Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

448new WordPress flaws this week

393,150entries in the database

12,207 results · page 88 of 245

Jul 22, 2025WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2025-8015 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded image's 'Title' and 'Slide link' fields in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Shortcodes Plugin — Shortcodes Ultimate
Affected
up to 7.4.2
What to do
Affects up to 7.4.2. Update WP Shortcodes Plugin — Shortcodes Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Jul 22, 2025WP-Members Membership: Stored Cross-Site ScriptingCVE-2025-7495 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpmem_login_link' shortcode in all versions up to, and including, 3.5.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Members Membership
Affected
up to 3.5.4.1
What to do
Affects up to 3.5.4.1. Update WP-Members Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 21, 2025User Registration: Stored Cross-Site ScriptingCVE-2025-6831 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's urcr_restrict shortcode in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
User Registration
Affected
up to 4.2.4
What to do
Affects up to 4.2.4. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 21, 2025CRM and Lead Management by vcita: Stored Cross-Site ScriptingCVE-2025-5240 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CRM and Lead Management by vcita
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update CRM and Lead Management by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 21, 2025Ebook Store: Stored Cross-Site ScriptingCVE-2025-7486 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Ebook Store plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Order Details in all versions up to, and including, 5.8012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Ebook Store
Affected
up to 5.8012
What to do
Affects up to 5.8012. Update Ebook Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 21, 2025WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2025-7354 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Shortcodes Plugin — Shortcodes Ultimate
Affected
up to 7.4.2
What to do
Affects up to 7.4.2. Update WP Shortcodes Plugin — Shortcodes Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 21, 2025Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor: Stored Cross-Site ScriptingCVE-2025-4685 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML data attributes of multiple widgets, in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor
Affected
up to 3.4.8
What to do
Affects up to 3.4.8. Update Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 19, 2025ThemeREX Addons: Stored Cross-Site ScriptingCVE-2025-6997 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ThemeREX Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.35.1.1 due to insufficient input sanitization and output escaping. The plugin’s SVG rendering routine calls the trx_addons_get_svg_from_file() function on an unvalidated 'svg' parameter supplied via the shortcode or Elementor widget settings, then outputs it via the trx_addons_show_layout() function. Because there is no check on the URL’s origin, scheme, or the SVG content itself, authenticated attackers, with Contributor-level access and above, can supply a remote SVG and inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
ThemeREX Addons
Affected
up to 2.35.1.1
What to do
Affects up to 2.35.1.1. Update ThemeREX Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themerex.net wordfence.com
Jul 18, 2025Partnerský systém Martinus: Stored Cross-Site ScriptingCVE-2025-7661 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Partnerský systém Martinus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'martinus' shortcode in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Partnerský systém Martinus
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Partnerský systém Martinus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 18, 2025Temporarily Hidden Content: Stored Cross-Site ScriptingCVE-2025-7658 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Temporarily Hidden Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'temphc-start' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Temporarily Hidden Content
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Temporarily Hidden Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Jul 18, 2025Live Stream Badger: Stored Cross-Site ScriptingCVE-2025-7655 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Live Stream Badger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'livestream' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Live Stream Badger
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Live Stream Badger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Jul 18, 2025EPay.bg Payments: Stored Cross-Site ScriptingCVE-2025-7653 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EPay.bg Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'epay' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
EPay.bg Payments
Affected
up to 0.1
What to do
Affects up to 0.1. Update EPay.bg Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordfence.com
Jul 18, 2025Terms descriptions: Stored Cross-Site ScriptingCVE-2025-6719 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Terms descriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Terms descriptions
Affected
up to 3.4.8
What to do
Affects up to 3.4.8. Update Terms descriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jul 18, 2025Testimonial Post type: Stored Cross-Site ScriptingCVE-2025-5800 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Testimonial Post type plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play’ parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Testimonial Post type
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Testimonial Post type to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 18, 2025Crowdfunding for WooCommerce: Stored Cross-Site ScriptingCVE-2025-5767 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Crowdfunding for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 3.1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Crowdfunding for WooCommerce
Affected
up to 3.1.14
What to do
Affects up to 3.1.14. Update Crowdfunding for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 18, 2025Useful Tab Block – Responsive & AMP-Compatible: Stored Cross-Site ScriptingCVE-2025-5754 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Useful Tab Block – Responsive & AMP-Compatible plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Useful Tab Block – Responsive & AMP-Compatible
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Useful Tab Block – Responsive & AMP-Compatible to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 18, 2025Vertical scroll image slideshow gallery: Stored Cross-Site ScriptingCVE-2025-5752 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Vertical scroll image slideshow gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Vertical scroll image slideshow gallery
Affected
up to 11.1
What to do
Affects up to 11.1. Update Vertical scroll image slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 18, 2025Map My Locations: Stored Cross-Site ScriptingCVE-2025-7660 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Map My Locations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'map_my_locations' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Map My Locations
Affected
up to 1.1
What to do
Affects up to 1.1. Update Map My Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Jul 18, 2025Ruven Themes: Shortcodes: Stored Cross-Site ScriptingCVE-2025-7648 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ruven Themes: Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ruven_button' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ruven Themes: Shortcodes
Affected
up to 1.0
What to do
Affects up to 1.0. Update Ruven Themes: Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jul 17, 2025Knowledge Base: Stored Cross-Site ScriptingCVE-2025-7431 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin slug setting in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Knowledge Base
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 16, 2025Tennis Court Bookings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52787 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EZiHosting Tennis Court Bookings tennis-court-bookings allows Reflected XSS.This issue affects Tennis Court Bookings: from n/a through <= 1.2.7.
Product
Tennis Court Bookings
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Tennis Court Bookings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Media Folder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52786 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kingdom Creation Media Folder media-folder allows Reflected XSS.This issue affects Media Folder: from n/a through <= 1.0.0.
Product
Media Folder
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Media Folder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Dot html,php,xml etc pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52779 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc-pages allows Reflected XSS.This issue affects Dot html,php,xml etc pages: from n/a through <= 1.0.
Product
Dot html,php,xml etc pages
Affected
up to 1.0
What to do
Affects up to 1.0. Update Dot html,php,xml etc pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Pay with Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52777 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Reflected XSS.This issue affects Pay with Contact Form 7: from n/a through <= 1.0.4.
Product
Pay with Contact Form 7
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Pay with Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025SMu Manual DoFollow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49031 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefan M. SMu Manual DoFollow manuall-dofollow allows Reflected XSS.This issue affects SMu Manual DoFollow: from n/a through <= 1.8.1.
Product
SMu Manual DoFollow
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update SMu Manual DoFollow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Contact Form 7 Editor Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48345 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arisoft Contact Form 7 Editor Button cf7-editor-button allows Reflected XSS.This issue affects Contact Form 7 Editor Button: from n/a through <= 1.0.0.
Product
Contact Form 7 Editor Button
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Contact Form 7 Editor Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Contest Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48291 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through <= 26.0.6.
Product
Contest Gallery
Affected
up to 26.0.6
What to do
Affects up to 26.0.6. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Infility Global: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47652 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Reflected XSS.This issue affects Infility Global: from n/a through <= 2.13.4.
Product
Infility Global
Affected
up to 2.13.4
What to do
Affects up to 2.13.4. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025CSS3 Compare Pricing Tables for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47554 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress css3_web_pricing_tables_grids allows Reflected XSS.This issue affects CSS3 Compare Pricing Tables for WordPress: from n/a through <= 11.6.
Product
CSS3 Compare Pricing Tables for
Affected
up to 11.6
What to do
Affects up to 11.6. Update CSS3 Compare Pricing Tables for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Wordpress Auto Spinner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46500 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Reflected XSS.This issue affects Wordpress Auto Spinner: from n/a through <= 3.26.0.
Product
Wordpress Auto Spinner
Affected
up to 3.26.0
What to do
Affects up to 3.26.0. Update Wordpress Auto Spinner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Invico - WordPress Consulting Business: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31427 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Invico - WordPress Consulting Business Theme invico allows Reflected XSS.This issue affects Invico - WordPress Consulting Business Theme: from n/a through <= 1.9.
Product
Invico - WordPress Consulting Business
Affected
up to 1.9
What to do
Affects up to 1.9. Update Invico - WordPress Consulting Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Ofiz - WordPress Business Consulting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31072 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Ofiz - WordPress Business Consulting Theme ofiz allows Reflected XSS.This issue affects Ofiz - WordPress Business Consulting Theme: from n/a through <= 2.0.
Product
Ofiz - WordPress Business Consulting
Affected
up to 2.0
What to do
Affects up to 2.0. Update Ofiz - WordPress Business Consulting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Electrician - Electrical Service: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31055 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vergatheme Electrician - Electrical Service WordPress electrician allows Reflected XSS.This issue affects Electrician - Electrical Service WordPress: from n/a through <= 1.0.
Product
Electrician - Electrical Service
Affected
up to 1.0
What to do
Affects up to 1.0. Update Electrician - Electrical Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025ListingEasy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30955 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes ListingEasy listingeasy allows Reflected XSS.This issue affects ListingEasy: from n/a through <= 1.9.2.
Product
ListingEasy
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update ListingEasy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Medical Prescription Attachment Plugin for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2025-29009 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Webkul Medical Prescription Attachment Plugin for WooCommerce medical-prescription-attachment-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Medical Prescription Attachment Plugin for WooCommerce: from n/a through <= 1.2.3.
Product
Medical Prescription Attachment Plugin for WooCommerce
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Medical Prescription Attachment Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025LightBox Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54051 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through <= 1.1.30.
Product
LightBox Block
Affected
up to 1.1.30
What to do
Affects up to 1.1.30. Update LightBox Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Responsive Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54050 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Stored XSS.This issue affects Responsive Addons for Elementor: from n/a through <= 1.7.3.
Product
Responsive Addons for Elementor
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Responsive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025WPAdverts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54024 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.This issue affects WPAdverts: from n/a through <= 2.2.5.
Product
WPAdverts
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update WPAdverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025WP Delicious: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54023 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows DOM-Based XSS.This issue affects WP Delicious: from n/a through <= 1.8.4.
Product
WP Delicious
Affected
up to 1.8.4
What to do
Affects up to 1.8.4. Update WP Delicious to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Videopack: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54016 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Gilman Videopack video-embed-thumbnail-generator allows DOM-Based XSS.This issue affects Videopack: from n/a through <= 4.10.3.
Product
Videopack
Affected
up to 4.10.3
What to do
Affects up to 4.10.3. Update Videopack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54013 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through <= 2.11.16.
Product
Welcart e-Commerce
Affected
up to 2.11.16
What to do
Affects up to 2.11.16. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetSmartFilters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54009 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through <= 3.6.8.
Product
JetSmartFilters
Affected
up to 3.6.8
What to do
Affects up to 3.6.8. Update JetSmartFilters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54006 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.4.1.
Product
Bold Page Builder
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53996 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows Stored XSS.This issue affects JetSearch: from n/a through <= 3.5.10.1.
Product
JetSearch
Affected
up to 3.5.10.1
What to do
Affects up to 3.5.10.1. Update JetSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetPopup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53995 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetPopup jet-popup allows Stored XSS.This issue affects JetPopup: from n/a through <= 2.0.15.1.
Product
JetPopup
Affected
up to 2.0.15.1
What to do
Affects up to 2.0.15.1. Update JetPopup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetPopup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53994 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetPopup jet-popup allows DOM-Based XSS.This issue affects JetPopup: from n/a through <= 2.0.15.
Product
JetPopup
Affected
up to 2.0.15
What to do
Affects up to 2.0.15. Update JetPopup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetTricks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTricks jet-tricks allows Stored XSS.This issue affects JetTricks: from n/a through <= 1.5.4.1.
Product
JetTricks
Affected
up to 1.5.4.1
What to do
Affects up to 1.5.4.1. Update JetTricks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetBlocks For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53989 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.19.
Product
JetBlocks For Elementor
Affected
up to 1.3.19
What to do
Affects up to 1.3.19. Update JetBlocks For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetTabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53984 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through <= 2.2.9.
Product
JetTabs
Affected
up to 2.2.9
What to do
Affects up to 2.2.9. Update JetTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53982 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.7.
Product
JetElements For Elementor
Affected
up to 2.7.7
What to do
Affects up to 2.7.7. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.