Vulnerability database

11,286 results · page 75 of 226

• Sep 10, 2025Maspik – Ultimate Spam Protection: Cross-Site Request ForgeryCVE-2025-9888 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Maspik – Ultimate Spam Protection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.6. This is due to missing or incorrect nonce validation on the clear_log function. This makes it possible for unauthenticated attackers to clear all spam logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Maspik – Ultimate Spam Protection

  Affected

  up to 2.5.6

  What to do

  Affects up to 2.5.6. Update Maspik – Ultimate Spam Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 9, 2025ZIP Code Based Content Protection: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-59008 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PressTigers ZIP Code Based Content Protection zip-code-based-content-protection allows SQL Injection.This issue affects ZIP Code Based Content Protection: from n/a through <= 1.0.0.

  Product

  ZIP Code Based Content Protection

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update ZIP Code Based Content Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58993 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS tutor allows SQL Injection.This issue affects Tutor LMS: from n/a through <= 3.7.4.

  Product

  Tutor LMS

  Affected

  up to 3.7.4

  What to do

  Affects up to 3.7.4. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025ShopLentor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58990 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Stored XSS.This issue affects ShopLentor: from n/a through <= 3.2.0.

  Product

  ShopLentor

  Affected

  up to 3.2.0

  What to do

  Affects up to 3.2.0. Update ShopLentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Dynamic Text Field For Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58989 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silverplugins217 Dynamic Text Field For Contact Form 7 dynamic-text-field-for-contact-form-7 allows Stored XSS.This issue affects Dynamic Text Field For Contact Form 7: from n/a through <= 1.0.

  Product

  Dynamic Text Field For Contact Form 7

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Dynamic Text Field For Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025My Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58988 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Dolson My Tickets my-tickets allows Stored XSS.This issue affects My Tickets: from n/a through <= 2.0.22.

  Product

  My Tickets

  Affected

  up to 2.0.22

  What to do

  Affects up to 2.0.22. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Football Pool: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58987 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.This issue affects Football Pool: from n/a through <= 2.12.6.

  Product

  Football Pool

  Affected

  up to 2.12.6

  What to do

  Affects up to 2.12.6. Update Football Pool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Additional Custom Product Tabs for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58985 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce product-tabs-for-woocommerce allows Stored XSS.This issue affects Additional Custom Product Tabs for WooCommerce: from n/a through <= 1.7.3.

  Product

  Additional Custom Product Tabs for WooCommerce

  Affected

  up to 1.7.3

  What to do

  Affects up to 1.7.3. Update Additional Custom Product Tabs for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58984 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through <= 2.11.20.

  Product

  Welcart e-Commerce

  Affected

  up to 2.11.20

  What to do

  Affects up to 2.11.20. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Include Me: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58983 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefano Lissa Include Me include-me allows Stored XSS.This issue affects Include Me: from n/a through <= 1.3.2.

  Product

  Include Me

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update Include Me to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Pixeline's Email Protector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58982 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline Pixeline's Email Protector pixelines-email-protector allows Stored XSS.This issue affects Pixeline's Email Protector: from n/a through <= 1.3.8.

  Product

  Pixeline's Email Protector

  Affected

  up to 1.3.8

  What to do

  Affects up to 1.3.8. Update Pixeline's Email Protector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025WP eBay Product Feeds: Server-Side Request Forgery (SSRF)CVE-2025-58977 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Server-Side Request Forgery (SSRF) vulnerability in Rhys Wynne WP eBay Product Feeds ebay-feeds-for-wordpress allows Server Side Request Forgery.This issue affects WP eBay Product Feeds: from n/a through <= 3.4.8.

  Product

  WP eBay Product Feeds

  Affected

  up to 3.4.8

  What to do

  Affects up to 3.4.8. Update WP eBay Product Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Ziston: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58215 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Ziston ziston allows PHP Local File Inclusion.This issue affects Ziston: from n/a through < 1.4.5.

  Product

  Ziston

  What to do

  Update Ziston to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Sala: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-54709 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Sala. This issue affects Sala: from n/a through 1.1.6.

  Product

  Sala

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Sala to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Blog Designer PRO: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47695 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.

  Product

  Blog Designer PRO

  Affected

  up to 3.4.7

  What to do

  Affects up to 3.4.7. Update Blog Designer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Blog Designer PRO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47694 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.

  Product

  Blog Designer PRO

  Affected

  up to 3.4.7

  What to do

  Affects up to 3.4.7. Update Blog Designer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Super Store Finder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47571 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in highwarden Super Store Finder superstorefinder-wp allows PHP Local File Inclusion.This issue affects Super Store Finder: from n/a through < 7.8.

  Product

  Super Store Finder

  What to do

  Update Super Store Finder to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025WooCommerce Photo Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47570 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews.This issue affects WooCommerce Photo Reviews: from n/a through <= 1.3.13.

  Product

  WooCommerce Photo Reviews

  Affected

  up to 1.3.13

  What to do

  Affects up to 1.3.13. Update WooCommerce Photo Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025WooCommerce Ultimate Gift Card: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47569 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPSwings WooCommerce Ultimate Gift Card woocommerce-ultimate-gift-card allows Blind SQL Injection.This issue affects WooCommerce Ultimate Gift Card: from n/a through <= 2.9.6.

  Product

  WooCommerce Ultimate Gift Card

  Affected

  up to 2.9.6

  What to do

  Affects up to 2.9.6. Update WooCommerce Ultimate Gift Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025WP SmartPay: Improper Validation of Specified Quantity in InputCVE-2025-32689 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Validation of Specified Quantity in Input vulnerability in Convers Lab WP SmartPay smartpay.This issue affects WP SmartPay: from n/a through <= 2.8.2.

  Product

  WP SmartPay

  Affected

  up to 2.8.2

  What to do

  Affects up to 2.8.2. Update WP SmartPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025WP Weixin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30875 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alexandre Froger WP Weixin wp-weixin allows Stored XSS.This issue affects WP Weixin: from n/a through <= 1.3.16.

  Product

  WP Weixin

  Affected

  up to 1.3.16

  What to do

  Affects up to 1.3.16. Update WP Weixin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Goza - Nonprofit Charity: Arbitrary file deletionCVE-2025-10134 · WordPress plugins & themes · reported by WordfenceCritical 9.1

  The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

  Product

  Goza - Nonprofit Charity

  Affected

  up to 3.2.2

  What to do

  Affects up to 3.2.2. Update Goza - Nonprofit Charity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordthemeforest.networdfence.com

• Sep 9, 2025Compress & Upload: Does not properly validate uploaded filesCVE-2025-8889 · WordPress plugins & themes · reported by WPScanLow 3.8

  The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

  Product

  Compress & Upload

  Fixed in

  1.0.5

  What to do

  Update Compress & Upload to 1.0.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 6, 2025ELEX WooCommerce Google Shopping (Google Product Feed): SQL InjectionCVE-2025-10046 · WordPress plugins & themes · reported by WordfenceMedium 4.9

  The ELEX WooCommerce Google Shopping (Google Product Feed) plugin for WordPress is vulnerable to SQL Injection via the 'file_to_delete' parameter in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  Product

  ELEX WooCommerce Google Shopping (Google Product Feed)

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update ELEX WooCommerce Google Shopping (Google Product Feed) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org

• Sep 6, 2025Cloud SAML SSO: Identity Provider DeletionCVE-2025-7045 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Cloud SAML SSO plugin for WordPress is vulnerable to Identity Provider Deletion due to a missing capability check on the delete_config action of the csso_handle_actions() function in all versions up to, and including, 1.0.19. This makes it possible for unauthenticated attackers to delete any configured IdP, breaking the SSO authentication flow and causing a denial-of-service.

  Product

  Cloud SAML SSO

  Affected

  up to 1.0.19

  What to do

  Affects up to 1.0.19. Update Cloud SAML SSO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 5, 2025UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for: Time-based SQL InjectionCVE-2025-10003 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘upload_file_remove’ function and 'htmlvar' parameter in all versions up to, and including, 1.2.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  Product

  UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for

  Affected

  up to 1.2.44

  What to do

  Affects up to 1.2.44. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Sep 5, 2025Miraculous: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58628 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Miraculous miraculous allows Blind SQL Injection.This issue affects Miraculous: from n/a through < 2.0.9.

  Product

  Miraculous

  What to do

  Update Miraculous to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Indutri: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58214 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Indutri indutri allows PHP Local File Inclusion.This issue affects Indutri: from n/a through < 1.3.0.

  Product

  Indutri

  What to do

  Update Indutri to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025MaxCoach: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58206 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MaxCoach maxcoach allows PHP Local File Inclusion.This issue affects MaxCoach: from n/a through <= 3.2.5.

  Product

  MaxCoach

  Affected

  up to 3.2.5

  What to do

  Affects up to 3.2.5. Update MaxCoach to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025InPost Gallery: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-57889 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 InPost Gallery inpost-gallery allows PHP Local File Inclusion.This issue affects InPost Gallery: from n/a through <= 2.1.4.5.

  Product

  InPost Gallery

  Affected

  up to 2.1.4.5

  What to do

  Affects up to 2.1.4.5. Update InPost Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025WordPress Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53307 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder WordPress Assistant assistant allows Reflected XSS.This issue affects WordPress Assistant: from n/a through <= 1.5.2.

  Product

  WordPress Assistant

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update WordPress Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Easy Flash Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48105 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Boiardt Easy Flash Embed easy-flash-embed allows Stored XSS.This issue affects Easy Flash Embed: from n/a through <= 1.0.

  Product

  Easy Flash Embed

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Easy Flash Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Today's Date Inserter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48103 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mulscully Today's Date Inserter todays-date-inserter allows Stored XSS.This issue affects Today's Date Inserter: from n/a through <= 1.2.1.

  Product

  Today's Date Inserter

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Today's Date Inserter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48102 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gourl GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership gourl-bitcoin-payment-gateway-paid-downloads-membership allows Stored XSS.This issue affects GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership: from n/a through <= 1.6.6.

  Product

  GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership

  Affected

  up to 1.6.6

  What to do

  Affects up to 1.6.6. Update GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Course Booking Platform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58887 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Course Finder | andré martin - it solutions & research UG Course Booking Platform course-booking-platform allows Stored XSS.This issue affects Course Booking Platform: from n/a through <= 1.0.0.

  Product

  Course Booking Platform

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Course Booking Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Instant Locations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58886 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tan Nguyen Instant Locations instant-locations allows Stored XSS.This issue affects Instant Locations: from n/a through <= 1.0.

  Product

  Instant Locations

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Instant Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025vipdrv: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58884 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ivan Drago vipdrv vipdrv-vip-test-drive allows Stored XSS.This issue affects vipdrv: from n/a through <= 1.0.3.

  Product

  vipdrv

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update vipdrv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Search Cloud One: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58883 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Harris Search Cloud One search-cloud-one allows Stored XSS.This issue affects Search Cloud One: from n/a through <= 2.2.5.

  Product

  Search Cloud One

  Affected

  up to 2.2.5

  What to do

  Affects up to 2.2.5. Update Search Cloud One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Simple Text Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58882 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in w1zzard Simple Text Slider simple-text-slider allows Stored XSS.This issue affects Simple Text Slider: from n/a through <= 1.0.5.

  Product

  Simple Text Slider

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Simple Text Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025New Simple Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58881 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus New Simple Gallery new-simple-gallery allows Blind SQL Injection.This issue affects New Simple Gallery: from n/a through <= 8.0.

  Product

  New Simple Gallery

  Affected

  up to 8.0

  What to do

  Affects up to 8.0. Update New Simple Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Translate This gTranslate Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58880 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reubenthiessen Translate This gTranslate Shortcode translate-this-google-translate-web-element-shortcode allows Stored XSS.This issue affects Translate This gTranslate Shortcode: from n/a through <= 1.0.

  Product

  Translate This gTranslate Shortcode

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Translate This gTranslate Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Woocommerce Gifts Product: Cross-Site Request Forgery (CSRF)CVE-2025-58878 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in usamafarooq Woocommerce Gifts Product woo-gift-product allows Cross Site Request Forgery.This issue affects Woocommerce Gifts Product: from n/a through <= 1.0.0.

  Product

  Woocommerce Gifts Product

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Woocommerce Gifts Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Aparat Video Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58876 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ali Aghdam Aparat Video Shortcode aparat-shortcode allows Stored XSS.This issue affects Aparat Video Shortcode: from n/a through <= 0.2.4.

  Product

  Aparat Video Shortcode

  Affected

  up to 0.2.4

  What to do

  Affects up to 0.2.4. Update Aparat Video Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025WP Github Gist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58875 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sudar Muthu WP Github Gist wp-github-gist allows Stored XSS.This issue affects WP Github Gist: from n/a through <= 0.5.

  Product

  WP Github Gist

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update WP Github Gist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025StoryMap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58874 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in josepsitjar StoryMap wp-storymap allows DOM-Based XSS.This issue affects StoryMap: from n/a through <= 2.1.

  Product

  StoryMap

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update StoryMap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Pushe Web Push Notification: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58873 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pusheco Pushe Web Push Notification pushe-webpush allows Stored XSS.This issue affects Pushe Web Push Notification: from n/a through <= 0.5.0.

  Product

  Pushe Web Push Notification

  Affected

  up to 0.5.0

  What to do

  Affects up to 0.5.0. Update Pushe Web Push Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Master Paper Collapse Toggle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58871 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Luis Rock Master Paper Collapse Toggle master-paper-collapse-toggle allows Stored XSS.This issue affects Master Paper Collapse Toggle: from n/a through <= 1.1.

  Product

  Master Paper Collapse Toggle

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Master Paper Collapse Toggle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025WP-GraphViz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58870 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeBAAT WP-GraphViz wp-graphviz allows DOM-Based XSS.This issue affects WP-GraphViz: from n/a through <= 1.5.1.

  Product

  WP-GraphViz

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update WP-GraphViz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025SimaCookie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58868 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simasicher SimaCookie simasicher-dsgvo-cookie allows Stored XSS.This issue affects SimaCookie: from n/a through <= 1.3.2.

  Product

  SimaCookie

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update SimaCookie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Easy Download Media Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58867 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Remi Corson Easy Download Media Counter easy-download-media-counter allows Stored XSS.This issue affects Easy Download Media Counter: from n/a through <= 1.2.

  Product

  Easy Download Media Counter

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Easy Download Media Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.