Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

455new WordPress flaws this week

393,009entries in the database

12,203 results · page 83 of 245

Aug 28, 2025NextGEN Gallery Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53224 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Koen Schuit NextGEN Gallery Search nextgen-gallery-search-galleries allows Reflected XSS.This issue affects NextGEN Gallery Search: from n/a through <= 2.12.
Product
NextGEN Gallery Search
Affected
up to 2.12
What to do
Affects up to 2.12. Update NextGEN Gallery Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Theme Switcher Reloaded: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53223 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undoIT Theme Switcher Reloaded theme-switcher-reloaded allows Reflected XSS.This issue affects Theme Switcher Reloaded: from n/a through <= 1.1.
Product
Theme Switcher Reloaded
Affected
up to 1.1
What to do
Affects up to 1.1. Update Theme Switcher Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025XmasB Quotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53220 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XmasB XmasB Quotes xmasb-quotes allows Reflected XSS.This issue affects XmasB Quotes: from n/a through <= 1.6.1.
Product
XmasB Quotes
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update XmasB Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Yahoo! WebPlayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53215 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8bitkid Yahoo! WebPlayer yahoo-media-player allows Reflected XSS.This issue affects Yahoo! WebPlayer: from n/a through <= 2.0.6.
Product
Yahoo! WebPlayer
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Yahoo! WebPlayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Houzez: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49407 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.1.1.
Product
Houzez
Affected
up to 4.1.1
What to do
Affects up to 4.1.1. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Custom Comment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48365 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imaprogrammer Custom Comment customcomment allows Stored XSS.This issue affects Custom Comment: from n/a through <= 2.1.6.
Product
Custom Comment
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update Custom Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Varnish/Nginx Proxy Caching: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48360 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows Stored XSS.This issue affects Varnish/Nginx Proxy Caching: from n/a through <= 1.8.3.
Product
Varnish/Nginx Proxy Caching
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update Varnish/Nginx Proxy Caching to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Risk Free Cash On Delivery (COD) – WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48358 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in everythingwp Risk Free Cash On Delivery (COD) – WooCommerce risk-free-cash-on-delivery-cod-woocommerce allows Stored XSS.This issue affects Risk Free Cash On Delivery (COD) – WooCommerce: from n/a through <= 1.0.4.
Product
Risk Free Cash On Delivery (COD) – WooCommerce
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Risk Free Cash On Delivery (COD) – WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Kanpress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48356 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Isra Kanpress kanpress allows Stored XSS.This issue affects Kanpress: from n/a through <= 1.1.
Product
Kanpress
Affected
up to 1.1
What to do
Affects up to 1.1. Update Kanpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Better Post & Filter Widgets for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48354 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Stored XSS.This issue affects Better Post & Filter Widgets for Elementor: from n/a through <= 1.6.1.
Product
Better Post & Filter Widgets for Elementor
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Better Post & Filter Widgets for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Yandex Site search pinger: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48352 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sitesearch-yandex Yandex Site search pinger yandex-pinger allows Stored XSS.This issue affects Yandex Site search pinger: from n/a through <= 1.5.
Product
Yandex Site search pinger
Affected
up to 1.5
What to do
Affects up to 1.5. Update Yandex Site search pinger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Video Gallery – Vimeo and YouTube Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48349 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in origincode Video Gallery – Vimeo and YouTube Gallery smart-grid-gallery allows Stored XSS.This issue affects Video Gallery – Vimeo and YouTube Gallery: from n/a through <= 1.1.7.
Product
Video Gallery – Vimeo and YouTube Gallery
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Video Gallery – Vimeo and YouTube Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025bxSlider integration for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48347 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Mimoun-Prat bxSlider integration for WordPress bxslider-integration allows Stored XSS.This issue affects bxSlider integration for WordPress: from n/a through <= 1.7.2.
Product
bxSlider integration for
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update bxSlider integration for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025tli.tl auto Twitter poster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48324 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khashabawy tli.tl auto Twitter poster tlitl-auto-twitter-poster allows Stored XSS.This issue affects tli.tl auto Twitter poster: from n/a through <= 3.4.
Product
tli.tl auto Twitter poster
Affected
up to 3.4
What to do
Affects up to 3.4. Update tli.tl auto Twitter poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Advance Food Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48323 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Abunaser Khan Advance Food Menu advance-food-menu allows Stored XSS.This issue affects Advance Food Menu: from n/a through <= 1.0.
Product
Advance Food Menu
Affected
up to 1.0
What to do
Affects up to 1.0. Update Advance Food Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Statify Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48322 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Finn Dohrn Statify Widget statify-widget allows Stored XSS.This issue affects Statify Widget: from n/a through <= 1.4.6.
Product
Statify Widget
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Statify Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Mesa Mesa Reservation Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48319 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gslauraspeck Mesa Mesa Reservation Widget mesa-mesa-reservation-widget allows Stored XSS.This issue affects Mesa Mesa Reservation Widget: from n/a through <= 1.0.0.
Product
Mesa Mesa Reservation Widget
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Mesa Mesa Reservation Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Responsive Mobile-Friendly Tooltip: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48316 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ItayXD Responsive Mobile-Friendly Tooltip responsive-mobile-friendly-tooltip allows Stored XSS.This issue affects Responsive Mobile-Friendly Tooltip: from n/a through <= 1.6.6.
Product
Responsive Mobile-Friendly Tooltip
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Responsive Mobile-Friendly Tooltip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025WordPress HTML: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48315 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stanton119 WordPress HTML custom-html-bodyhead allows Stored XSS.This issue affects WordPress HTML: from n/a through <= 0.51.
Product
WordPress HTML
Affected
up to 0.51
What to do
Affects up to 0.51. Update WordPress HTML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Add Code To Head: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48314 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salubrio Add Code To Head add-code-to-head allows Stored XSS.This issue affects Add Code To Head: from n/a through <= 1.17.
Product
Add Code To Head
Affected
up to 1.17
What to do
Affects up to 1.17. Update Add Code To Head to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Tripadvisor Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48313 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kevin heath Tripadvisor Shortcode tripadvisor-shortcode allows Stored XSS.This issue affects Tripadvisor Shortcode: from n/a through <= 2.2.
Product
Tripadvisor Shortcode
Affected
up to 2.2
What to do
Affects up to 2.2. Update Tripadvisor Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025WPAvatar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48312 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 文派翻译（WP Chinese Translation） WPAvatar wpavatar allows Stored XSS.This issue affects WPAvatar: from n/a through <= 1.9.4.
Product
WPAvatar
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update WPAvatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Newsletter subscription optin module: Cross-Site Request Forgery (CSRF)CVE-2025-48308 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in nonletter Newsletter subscription optin module newsletter-subscription-widget-for-sendblaster allows Stored XSS.This issue affects Newsletter subscription optin module: from n/a through <= 1.2.9.
Product
Newsletter subscription optin module
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Newsletter subscription optin module to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Goal Tracker for Patreon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48305 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vikingjs Goal Tracker for Patreon goal-tracker-for-patreon allows Stored XSS.This issue affects Goal Tracker for Patreon: from n/a through <= 0.4.6.
Product
Goal Tracker for Patreon
Affected
up to 0.4.6
What to do
Affects up to 0.4.6. Update Goal Tracker for Patreon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Link View: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48110 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View link-view allows Stored XSS.This issue affects Link View: from n/a through <= 0.8.0.
Product
Link View
Affected
up to 0.8.0
What to do
Affects up to 0.8.0. Update Link View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Dynamic AJAX Product Filters for WooCommerce: Stored Cross-Site ScriptingCVE-2025-8073 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Dynamic AJAX Product Filters for WooCommerce
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Dynamic AJAX Product Filters for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 28, 2025Dynamic AJAX Product Filters for WooCommerce: Stored Cross-Site ScriptingCVE-2025-6255 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Dynamic AJAX Product Filters for WooCommerce
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Dynamic AJAX Product Filters for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 28, 2025Booking Calendar: Stored Cross-Site ScriptingCVE-2025-9346 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 10.14.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Booking Calendar
Affected
up to 10.14.1
What to do
Affects up to 10.14.1. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 28, 2025Unlimited Elements For Elementor: Stored Cross-Site ScriptingCVE-2025-8603 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.148 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Unlimited Elements For Elementor
Affected
up to 1.5.148
What to do
Affects up to 1.5.148. Update Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2025Pronamic Google Maps: Stored Cross-Site ScriptingCVE-2025-9352 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Pronamic Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the description field in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Pronamic Google Maps
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Pronamic Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 27, 2025UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP: Stored Cross-Site ScriptingCVE-2025-9344 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uwp_profile' and 'uwp_profile_header' shortcodes in all versions up to, and including, 1.2.42 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
Affected
up to 1.2.42
What to do
Affects up to 1.2.42. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 27, 2025Beaver Builder – WordPress Page Builder: Reflected Cross-Site ScriptingCVE-2025-8897 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘'fl_builder' parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Beaver Builder – WordPress Page Builder
Affected
up to 2.9.2.1
What to do
Affects up to 2.9.2.1. Update Beaver Builder – WordPress Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 27, 2025WP Thumbtack Review Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58216 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgwhite33 WP Thumbtack Review Slider wp-thumbtack-review-slider allows Stored XSS.This issue affects WP Thumbtack Review Slider: from n/a through <= 2.6.
Product
WP Thumbtack Review Slider
Affected
up to 2.6
What to do
Affects up to 2.6. Update WP Thumbtack Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2025Booking System Trafft: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58213 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ameliabooking Booking System Trafft booking-system-trafft allows Stored XSS.This issue affects Booking System Trafft: from n/a through <= 1.0.14.
Product
Booking System Trafft
Affected
up to 1.0.14
What to do
Affects up to 1.0.14. Update Booking System Trafft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2025Epeken All Kurir: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58212 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in epeken Epeken All Kurir epeken-all-kurir allows DOM-Based XSS.This issue affects Epeken All Kurir: from n/a through <= 2.0.1.
Product
Epeken All Kurir
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Epeken All Kurir to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2025Chatbox Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58211 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Stored XSS.This issue affects Chatbox Manager: from n/a through <= 1.2.6.
Product
Chatbox Manager
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Chatbox Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2025Transcoder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58209 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtCamp Transcoder transcoder allows Stored XSS.This issue affects Transcoder: from n/a through <= 1.4.0.
Product
Transcoder
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Transcoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2025PDF for Elementor Forms + Drag And Drop Template Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58208 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Stored XSS.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through <= 6.2.0.
Product
PDF for Elementor Forms + Drag And Drop Template Builder
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update PDF for Elementor Forms + Drag And Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2025ElementInvader Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58205 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows DOM-Based XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.6.
Product
ElementInvader Addons for Elementor
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2025Simple Download Monitor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58197 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mra13 Simple Download Monitor simple-download-monitor allows Stored XSS.This issue affects Simple Download Monitor: from n/a through <= 3.9.34.
Product
Simple Download Monitor
Affected
up to 3.9.34
What to do
Affects up to 3.9.34. Update Simple Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2025UiCore Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58196 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uicore UiCore Elements uicore-elements allows Stored XSS.This issue affects UiCore Elements: from n/a through <= 1.3.4.
Product
UiCore Elements
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update UiCore Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2025Xpro Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58195 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Stored XSS.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.17.
Product
Xpro Elementor Addons
Affected
up to 1.4.17
What to do
Affects up to 1.4.17. Update Xpro Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2025Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58194 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.4.3.
Product
Bold Page Builder
Affected
up to 5.4.3
What to do
Affects up to 5.4.3. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2025Link View: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49039 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View link-view allows Stored XSS.This issue affects Link View: from n/a through <= 0.8.0.
Product
Link View
Affected
up to 0.8.0
What to do
Affects up to 0.8.0. Update Link View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2025Admin Menu Groups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49035 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chaimchaikin Admin Menu Groups admin-menu-groups allows Stored XSS.This issue affects Admin Menu Groups: from n/a through <= 0.1.2.
Product
Admin Menu Groups
Affected
up to 0.1.2
What to do
Affects up to 0.1.2. Update Admin Menu Groups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2025Lazy Load for Videos: Stored Cross-Site ScriptingCVE-2025-7732 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Lazy Load for Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lazy‑loading handlers in all versions up to, and including, 2.18.7 due to insufficient input sanitization and output escaping. The plugin’s JavaScript registration handlers read the client‑supplied 'data-video-title' and 'href' attributes, decode HTML entities by default, and pass them directly into DOM sinks without any escaping or validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Lazy Load for Videos
Affected
up to 2.18.7
What to do
Affects up to 2.18.7. Update Lazy Load for Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 26, 2025All-in-One WP Migration and Backup: Stored Cross-Site ScriptingCVE-2025-8490 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
All-in-One WP Migration and Backup
Affected
up to 7.97
What to do
Affects up to 7.97. Update All-in-One WP Migration and Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 26, 2025SiteSEO – SEO Simplified: Stored Cross-Site ScriptingCVE-2025-9277 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the broken preg_replace expression in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SiteSEO – SEO Simplified
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update SiteSEO – SEO Simplified to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 24, 2025Spexo Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-8208 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Spexo Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 1.0.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Spexo Addons for Elementor
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update Spexo Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 23, 2025Ogulo – 360° Tour: Stored Cross-Site ScriptingCVE-2025-9131 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ogulo – 360° Tour plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, 1.0.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ogulo – 360° Tour
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update Ogulo – 360° Tour to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.