Vulnerability database

11,286 results · page 77 of 226

• Sep 3, 2025WP Flow Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58625 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through <= 5.2.5.

  Product

  WP Flow Plus

  Affected

  up to 5.2.5

  What to do

  Affects up to 5.2.5. Update WP Flow Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Exchange Rates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58624 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in falselight Exchange Rates exchange-rates allows Stored XSS.This issue affects Exchange Rates: from n/a through <= 1.2.5.

  Product

  Exchange Rates

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Exchange Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Event Feed for Eventbrite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58623 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bohemia Plugins Event Feed for Eventbrite event-feed-for-eventbrite allows DOM-Based XSS.This issue affects Event Feed for Eventbrite: from n/a through <= 1.3.2.

  Product

  Event Feed for Eventbrite

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update Event Feed for Eventbrite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025PuzzleMe for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58621 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amuse Labs PuzzleMe for WordPress puzzleme allows Stored XSS.This issue affects PuzzleMe for WordPress: from n/a through <= 1.2.0.

  Product

  PuzzleMe for

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update PuzzleMe for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025PDF for WPForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58620 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Stored XSS.This issue affects PDF for WPForms: from n/a through <= 6.2.1.

  Product

  PDF for WPForms

  Affected

  up to 6.2.1

  What to do

  Affects up to 6.2.1. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Pie Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58618 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Jernigan Pie Calendar pie-calendar allows DOM-Based XSS.This issue affects Pie Calendar: from n/a through <= 1.2.8.

  Product

  Pie Calendar

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update Pie Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025WP Bannerize Pro: Server-Side Request Forgery (SSRF)CVE-2025-58615 · WordPress plugins & themes · reported by PatchstackMedium 4.4

  Server-Side Request Forgery (SSRF) vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Server Side Request Forgery.This issue affects WP Bannerize Pro: from n/a through <= 1.10.0.

  Product

  WP Bannerize Pro

  Affected

  up to 1.10.0

  What to do

  Affects up to 1.10.0. Update WP Bannerize Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Tooltipy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58614 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows Stored XSS.This issue affects Tooltipy: from n/a through <= 5.5.6.

  Product

  Tooltipy

  Affected

  up to 5.5.6

  What to do

  Affects up to 5.5.6. Update Tooltipy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025PropertyHive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58612 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Stored XSS.This issue affects PropertyHive: from n/a through <= 2.1.5.

  Product

  PropertyHive

  Affected

  up to 2.1.5

  What to do

  Affects up to 2.1.5. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Gallery PhotoBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58610 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through <= 1.3.1.

  Product

  Gallery PhotoBlocks

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Gallery PhotoBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Latest Post Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58609 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Stored XSS.This issue affects Latest Post Shortcode: from n/a through <= 14.0.3.

  Product

  Latest Post Shortcode

  Affected

  up to 14.0.3

  What to do

  Affects up to 14.0.3. Update Latest Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025MediaPress: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58608 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuddyDev MediaPress mediapress allows PHP Local File Inclusion.This issue affects MediaPress: from n/a through <= 1.5.9.1.

  Product

  MediaPress

  Affected

  up to 1.5.9.1

  What to do

  Affects up to 1.5.9.1. Update MediaPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Cookie Notice & Consent Banner for GDPR & CCPA Compliance: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58607 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA Compliance cookie-notice-and-consent-banner allows Stored XSS.This issue affects Cookie Notice & Consent Banner for GDPR & CCPA Compliance: from n/a through <= 1.7.11.

  Product

  Cookie Notice & Consent Banner for GDPR & CCPA Compliance

  Affected

  up to 1.7.11

  What to do

  Affects up to 1.7.11. Update Cookie Notice & Consent Banner for GDPR & CCPA Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025WP Delicious: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58605 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows Stored XSS.This issue affects WP Delicious: from n/a through <= 1.8.7.

  Product

  WP Delicious

  Affected

  up to 1.8.7

  What to do

  Affects up to 1.8.7. Update WP Delicious to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Mail Mint: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58604 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint mail-mint allows SQL Injection.This issue affects Mail Mint: from n/a through <= 1.18.5.

  Product

  Mail Mint

  Affected

  up to 1.18.5

  What to do

  Affects up to 1.18.5. Update Mail Mint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025If-So Dynamic Content Personalization: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58602 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Stored XSS.This issue affects If-So Dynamic Content Personalization: from n/a through <= 1.9.4.

  Product

  If-So Dynamic Content Personalization

  Affected

  up to 1.9.4

  What to do

  Affects up to 1.9.4. Update If-So Dynamic Content Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025MailOptin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58596 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in properfraction MailOptin mailoptin allows Stored XSS.This issue affects MailOptin: from n/a through <= 1.2.75.0.

  Product

  MailOptin

  Affected

  up to 1.2.75.0

  What to do

  Affects up to 1.2.75.0. Update MailOptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Orbit Fox by ThemeIsle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58593 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allows Stored XSS.This issue affects Orbit Fox by ThemeIsle: from n/a through <= 3.0.0.

  Product

  Orbit Fox by ThemeIsle

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update Orbit Fox by ThemeIsle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 31, 2025Blog Designer PRO: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47696 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.

  Product

  Blog Designer PRO

  Affected

  up to 3.4.7

  What to do

  Affects up to 3.4.7. Update Blog Designer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2025Pro Bulk Watermark Plugin for: Path Traversal: '.../...//'CVE-2025-4956 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress allows Path Traversal.This issue affects Pro Bulk Watermark Plugin for WordPress: from n/a through 2.0.

  Product

  Pro Bulk Watermark Plugin for

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Pro Bulk Watermark Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025YouTube Showcase: Improper Control of Generation of Code ('Code Injection')CVE-2025-54731 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Generation of Code ('Code Injection') vulnerability in emarket-design YouTube Showcase youtube-showcase allows Object Injection.This issue affects YouTube Showcase: from n/a through <= 3.5.1.

  Product

  YouTube Showcase

  Affected

  up to 3.5.1

  What to do

  Affects up to 3.5.1. Update YouTube Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Golo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54724 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Golo golo allows Reflected XSS.This issue affects Golo: from n/a through <= 1.7.1.

  Product

  Golo

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update Golo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Nest Addons: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-54720 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SteelThemes Nest Addons nest-addons allows SQL Injection.This issue affects Nest Addons: from n/a through <= 1.6.3.

  Product

  Nest Addons

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update Nest Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Ireca: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-54716 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Ireca ireca allows PHP Local File Inclusion.This issue affects Ireca: from n/a through <= 1.8.5.

  Product

  Ireca

  Affected

  up to 1.8.5

  What to do

  Affects up to 1.8.5. Update Ireca to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Zephyr Project Manager: Missing AuthorizationCVE-2025-54714 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zephyr Project Manager: from n/a through <= 3.3.201.

  Product

  Zephyr Project Manager

  Affected

  up to 3.3.201

  What to do

  Affects up to 3.3.201. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025WooCommerce csv import export: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-54029 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in extendons WooCommerce csv import export extendons-eo-wooimport-export allows Path Traversal.This issue affects WooCommerce csv import export: from n/a through <= 2.0.6.

  Product

  WooCommerce csv import export

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update WooCommerce csv import export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025UPC/EAN/GTIN Code Generator: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-53588 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator upc-ean-barcode-generator allows Path Traversal.This issue affects UPC/EAN/GTIN Code Generator: from n/a through <= 2.0.2.

  Product

  UPC/EAN/GTIN Code Generator

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update UPC/EAN/GTIN Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Captcha.eu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53579 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captcha.eu Captcha.eu captcha-eu allows Reflected XSS.This issue affects Captcha.eu: from n/a through < 1.0.61.

  Product

  Captcha.eu

  What to do

  Update Captcha.eu to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Kipso: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53578 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kipso kipso allows PHP Local File Inclusion.This issue affects Kipso: from n/a through <= 1.3.4.

  Product

  Kipso

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update Kipso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Ovatheme Events: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53576 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Ovatheme Events ova-events allows PHP Local File Inclusion.This issue affects Ovatheme Events: from n/a through <= 1.2.8.

  Product

  Ovatheme Events

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update Ovatheme Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Jannah: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53334 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TieLabs Jannah jannah allows PHP Local File Inclusion.This issue affects Jannah: from n/a through < 7.5.1.

  Product

  Jannah

  What to do

  Update Jannah to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Poll, Survey & Quiz Maker Plugin by Opinion Stage: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53328 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Opinion Stage Poll, Survey & Quiz Maker Plugin by Opinion Stage social-polls-by-opinionstage allows PHP Local File Inclusion.This issue affects Poll, Survey & Quiz Maker Plugin by Opinion Stage: from n/a through <= 19.11.0.

  Product

  Poll, Survey & Quiz Maker Plugin by Opinion Stage

  Affected

  up to 19.11.0

  What to do

  Affects up to 19.11.0. Update Poll, Survey & Quiz Maker Plugin by Opinion Stage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Gutenify: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53326 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodeYatri Gutenify gutenify allows PHP Local File Inclusion.This issue affects Gutenify: from n/a through <= 1.5.4.

  Product

  Gutenify

  Affected

  up to 1.5.4

  What to do

  Affects up to 1.5.4. Update Gutenify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Theme Blvd Widget Areas: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53289 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Theme Blvd Widget Areas theme-blvd-widget-areas allows Reflected XSS.This issue affects Theme Blvd Widget Areas: from n/a through <= 1.3.0.

  Product

  Theme Blvd Widget Areas

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Theme Blvd Widget Areas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Magazine: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53248 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magazine eximious-magazine allows PHP Local File Inclusion.This issue affects Magazine: from n/a through <= 1.2.2.

  Product

  Magazine

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025BlogMarks: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53247 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpinterface BlogMarks blogmarks allows PHP Local File Inclusion.This issue affects BlogMarks: from n/a through <= 1.0.8.

  Product

  BlogMarks

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update BlogMarks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Magazine Elite: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53244 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magazine Elite magazine-elite allows PHP Local File Inclusion.This issue affects Magazine Elite: from n/a through <= 1.2.4.

  Product

  Magazine Elite

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update Magazine Elite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Magazine Saga: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53227 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magazine Saga magazine-saga allows PHP Local File Inclusion.This issue affects Magazine Saga: from n/a through <= 1.2.7.

  Product

  Magazine Saga

  Affected

  up to 1.2.7

  What to do

  Affects up to 1.2.7. Update Magazine Saga to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025e-Boekhouden.nl: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53225 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eboekhouden e-Boekhouden.nl e-boekhoudennl-connector allows Reflected XSS.This issue affects e-Boekhouden.nl: from n/a through <= 1.9.3.

  Product

  e-Boekhouden.nl

  Affected

  up to 1.9.3

  What to do

  Affects up to 1.9.3. Update e-Boekhouden.nl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025NextGEN Gallery Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53224 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Koen Schuit NextGEN Gallery Search nextgen-gallery-search-galleries allows Reflected XSS.This issue affects NextGEN Gallery Search: from n/a through <= 2.12.

  Product

  NextGEN Gallery Search

  Affected

  up to 2.12

  What to do

  Affects up to 2.12. Update NextGEN Gallery Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Theme Switcher Reloaded: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53223 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undoIT Theme Switcher Reloaded theme-switcher-reloaded allows Reflected XSS.This issue affects Theme Switcher Reloaded: from n/a through <= 1.1.

  Product

  Theme Switcher Reloaded

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Theme Switcher Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025XmasB Quotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53220 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XmasB XmasB Quotes xmasb-quotes allows Reflected XSS.This issue affects XmasB Quotes: from n/a through <= 1.6.1.

  Product

  XmasB Quotes

  Affected

  up to 1.6.1

  What to do

  Affects up to 1.6.1. Update XmasB Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Glamer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53216 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeuniver Glamer glamer allows PHP Local File Inclusion.This issue affects Glamer: from n/a through <= 1.0.2.

  Product

  Glamer

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Glamer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Yahoo! WebPlayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53215 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8bitkid Yahoo! WebPlayer yahoo-media-player allows Reflected XSS.This issue affects Yahoo! WebPlayer: from n/a through <= 2.0.6.

  Product

  Yahoo! WebPlayer

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update Yahoo! WebPlayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Houzez: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49407 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.1.1.

  Product

  Houzez

  Affected

  up to 4.1.1

  What to do

  Affects up to 4.1.1. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Houzez: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49405 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Favethemes Houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a before 4.1.4.

  Product

  Houzez

  Fixed in

  4.1.4

  What to do

  Update Houzez to 4.1.4 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Listeo Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49404 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in purethemes Listeo Core listeo-core allows SQL Injection.This issue affects Listeo Core: from n/a through < 2.0.7.

  Product

  Listeo Core

  What to do

  Update Listeo Core to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Exertio Framework: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49402 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in scriptsbundle Exertio Framework exertio-framework allows Blind SQL Injection.This issue affects Exertio Framework: from n/a through <= 1.3.3.

  Product

  Exertio Framework

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update Exertio Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Neresa: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49383 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CocoBasic Neresa neresa-wp allows PHP Local File Inclusion.This issue affects Neresa: from n/a through <= 1.3.

  Product

  Neresa

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Neresa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Custom Comment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48365 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imaprogrammer Custom Comment customcomment allows Stored XSS.This issue affects Custom Comment: from n/a through <= 2.1.6.

  Product

  Custom Comment

  Affected

  up to 2.1.6

  What to do

  Affects up to 2.1.6. Update Custom Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.