Vulnerability database

5,859 results · page 71 of 118

• Jan 9, 2025wp custom countdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22822 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bishawjit-das wp custom countdown wp-custom-countdown allows Stored XSS.This issue affects wp custom countdown: from n/a through <= 2.8.

  Product

  wp custom countdown

  Affected

  up to 2.8

  What to do

  Affects up to 2.8. Update wp custom countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025StorePress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22821 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vfthemes StorePress storepress allows DOM-Based XSS.This issue affects StorePress: from n/a through <= 1.0.12.

  Product

  StorePress

  Affected

  up to 1.0.12

  What to do

  Affects up to 1.0.12. Update StorePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025VR Views: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22820 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in goldsounds VR Views vr-views allows Stored XSS.This issue affects VR Views: from n/a through <= 1.5.1.

  Product

  VR Views

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update VR Views to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Qr Code and Barcode Scanner Reader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22819 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roberto Bottalico Qr Code and Barcode Scanner Reader qr-code-and-barcode-scanner-reader allows Stored XSS.This issue affects Qr Code and Barcode Scanner Reader: from n/a through <= 1.0.0.

  Product

  Qr Code and Barcode Scanner Reader

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Qr Code and Barcode Scanner Reader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025S3Player – WooCommerce & Elementor Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22818 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in S3Bubble S3Player – WooCommerce & Elementor Integration drm-protected-video-streaming allows Stored XSS.This issue affects S3Player – WooCommerce & Elementor Integration: from n/a through <= 4.2.1.

  Product

  S3Player – WooCommerce & Elementor Integration

  Affected

  up to 4.2.1

  What to do

  Affects up to 4.2.1. Update S3Player – WooCommerce & Elementor Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025BP Profile Shortcodes Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22817 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra bp-profile-shortcodes-extra allows Stored XSS.This issue affects BP Profile Shortcodes Extra: from n/a through <= 2.6.0.

  Product

  BP Profile Shortcodes Extra

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update BP Profile Shortcodes Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Button Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22815 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through <= 1.1.9.

  Product

  Button Block

  Affected

  up to 1.1.9

  What to do

  Affects up to 1.1.9. Update Button Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Conversational Forms for ChatBot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22813 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Stored XSS.This issue affects Conversational Forms for ChatBot: from n/a through <= 1.4.2.

  Product

  Conversational Forms for ChatBot

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update Conversational Forms for ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025News Ticker Widget for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22812 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aezaz Shaikh News Ticker Widget for Elementor news-ticker-widget-for-elementor allows Stored XSS.This issue affects News Ticker Widget for Elementor: from n/a through <= 1.3.2.

  Product

  News Ticker Widget for Elementor

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update News Ticker Widget for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025MT Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22811 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristian Stan MT Addons for Elementor mt-addons-for-elementor allows Stored XSS.This issue affects MT Addons for Elementor: from n/a through <= 1.0.6.

  Product

  MT Addons for Elementor

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update MT Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Content Blocks Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22810 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phi Phan Content Blocks Builder content-blocks-builder allows Stored XSS.This issue affects Content Blocks Builder: from n/a through <= 2.7.6.

  Product

  Content Blocks Builder

  Affected

  up to 2.7.6

  What to do

  Affects up to 2.7.6. Update Content Blocks Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025PDF Catalog Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22809 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in theme funda PDF Catalog Woocommerce pdf-catalog-woocommerce allows DOM-Based XSS.This issue affects PDF Catalog Woocommerce: from n/a through <= 2.0.

  Product

  PDF Catalog Woocommerce

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update PDF Catalog Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Surbma | Premium WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22808 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Surbma Surbma | Premium WP surbma-premium-wp allows DOM-Based XSS.This issue affects Surbma | Premium WP: from n/a through <= 9.0.

  Product

  Surbma | Premium WP

  Affected

  up to 9.0

  What to do

  Affects up to 9.0. Update Surbma | Premium WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Responsive Flickr Slideshow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22807 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Responsive Flickr Slideshow mobile-friendly-flickr-slideshow allows Stored XSS.This issue affects Responsive Flickr Slideshow: from n/a through <= 2.6.0.

  Product

  Responsive Flickr Slideshow

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update Responsive Flickr Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Black Widgets For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22806 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor black-widgets allows DOM-Based XSS.This issue affects Black Widgets For Elementor: from n/a through <= 1.3.8.

  Product

  Black Widgets For Elementor

  Affected

  up to 1.3.8

  What to do

  Affects up to 1.3.8. Update Black Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Skill Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22805 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Skill Bar skillbars allows Stored XSS.This issue affects Skill Bar: from n/a through <= 1.2.

  Product

  Skill Bar

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Skill Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Author Avatars List/Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22804 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Stored XSS.This issue affects Author Avatars List/Block: from n/a through <= 2.1.23.

  Product

  Author Avatars List/Block

  Affected

  up to 2.1.23

  What to do

  Affects up to 2.1.23. Update Author Avatars List/Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Advanced Product Information for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22803 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Advanced Product Information for WooCommerce woo-advanced-product-information allows Stored XSS.This issue affects Advanced Product Information for WooCommerce: from n/a through <= 1.1.4.

  Product

  Advanced Product Information for WooCommerce

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Advanced Product Information for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22802 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail yeemail allows Stored XSS.This issue affects Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: from n/a through <= 2.1.4.

  Product

  Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail

  Affected

  up to 2.1.4

  What to do

  Affects up to 2.1.4. Update Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Free WooCommerce Theme 99fy Extension: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22801 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes Free WooCommerce Theme 99fy Extension 99fy-core allows Stored XSS.This issue affects Free WooCommerce Theme 99fy Extension: from n/a through <= 1.2.8.

  Product

  Free WooCommerce Theme 99fy Extension

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update Free WooCommerce Theme 99fy Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Mailing Group Listserv: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22595 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yamna Khawaja Mailing Group Listserv wp-mailing-group allows Reflected XSS.This issue affects Mailing Group Listserv: from n/a through <= 2.0.9.

  Product

  Mailing Group Listserv

  Affected

  up to 2.0.9

  What to do

  Affects up to 2.0.9. Update Mailing Group Listserv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Better User Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22594 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hccoder Better User Shortcodes better-user-shortcodes allows Reflected XSS.This issue affects Better User Shortcodes: from n/a through <= 1.0.

  Product

  Better User Shortcodes

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Better User Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Custom DataBase Tables: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22539 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ka2 Custom DataBase Tables custom-database-tables allows Reflected XSS.This issue affects Custom DataBase Tables: from n/a through <= 2.1.34.

  Product

  Custom DataBase Tables

  Affected

  up to 2.1.34

  What to do

  Affects up to 2.1.34. Update Custom DataBase Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025wp Hosting Performance Check: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22521 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Farrell wp Hosting Performance Check wp-hosting-performance-check allows Reflected XSS.This issue affects wp Hosting Performance Check: from n/a through <= 2.18.8.

  Product

  wp Hosting Performance Check

  Affected

  up to 2.18.8

  What to do

  Affects up to 2.18.8. Update wp Hosting Performance Check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Opentracker Analytics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22361 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Opentracker Opentracker Analytics opentracker-analytics allows Reflected XSS.This issue affects Opentracker Analytics: from n/a through <= 1.3.

  Product

  Opentracker Analytics

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Opentracker Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025TS Comfort DB: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22345 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tsinf TS Comfort DB ts-comfort-database allows Reflected XSS.This issue affects TS Comfort DB: from n/a through <= 2.0.7.

  Product

  TS Comfort DB

  Affected

  up to 2.0.7

  What to do

  Affects up to 2.0.7. Update TS Comfort DB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Cf7Save Extension: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22331 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in P3JX Cf7Save Extension cf7save-extension allows Reflected XSS.This issue affects Cf7Save Extension: from n/a through <= 1.

  Product

  Cf7Save Extension

  Affected

  up to 1

  What to do

  Affects up to 1. Update Cf7Save Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025MG Parallax Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22330 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Waghmare MG Parallax Slider mg-parallax-slider allows Reflected XSS.This issue affects MG Parallax Slider: from n/a through <= 1.0..

  Product

  MG Parallax Slider

  Affected

  up to 1.0.

  What to do

  Affects up to 1.0.. Update MG Parallax Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Widgetize Pages Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22313 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Reflected XSS.This issue affects Widgetize Pages Light: from n/a through <= 3.0.

  Product

  Widgetize Pages Light

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update Widgetize Pages Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Product Table for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22307 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam Product Table for WooCommerce woo-product-table allows Reflected XSS.This issue affects Product Table for WooCommerce: from n/a through <= 4.0.3.

  Product

  Product Table for WooCommerce

  Affected

  up to 4.0.3

  What to do

  Affects up to 4.0.3. Update Product Table for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22295 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto tripetto allows Stored XSS.This issue affects WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: from n/a through <= 8.0.6.

  Product

  WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto

  Affected

  up to 8.0.6

  What to do

  Affects up to 8.0.6. Update WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Pósturinn\'s Shipping with WooCommerce: Reflected Cross-Site ScriptingCVE-2024-11815 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Pósturinn\'s Shipping with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the printed_marked and nonprinted_marked parameters in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  Pósturinn\'s Shipping with WooCommerce

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Pósturinn\'s Shipping with WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Jan 9, 2025Asgard Security Scanner: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12715 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Asgard Security Scanner WordPress plugin through 0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

  Product

  Asgard Security Scanner

  Affected

  up to 0.7

  What to do

  Affects up to 0.7. Update Asgard Security Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Jan 9, 2025PostLists: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-10815 · WordPress plugins & themes · reported by WPScanMedium 4.2

  The PostLists WordPress plugin through 2.0.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

  Product

  PostLists

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update PostLists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 7, 2025Alpha Price Table For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22500 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ali Ali Alpha Price Table For Elementor alpha-price-table-for-elementor allows DOM-Based XSS.This issue affects Alpha Price Table For Elementor: from n/a through <= 1.2.0.

  Product

  Alpha Price Table For Elementor

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Alpha Price Table For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025EMC2 Alert Boxes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22365 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric McNiece EMC2 Alert Boxes allows Stored XSS.This issue affects EMC2 Alert Boxes: from n/a through 1.3.

  Product

  EMC2 Alert Boxes

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update EMC2 Alert Boxes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Digi Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22354 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Themes Digi Store allows DOM-Based XSS.This issue affects Digi Store: from n/a through 1.1.4.

  Product

  Digi Store

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Digi Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Education LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22334 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FilaThemes Education LMS allows Stored XSS.This issue affects Education LMS: from n/a through 0.0.7.

  Product

  Education LMS

  Affected

  up to 0.0.7

  What to do

  Affects up to 0.0.7. Update Education LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Hash Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22296 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Hash Elements hash-elements.This issue affects Hash Elements: from n/a through <= 1.5.0.

  Product

  Hash Elements

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update Hash Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Laika Pedigree Tree: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22593 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burria Laika Pedigree Tree laika-pedigree-tree allows Stored XSS.This issue affects Laika Pedigree Tree: from n/a through <= 1.4.

  Product

  Laika Pedigree Tree

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Laika Pedigree Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Ultimate Image Hover Effects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22585 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Ultimate Image Hover Effects ultimate-image-hover-effects allows DOM-Based XSS.This issue affects Ultimate Image Hover Effects: from n/a through <= 1.1.2.

  Product

  Ultimate Image Hover Effects

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Ultimate Image Hover Effects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Timeline Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22584 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Timeline Pro timeline-pro allows DOM-Based XSS.This issue affects Timeline Pro: from n/a through <= 1.3.

  Product

  Timeline Pro

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Timeline Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Arcade Ready: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22581 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bytephp Arcade Ready arcadeready allows Stored XSS.This issue affects Arcade Ready: from n/a through <= 1.1.

  Product

  Arcade Ready

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Arcade Ready to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Biltorvet Dealer Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22580 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Auto IT Biltorvet Dealer Tools biltorvet-dealer-tools allows Stored XSS.This issue affects Biltorvet Dealer Tools: from n/a through <= 1.0.22.

  Product

  Biltorvet Dealer Tools

  Affected

  up to 1.0.22

  What to do

  Affects up to 1.0.22. Update Biltorvet Dealer Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025WP Header Notification: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22579 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly WP Header Notification wp-header-notification allows Stored XSS.This issue affects WP Header Notification: from n/a through <= 1.2.7.

  Product

  WP Header Notification

  Affected

  up to 1.2.7

  What to do

  Affects up to 1.2.7. Update WP Header Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025WP Cookie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22578 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aazztech WP Cookie wp-cookie allows Stored XSS.This issue affects WP Cookie: from n/a through <= 1.0.0.

  Product

  WP Cookie

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update WP Cookie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Able Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22577 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damion Armentrout Able Player wp-able-player allows DOM-Based XSS.This issue affects Able Player: from n/a through <= 1.0.

  Product

  Able Player

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Able Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025ICS Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22574 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleanshooter ICS Button ics-button allows Stored XSS.This issue affects ICS Button: from n/a through <= 0.6.

  Product

  ICS Button

  Affected

  up to 0.6

  What to do

  Affects up to 0.6. Update ICS Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Icons Enricher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22573 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in copist Icons Enricher icons-enricher allows Stored XSS.This issue affects Icons Enricher: from n/a through <= 1.0.8.

  Product

  Icons Enricher

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Icons Enricher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Legacy ePlayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22572 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Legacy ePlayer sportspress-tv allows Stored XSS.This issue affects Legacy ePlayer: from n/a through <= 0.9.9.

  Product

  Legacy ePlayer

  Affected

  up to 0.9.9

  What to do

  Affects up to 0.9.9. Update Legacy ePlayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.