Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

534new WordPress flaws this week

391,528entries in the database

11,286 results · page 74 of 226

Sep 22, 2025WooMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57956 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpcraft WooMS wooms allows Stored XSS.This issue affects WooMS: from n/a through <= 9.12.
Product
WooMS
Affected
up to 9.12
What to do
Affects up to 9.12. Update WooMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Poll Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57954 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Poll Maker poll-maker allows DOM-Based XSS.This issue affects Poll Maker: from n/a through <= 6.0.2.
Product
Poll Maker
Affected
up to 6.0.2
What to do
Affects up to 6.0.2. Update Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Open User Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57953 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 100plugins Open User Map open-user-map allows DOM-Based XSS.This issue affects Open User Map: from n/a through <= 1.4.14.
Product
Open User Map
Affected
up to 1.4.14
What to do
Affects up to 1.4.14. Update Open User Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Maps for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57952 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc Maps for WP maps-for-wp allows Stored XSS.This issue affects Maps for WP: from n/a through <= 1.2.5.
Product
Maps for WP
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Maps for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025SiteNarrator Text-to-Speech Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57951 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ken107 SiteNarrator Text-to-Speech Widget sitespeaker-widget allows Stored XSS.This issue affects SiteNarrator Text-to-Speech Widget: from n/a through <= 1.9.
Product
SiteNarrator Text-to-Speech Widget
Affected
up to 1.9
What to do
Affects up to 1.9. Update SiteNarrator Text-to-Speech Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Plugin Security Scanner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57950 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Glen Scott Plugin Security Scanner plugin-security-scanner allows Stored XSS.This issue affects Plugin Security Scanner: from n/a through <= 2.0.2.
Product
Plugin Security Scanner
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Plugin Security Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Directory Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57948 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Directory Pro directory-pro allows DOM-Based XSS.This issue affects Directory Pro: from n/a through <= 2.5.5.
Product
Directory Pro
Affected
up to 2.5.5
What to do
Affects up to 2.5.5. Update Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Photo Gallery by Ays: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57947 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Photo Gallery by Ays gallery-photo-gallery allows DOM-Based XSS.This issue affects Photo Gallery by Ays: from n/a through <= 6.3.8.
Product
Photo Gallery by Ays
Affected
up to 6.3.8
What to do
Affects up to 6.3.8. Update Photo Gallery by Ays to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WP Advanced PDF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57945 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cedcommerce WP Advanced PDF wp-advanced-pdf allows Stored XSS.This issue affects WP Advanced PDF: from n/a through <= 1.1.7.
Product
WP Advanced PDF
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update WP Advanced PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Append Link on Copy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57941 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JonathanMH Append Link on Copy append-link-on-copy allows Stored XSS.This issue affects Append Link on Copy: from n/a through <= 0.2.
Product
Append Link on Copy
Affected
up to 0.2
What to do
Affects up to 0.2. Update Append Link on Copy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Append extensions on Pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57940 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh Kumar Mukhiya Append extensions on Pages append-extensions-on-pages allows Stored XSS.This issue affects Append extensions on Pages: from n/a through <= 1.1.2.
Product
Append extensions on Pages
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Append extensions on Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Easy Hotel Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57938 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themewant Easy Hotel Booking easy-hotel allows DOM-Based XSS.This issue affects Easy Hotel Booking: from n/a through <= 1.9.0.
Product
Easy Hotel Booking
Affected
up to 1.9.0
What to do
Affects up to 1.9.0. Update Easy Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Bot Block – Stop Spam Referrals in Google Analytics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57935 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ricky Dawn Bot Block – Stop Spam Referrals in Google Analytics bot-block-stop-spam-google-analytics-referrals allows Stored XSS.This issue affects Bot Block – Stop Spam Referrals in Google Analytics: from n/a through <= 2.6.
Product
Bot Block – Stop Spam Referrals in Google Analytics
Affected
up to 2.6
What to do
Affects up to 2.6. Update Bot Block – Stop Spam Referrals in Google Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025PowerFolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57932 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Diego Pereira PowerFolio portfolio-elementor allows Stored XSS.This issue affects PowerFolio: from n/a through <= 3.2.1.
Product
PowerFolio
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update PowerFolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Double the Donation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57929 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kanwei_doublethedonation Double the Donation double-the-donation allows Stored XSS.This issue affects Double the Donation: from n/a through <= 2.0.0.
Product
Double the Donation
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Double the Donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025AWP Classifieds: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-57928 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Code Injection.This issue affects AWP Classifieds: from n/a through <= 4.4.3.
Product
AWP Classifieds
Affected
up to 4.4.3
What to do
Affects up to 4.4.3. Update AWP Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Passster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57926 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster content-protector allows Stored XSS.This issue affects Passster: from n/a through <= 4.2.18.
Product
Passster
Affected
up to 4.2.18
What to do
Affects up to 4.2.18. Update Passster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025immonex Kickstart Team: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-57925 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in immonex immonex Kickstart Team immonex-kickstart-team allows PHP Local File Inclusion.This issue affects immonex Kickstart Team: from n/a through <= 1.6.9.
Product
immonex Kickstart Team
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update immonex Kickstart Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Category Featured Images Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57920 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CK MacLeod Category Featured Images Extended category-featured-images-extended allows Stored XSS.This issue affects Category Featured Images Extended: from n/a through <= 1.52.
Product
Category Featured Images Extended
Affected
up to 1.52
What to do
Affects up to 1.52. Update Category Featured Images Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Printcart Web to Print Product Designer for WooCommerce: Missing AuthorizationCVE-2025-57917 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through <= 2.4.8.
Product
Printcart Web to Print Product Designer for WooCommerce
Affected
up to 2.4.8
What to do
Affects up to 2.4.8. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Behance Portfolio Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57913 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
Product
Behance Portfolio Manager
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Dialogity Free Live Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57912 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dialogity Dialogity Free Live Chat dialogity-website-chat allows Stored XSS.This issue affects Dialogity Free Live Chat: from n/a through <= 1.0.3.
Product
Dialogity Free Live Chat
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Dialogity Free Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Adverts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57911 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Adverts adverts-click-tracker allows DOM-Based XSS.This issue affects Adverts: from n/a through <= 1.4.
Product
Adverts
Affected
up to 1.4
What to do
Affects up to 1.4. Update Adverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025AnyClip Luminous Studio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57910 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AnyClip Video Platform AnyClip Luminous Studio anyclip-media allows Stored XSS.This issue affects AnyClip Luminous Studio: from n/a through <= 1.3.3.
Product
AnyClip Luminous Studio
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update AnyClip Luminous Studio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Product Time Countdown for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57908 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProWCPlugins Product Time Countdown for WooCommerce product-countdown-for-woocommerce allows Stored XSS.This issue affects Product Time Countdown for WooCommerce: from n/a through <= 1.6.5.
Product
Product Time Countdown for WooCommerce
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update Product Time Countdown for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Epeken All Kurir: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57906 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in epeken Epeken All Kurir epeken-all-kurir allows Stored XSS.This issue affects Epeken All Kurir: from n/a through <= 2.0.6.
Product
Epeken All Kurir
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Epeken All Kurir to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Sales Count Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57904 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-EXPERTS.IN Sales Count Manager for WooCommerce wc-sales-count-manager allows Stored XSS.This issue affects Sales Count Manager for WooCommerce: from n/a through <= 2.6.
Product
Sales Count Manager for WooCommerce
Affected
up to 2.6
What to do
Affects up to 2.6. Update Sales Count Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WooCommerce Additional Fees On Checkout (Free): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57903 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPSuperiors Developer WooCommerce Additional Fees On Checkout (Free) woo-additional-fees-on-checkout-wordpress allows Stored XSS.This issue affects WooCommerce Additional Fees On Checkout (Free): from n/a through <= 1.5.2.
Product
WooCommerce Additional Fees On Checkout (Free)
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update WooCommerce Additional Fees On Checkout (Free) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025GutenKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57900 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ataur R GutenKit gutenkit-blocks-addon allows Stored XSS.This issue affects GutenKit: from n/a through <= 2.4.2.
Product
GutenKit
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update GutenKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WP Frontend Admin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57898 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Vega WP Frontend Admin display-admin-page-on-frontend allows Stored XSS.This issue affects WP Frontend Admin: from n/a through <= 1.22.7.
Product
WP Frontend Admin
Affected
up to 1.22.7
What to do
Affects up to 1.22.7. Update WP Frontend Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025DELUCKS SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53570 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Stored XSS.This issue affects DELUCKS SEO: from n/a through <= 2.7.0.
Product
DELUCKS SEO
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025BMI Adult & Kid Calculator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53469 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mortgage Calculator BMI Adult & Kid Calculator bmi-adultkid-calculator allows Stored XSS.This issue affects BMI Adult & Kid Calculator: from n/a through <= 1.2.2.
Product
BMI Adult & Kid Calculator
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update BMI Adult & Kid Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Wp tabber widget: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-53468 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus@hotmail.com Wp tabber widget wp-tabber-widget allows SQL Injection.This issue affects Wp tabber widget: from n/a through <= 4.0.
Product
Wp tabber widget
Affected
up to 4.0
What to do
Affects up to 4.0. Update Wp tabber widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Login-Logout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53467 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Login-Logout login-logout allows Stored XSS.This issue affects Login-Logout: from n/a through <= 3.8.
Product
Login-Logout
Affected
up to 3.8
What to do
Affects up to 3.8. Update Login-Logout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Better Find and Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53466 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Better Find and Replace real-time-auto-find-and-replace allows Stored XSS.This issue affects Better Find and Replace: from n/a through <= 1.7.6.
Product
Better Find and Replace
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update Better Find and Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WP Mailto Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53464 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Online Optimisation WP Mailto Links wp-mailto-links allows Stored XSS.This issue affects WP Mailto Links: from n/a through <= 3.1.4.
Product
WP Mailto Links
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update WP Mailto Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025HT Mega – Absolute Addons for WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53463 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Mega – Absolute Addons for WPBakery Page Builder ht-mega-for-wpbakery allows DOM-Based XSS.This issue affects HT Mega – Absolute Addons for WPBakery Page Builder: from n/a through <= 1.0.9.
Product
HT Mega – Absolute Addons for WPBakery Page Builder
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update HT Mega – Absolute Addons for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025SAPO Feed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53462 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SAPO SAPO Feed sapo-feed allows Stored XSS.This issue affects SAPO Feed: from n/a through <= 2.4.2.
Product
SAPO Feed
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update SAPO Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025AffiliateWP – External Referral Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53460 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi AffiliateWP – External Referral Links affiliatewp-external-referral-links allows Stored XSS.This issue affects AffiliateWP – External Referral Links: from n/a through <= 1.2.0.
Product
AffiliateWP – External Referral Links
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update AffiliateWP – External Referral Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Goracash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53458 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davaxi Goracash goracash allows Stored XSS.This issue affects Goracash: from n/a through <= 1.1.
Product
Goracash
Affected
up to 1.1
What to do
Affects up to 1.1. Update Goracash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025CashBill.pl – Płatności WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53455 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CashBill CashBill.pl – Płatności WooCommerce cashbill-payment-method allows Stored XSS.This issue affects CashBill.pl – Płatności WooCommerce: from n/a through <= 3.2.1.
Product
CashBill.pl – Płatności WooCommerce
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update CashBill.pl – Płatności WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Ultimate WP Mail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53454 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Stored XSS.This issue affects Ultimate WP Mail: from n/a through <= 1.3.8.
Product
Ultimate WP Mail
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update Ultimate WP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Easy Pricing Table WP: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53450 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Pluginwale Easy Pricing Table WP easy-pricing-table-wp allows PHP Local File Inclusion.This issue affects Easy Pricing Table WP: from n/a through <= 1.1.3.
Product
Easy Pricing Table WP
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Easy Pricing Table WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 18, 2025Goza - Nonprofit Charity: Unauthorized arbitrary file uploadsCVE-2025-10690 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the 'beplus_import_pack_install_plugin' function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution.
Product
Goza - Nonprofit Charity
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Goza - Nonprofit Charity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net cve.org
Sep 18, 2025WP Hotel Booking: Lacks proper server-side validation for review ratingsCVE-2025-8942 · WordPress plugins & themes · reported by WPScanCritical 9.1
The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value (e.g., sending negative or out-of-range values) by intercepting and modifying requests.
Product
WP Hotel Booking
Fixed in
2.2.3
What to do
Update WP Hotel Booking to 2.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 16, 2025Productive Style: Stored Cross-Site ScriptingCVE-2025-8394 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Productive Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_productive_breadcrumb shortcode in all versions up to, and including, 1.1.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Productive Style
Affected
up to 1.1.23
What to do
Affects up to 1.1.23. Update Productive Style to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Sep 11, 2025User Meta – User Profile Builder and User management: Arbitrary file deletionCVE-2025-9693 · WordPress plugins & themes · reported by WordfenceHigh 8
The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the postInsertUserProcess function in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
User Meta – User Profile Builder and User management
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update User Meta – User Profile Builder and User management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 11, 2025Publish approval: Cross-Site Request ForgeryCVE-2025-9617 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Publish approval plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the publish_save_option function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Publish approval
Affected
up to 1.1
What to do
Affects up to 1.1. Update Publish approval to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 11, 2025Propovoice: All-in-One Client Management System: Arbitrary File ReadCVE-2025-8422 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.7.6.7 via the send_email() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Propovoice: All-in-One Client Management System
Affected
up to 1.7.6.7
What to do
Affects up to 1.7.6.7. Update Propovoice: All-in-One Client Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2025Wp Edit Password Protected: Does not validate a parameter before redirecting the user to its valueCVE-2025-9034 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Wp Edit Password Protected WordPress plugin before 1.3.5 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
Product
Wp Edit Password Protected
Fixed in
1.3.5
What to do
Update Wp Edit Password Protected to 1.3.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.