actions: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47627 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LCweb PrivateContent - Mail Actions allows PHP Local File Inclusion. This issue affects PrivateContent - Mail Actions: from n/a through 2.3.2.

  Product

  PrivateContent - Mail Actions

  Affected

  up to 2.3.2

  What to do

  Affects up to 2.3.2. Update PrivateContent - Mail Actions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Rankie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39487 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Rankie valvepress-rankie allows Reflected XSS.This issue affects Rankie: from n/a through <= 1.8.2.

  Product

  Rankie

  Affected

  up to 1.8.2

  What to do

  Affects up to 1.8.2. Update Rankie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Pressroom: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32311 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Pressroom pressroom allows Reflected XSS.This issue affects Pressroom: from n/a through <= 7.0.

  Product

  Pressroom

  Affected

  up to 7.0

  What to do

  Affects up to 7.0. Update Pressroom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Simple Link Directory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32297 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows SQL Injection.This issue affects Simple Link Directory: from n/a through < 14.8.1.

  Product

  Simple Link Directory

  What to do

  Update Simple Link Directory to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Homey: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31037 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey homey allows Reflected XSS.This issue affects Homey: from n/a through <= 2.4.5.

  Product

  Homey

  Affected

  up to 2.4.5

  What to do

  Affects up to 2.4.5. Update Homey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Click & Pledge Connect: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28983 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect allows Privilege Escalation. This issue affects Click & Pledge Connect: from 25.04010101 through WP6.8.

  Product

  Click & Pledge Connect

  What to do

  Update Click & Pledge Connect to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Aviation Weather from NOAA: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-28980 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in machouinard Aviation Weather from NOAA aviation-weather-from-noaa allows Path Traversal.This issue affects Aviation Weather from NOAA: from n/a through <= 0.7.2.

  Product

  Aviation Weather from NOAA

  Affected

  up to 0.7.2

  What to do

  Affects up to 0.7.2. Update Aviation Weather from NOAA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025SB Breadcrumbs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28978 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hung Trang Si SB Breadcrumbs sb-breadcrumbs allows Reflected XSS.This issue affects SB Breadcrumbs: from n/a through <= 1.0.

  Product

  SB Breadcrumbs

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update SB Breadcrumbs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Email Address Security by WebEmailProtector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28976 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dsrodzin Email Address Security by WebEmailProtector webemailprotector allows Stored XSS.This issue affects Email Address Security by WebEmailProtector: from n/a through <= 3.3.6.

  Product

  Email Address Security by WebEmailProtector

  Affected

  up to 3.3.6

  What to do

  Affects up to 3.3.6. Update Email Address Security by WebEmailProtector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025WP Wall: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28968 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Prelovac WP Wall wp-wall allows Reflected XSS.This issue affects WP Wall: from n/a through <= 1.7.3.

  Product

  WP Wall

  Affected

  up to 1.7.3

  What to do

  Affects up to 1.7.3. Update WP Wall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Printcart Web to Print Product Designer for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24780 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows SQL Injection.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through <= 2.4.0.

  Product

  Printcart Web to Print Product Designer for WooCommerce

  Affected

  up to 2.4.0

  What to do

  Affects up to 2.4.0. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Content Manager Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24771 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Content Manager Light content-manager-light allows Reflected XSS.This issue affects Content Manager Light: from n/a through <= 3.2.

  Product

  Content Manager Light

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update Content Manager Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53566 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Stored XSS.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 7.8.

  Product

  WP Visitor Statistics (Real Time Traffic)

  Affected

  up to 7.8

  What to do

  Affects up to 7.8. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Card flip image slideshow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30983 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Card flip image slideshow card-flip-image-slideshow allows DOM-Based XSS.This issue affects Card flip image slideshow: from n/a through <= 1.5.

  Product

  Card flip image slideshow

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Card flip image slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Pixelating image slideshow gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30979 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Pixelating image slideshow gallery pixelating-image-slideshow-gallery allows SQL Injection.This issue affects Pixelating image slideshow gallery: from n/a through <= 8.0.

  Product

  Pixelating image slideshow gallery

  Affected

  up to 8.0

  What to do

  Affects up to 8.0. Update Pixelating image slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025iFrame Images Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30969 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus iFrame Images Gallery wp-iframe-images-gallery allows SQL Injection.This issue affects iFrame Images Gallery: from n/a through <= 9.0.

  Product

  iFrame Images Gallery

  Affected

  up to 9.0

  What to do

  Affects up to 9.0. Update iFrame Images Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Cool fade popup: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30947 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Cool fade popup cool-fade-popup allows Blind SQL Injection.This issue affects Cool fade popup: from n/a through <= 10.1.

  Product

  Cool fade popup

  Affected

  up to 10.1

  What to do

  Affects up to 10.1. Update Cool fade popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Posts Slider Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30943 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aakif Kadiwala Posts Slider Shortcode posts-slider-shortcode allows DOM-Based XSS.This issue affects Posts Slider Shortcode: from n/a through <= 1.0.

  Product

  Posts Slider Shortcode

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Posts Slider Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025CF7 7 Mailchimp Add-on: Missing AuthorizationCVE-2025-29012 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in kamleshyadav CF7 7 Mailchimp Add-on CF7-mailchimp-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 7 Mailchimp Add-on: from n/a through < 2.4.

  Product

  CF7 7 Mailchimp Add-on

  What to do

  Update CF7 7 Mailchimp Add-on to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Easy Elements Hider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28971 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CWD Web Designer Easy Elements Hider easy-elements-hider allows Stored XSS.This issue affects Easy Elements Hider: from n/a through <= 2.0.

  Product

  Easy Elements Hider

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Easy Elements Hider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.