Vulnerability database

9,243 results · page 68 of 185

• Jun 20, 2025ANON::form embedded secure form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52733 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anonform Ab ANON::form embedded secure form anonform-embedded-secure-form allows DOM-Based XSS.This issue affects ANON::form embedded secure form: from n/a through <= 1.7.

  Product

  ANON::form embedded secure form

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update ANON::form embedded secure form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Classified Listing: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52715 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Classified Listing classified-listing allows PHP Local File Inclusion.This issue affects Classified Listing: from n/a through <= 4.2.0.

  Product

  Classified Listing

  Affected

  up to 4.2.0

  What to do

  Affects up to 4.2.0. Update Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025File Manager Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52710 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team File Manager Pro filester allows Stored XSS.This issue affects File Manager Pro: from n/a through <= 1.8.8.

  Product

  File Manager Pro

  Affected

  up to 1.8.8

  What to do

  Affects up to 1.8.8. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025HUSKY: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52708 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY woocommerce-products-filter allows PHP Local File Inclusion.This issue affects HUSKY: from n/a through <= 1.3.7.

  Product

  HUSKY

  Affected

  up to 1.3.7

  What to do

  Affects up to 1.3.7. Update HUSKY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Firelight Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52707 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored XSS.This issue affects Firelight Lightbox: from n/a through <= 2.3.16.

  Product

  Firelight Lightbox

  Affected

  up to 2.3.16

  What to do

  Affects up to 2.3.16. Update Firelight Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP-Members: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50051 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chad Butler WP-Members wp-members allows Stored XSS.This issue affects WP-Members: from n/a through <= 3.5.4.

  Product

  WP-Members

  Affected

  up to 3.5.4

  What to do

  Affects up to 3.5.4. Update WP-Members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Jobs for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50050 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Stored XSS.This issue affects Jobs for WordPress: from n/a through <= 2.7.14.

  Product

  Jobs for

  Affected

  up to 2.7.14

  What to do

  Affects up to 2.7.14. Update Jobs for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Modern Footnotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50049 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prismtechstudios Modern Footnotes modern-footnotes allows Stored XSS.This issue affects Modern Footnotes: from n/a through <= 1.4.19.

  Product

  Modern Footnotes

  Affected

  up to 1.4.19

  What to do

  Affects up to 1.4.19. Update Modern Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Automatically Hierarchic Categories in Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50048 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atakan Au Automatically Hierarchic Categories in Menu automatically-hierarchic-categories-in-menu allows Stored XSS.This issue affects Automatically Hierarchic Categories in Menu: from n/a through <= 2.0.9.

  Product

  Automatically Hierarchic Categories in Menu

  Affected

  up to 2.0.9

  What to do

  Affects up to 2.0.9. Update Automatically Hierarchic Categories in Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Sitekit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50047 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue affects Sitekit: from n/a through <= 1.9.

  Product

  Sitekit

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update Sitekit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WPComplete: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50046 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through <= 2.9.5.

  Product

  WPComplete

  Affected

  up to 2.9.5

  What to do

  Affects up to 2.9.5. Update WPComplete to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Related Products Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50045 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProWCPlugins Related Products Manager for WooCommerce related-products-manager-woocommerce allows DOM-Based XSS.This issue affects Related Products Manager for WooCommerce: from n/a through <= 1.6.2.

  Product

  Related Products Manager for WooCommerce

  Affected

  up to 1.6.2

  What to do

  Affects up to 1.6.2. Update Related Products Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Code Engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50043 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Code Engine code-engine allows Stored XSS.This issue affects Code Engine: from n/a through <= 0.3.2.

  Product

  Code Engine

  Affected

  up to 0.3.2

  What to do

  Affects up to 0.3.2. Update Code Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP Register Profile With Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50042 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com WP Register Profile With Shortcode wp-register-profile-with-shortcode allows Stored XSS.This issue affects WP Register Profile With Shortcode: from n/a through <= 3.6.3.

  Product

  WP Register Profile With Shortcode

  Affected

  up to 3.6.3

  What to do

  Affects up to 3.6.3. Update WP Register Profile With Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Gutenberg Blocks – ACF Blocks Suite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50041 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Engine Gutenberg Blocks – ACF Blocks Suite acf-blocks allows Stored XSS.This issue affects Gutenberg Blocks – ACF Blocks Suite: from n/a through <= 2.6.11.

  Product

  Gutenberg Blocks – ACF Blocks Suite

  Affected

  up to 2.6.11

  What to do

  Affects up to 2.6.11. Update Gutenberg Blocks – ACF Blocks Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Anant Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50038 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anantaddons Anant Addons for Elementor anant-addons-for-elementor allows Stored XSS.This issue affects Anant Addons for Elementor: from n/a through <= 1.2.8.

  Product

  Anant Addons for Elementor

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update Anant Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Buying Buddy IDX CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50037 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Buying Buddy Buying Buddy IDX CRM buying-buddy-idx-crm allows DOM-Based XSS.This issue affects Buying Buddy IDX CRM: from n/a through <= 2.3.0.

  Product

  Buying Buddy IDX CRM

  Affected

  up to 2.3.0

  What to do

  Affects up to 2.3.0. Update Buying Buddy IDX CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Fyrebox Quizzes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50035 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a through <= 3.1.

  Product

  Fyrebox Quizzes

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update Fyrebox Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Fitness Park: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50033 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Fitness Park fitness-park allows DOM-Based XSS.This issue affects Fitness Park: from n/a through <= 1.1.1.

  Product

  Fitness Park

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Fitness Park to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Spark Multipurpose: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50030 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Spark Multipurpose spark-multipurpose allows DOM-Based XSS.This issue affects Spark Multipurpose: from n/a through <= 1.0.7.

  Product

  Spark Multipurpose

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Spark Multipurpose to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Login/Signup Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50027 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Login/Signup Popup easy-login-woocommerce allows Stored XSS.This issue affects Login/Signup Popup: from n/a through <= 2.9.4.

  Product

  Login/Signup Popup

  Affected

  up to 2.9.4

  What to do

  Affects up to 2.9.4. Update Login/Signup Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Spoki: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50026 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spoki Spoki spoki allows Stored XSS.This issue affects Spoki: from n/a through <= 2.17.0.

  Product

  Spoki

  Affected

  up to 2.17.0

  What to do

  Affects up to 2.17.0. Update Spoki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025CP Polls: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50025 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Polls cp-polls allows Stored XSS.This issue affects CP Polls: from n/a through <= 1.0.81.

  Product

  CP Polls

  Affected

  up to 1.0.81

  What to do

  Affects up to 1.0.81. Update CP Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025ATP Call Now: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50024 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Truong Thanh ATP Call Now atp-call-now allows Stored XSS.This issue affects ATP Call Now: from n/a through <= 1.0.3.

  Product

  ATP Call Now

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update ATP Call Now to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025CodePen Embed Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50023 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Coyier CodePen Embed Block codepen-embed-block allows Stored XSS.This issue affects CodePen Embed Block: from n/a through <= 1.2.0.

  Product

  CodePen Embed Block

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update CodePen Embed Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP-FB-AutoConnect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50022 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JK WP-FB-AutoConnect wp-fb-autoconnect allows Stored XSS.This issue affects WP-FB-AutoConnect: from n/a through <= 4.6.4.

  Product

  WP-FB-AutoConnect

  Affected

  up to 4.6.4

  What to do

  Affects up to 4.6.4. Update WP-FB-AutoConnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Better Random Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50021 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Peake Better Random Redirect better-random-redirect allows Stored XSS.This issue affects Better Random Redirect: from n/a through <= 1.3.20.

  Product

  Better Random Redirect

  Affected

  up to 1.3.20

  What to do

  Affects up to 1.3.20. Update Better Random Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025RDFa Breadcrumb: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50020 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nitin Yawalkar RDFa Breadcrumb rdfa-breadcrumb allows Stored XSS.This issue affects RDFa Breadcrumb: from n/a through <= 2.3.

  Product

  RDFa Breadcrumb

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update RDFa Breadcrumb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Simple Sticky Footer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50019 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sandor Kovacs Simple Sticky Footer simple-sticky-footer allows Stored XSS.This issue affects Simple Sticky Footer : from n/a through <= 1.3.5.

  Product

  Simple Sticky Footer

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update Simple Sticky Footer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Tealium: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50018 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tealium Tealium tealium allows Stored XSS.This issue affects Tealium: from n/a through <= 2.1.20.

  Product

  Tealium

  Affected

  up to 2.1.20

  What to do

  Affects up to 2.1.20. Update Tealium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP Voting Contest: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50017 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt WP Voting Contest wp-voting-contest allows Stored XSS.This issue affects WP Voting Contest: from n/a through <= 5.8.

  Product

  WP Voting Contest

  Affected

  up to 5.8

  What to do

  Affects up to 5.8. Update WP Voting Contest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025IP Based Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50016 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brijeshk89 IP Based Login ip-based-login allows Stored XSS.This issue affects IP Based Login: from n/a through <= 2.4.2.

  Product

  IP Based Login

  Affected

  up to 2.4.2

  What to do

  Affects up to 2.4.2. Update IP Based Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Hand Talk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50015 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rodrigo Bastos Hand Talk handtalk allows Stored XSS.This issue affects Hand Talk: from n/a through <= 6.1.

  Product

  Hand Talk

  Affected

  up to 6.1

  What to do

  Affects up to 6.1. Update Hand Talk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025PDPA Consent for Thailand: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50014 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iamapinan PDPA Consent for Thailand pdpa-consent allows Stored XSS.This issue affects PDPA Consent for Thailand: from n/a through <= 1.1.1.

  Product

  PDPA Consent for Thailand

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update PDPA Consent for Thailand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025CSV Importer Improved: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50013 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Judge CSV Importer Improved csv-importer-improved allows Stored XSS.This issue affects CSV Importer Improved: from n/a through <= 0.6.1.

  Product

  CSV Importer Improved

  Affected

  up to 0.6.1

  What to do

  Affects up to 0.6.1. Update CSV Importer Improved to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Inventory Presser: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50012 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fridaysystems Inventory Presser inventory-presser allows Stored XSS.This issue affects Inventory Presser: from n/a through <= 15.2.6.

  Product

  Inventory Presser

  Affected

  up to 15.2.6

  What to do

  Affects up to 15.2.6. Update Inventory Presser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Recipes manager - WPH: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50011 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Félix Martínez Recipes manager - WPH allows Stored XSS. This issue affects Recipes manager - WPH: from n/a through 1.0.4.

  Product

  Recipes manager - WPH

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Recipes manager - WPH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Elessi: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49873 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Elessi elessi-theme allows Reflected XSS.This issue affects Elessi: from n/a through <= 6.3.9.

  Product

  Elessi

  Affected

  up to 6.3.9

  What to do

  Affects up to 6.3.9. Update Elessi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025CubeWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49882 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Tauqeer CubeWP cubewp-framework allows DOM-Based XSS.This issue affects CubeWP: from n/a through <= 1.1.23.

  Product

  CubeWP

  Affected

  up to 1.1.23

  What to do

  Affects up to 1.1.23. Update CubeWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Responsive Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49881 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Stored XSS.This issue affects Responsive Blocks: from n/a through <= 2.0.5.

  Product

  Responsive Blocks

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update Responsive Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Litho: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-49879 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in themezaa Litho litho allows Path Traversal.This issue affects Litho: from n/a through <= 3.0.

  Product

  Litho

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update Litho to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025WPAdverts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49878 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.This issue affects WPAdverts: from n/a through <= 2.2.4.

  Product

  WPAdverts

  Affected

  up to 2.2.4

  What to do

  Affects up to 2.2.4. Update WPAdverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025If-So Dynamic Content Personalization: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49875 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Stored XSS.This issue affects If-So Dynamic Content Personalization: from n/a through <= 1.9.3.1.

  Product

  If-So Dynamic Content Personalization

  Affected

  up to 1.9.3.1

  What to do

  Affects up to 1.9.3.1. Update If-So Dynamic Content Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Noptin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49871 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows Stored XSS.This issue affects Noptin: from n/a through <= 3.8.7.

  Product

  Noptin

  Affected

  up to 3.8.7

  What to do

  Affects up to 3.8.7. Update Noptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Advanced Sermons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49863 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Advanced Sermons advanced-sermons allows Stored XSS.This issue affects Advanced Sermons: from n/a through <= 3.6.

  Product

  Advanced Sermons

  Affected

  up to 3.6

  What to do

  Affects up to 3.6. Update Advanced Sermons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Ebook Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49862 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in motov.net Ebook Store ebook-store allows Stored XSS.This issue affects Ebook Store: from n/a through <= 5.8008.

  Product

  Ebook Store

  Affected

  up to 5.8008

  What to do

  Affects up to 5.8008. Update Ebook Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Kama Click Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49861 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timur Kamaev Kama Click Counter kama-clic-counter allows Stored XSS.This issue affects Kama Click Counter: from n/a through <= 4.0.3.

  Product

  Kama Click Counter

  Affected

  up to 4.0.3

  What to do

  Affects up to 4.0.3. Update Kama Click Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025WP Views Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49859 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in etruel WP Views Counter wpecounter allows Stored XSS.This issue affects WP Views Counter: from n/a through <= 2.0.3.

  Product

  WP Views Counter

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update WP Views Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Arconix Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49858 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.17.

  Product

  Arconix Shortcodes

  Affected

  up to 2.1.17

  What to do

  Affects up to 2.1.17. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Meks Flexible Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49855 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks Flexible Shortcodes meks-flexible-shortcodes allows DOM-Based XSS.This issue affects Meks Flexible Shortcodes: from n/a through <= 1.3.7.

  Product

  Meks Flexible Shortcodes

  Affected

  up to 1.3.7

  What to do

  Affects up to 1.3.7. Update Meks Flexible Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.