Vulnerability database

8,931 results · page 91 of 179

• Mar 28, 2025Magic Embeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31433 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Miguel Sirvent Magic Embeds wp-embed-facebook allows Stored XSS.This issue affects Magic Embeds: from n/a through <= 3.1.2.

  Product

  Magic Embeds

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update Magic Embeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Pop-Up Chop Chop: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31432 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Chop Chop Pop-Up Chop Chop pop-up allows PHP Local File Inclusion.This issue affects Pop-Up Chop Chop: from n/a through <= 2.1.7.

  Product

  Pop-Up Chop Chop

  Affected

  up to 2.1.7

  What to do

  Affects up to 2.1.7. Update Pop-Up Chop Chop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Hostel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31102 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects Hostel: from n/a through <= 1.1.5.5.

  Product

  Hostel

  Affected

  up to 1.1.5.5

  What to do

  Affects up to 1.1.5.5. Update Hostel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Slider by BestWebSoft: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31099 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bestweblayout Slider by BestWebSoft slider-bws allows SQL Injection.This issue affects Slider by BestWebSoft: from n/a through <= 1.1.0.

  Product

  Slider by BestWebSoft

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Slider by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025PostX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31096 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post allows DOM-Based XSS.This issue affects PostX: from n/a through <= 4.1.25.

  Product

  PostX

  Affected

  up to 4.1.25

  What to do

  Affects up to 4.1.25. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025WP Posts Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31094 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Stored XSS.This issue affects WP Posts Carousel: from n/a through <= 1.3.8.

  Product

  WP Posts Carousel

  Affected

  up to 1.3.8

  What to do

  Affects up to 1.3.8. Update WP Posts Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025RPS Include Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31093 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redpixelstudios RPS Include Content rps-include-content allows DOM-Based XSS.This issue affects RPS Include Content: from n/a through <= 1.2.1.

  Product

  RPS Include Content

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update RPS Include Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Dropdown Multisite selector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31090 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alordiel Dropdown Multisite selector dropdown-multisite-selector allows Stored XSS.This issue affects Dropdown Multisite selector: from n/a through < 0.9.4.

  Product

  Dropdown Multisite selector

  What to do

  Update Dropdown Multisite selector to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Paid Member Subscriptions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31088 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Stored XSS.This issue affects Paid Member Subscriptions: from n/a through <= 2.14.3.

  Product

  Paid Member Subscriptions

  Affected

  up to 2.14.3

  What to do

  Affects up to 2.14.3. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Leaky Paywall: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31083 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Stored XSS.This issue affects Leaky Paywall: from n/a through <= 4.21.7.

  Product

  Leaky Paywall

  Affected

  up to 4.21.7

  What to do

  Affects up to 4.21.7. Update Leaky Paywall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Ultimate Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31077 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows DOM-Based XSS.This issue affects Ultimate Blocks: from n/a through <= 3.2.7.

  Product

  Ultimate Blocks

  Affected

  up to 3.2.7

  What to do

  Affects up to 3.2.7. Update Ultimate Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025MicroPayments: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-31075 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in videowhisper MicroPayments paid-membership allows Stored XSS.This issue affects MicroPayments: from n/a through <= 2.9.29.

  Product

  MicroPayments

  Affected

  up to 2.9.29

  What to do

  Affects up to 2.9.29. Update MicroPayments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Unlimited: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31073 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bensibley Unlimited unlimited allows Stored XSS.This issue affects Unlimited: from n/a through <= 1.45.

  Product

  Unlimited

  Affected

  up to 1.45

  What to do

  Affects up to 1.45. Update Unlimited to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Click to Chat – WP Support All-in-One Floating Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31092 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Floating Widget support-chat allows Stored XSS.This issue affects Click to Chat – WP Support All-in-One Floating Widget: from n/a through <= 2.3.4.

  Product

  Click to Chat – WP Support All-in-One Floating Widget

  Affected

  up to 2.3.4

  What to do

  Affects up to 2.3.4. Update Click to Chat – WP Support All-in-One Floating Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025VaultRE Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31101 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vault Group Pty Ltd VaultRE Contact Form 7 allows Stored XSS.This issue affects VaultRE Contact Form 7: from n/a through 1.0.

  Product

  VaultRE Contact Form 7

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update VaultRE Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Job Colors for WP Job Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31031 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Job Colors for WP Job Manager wp-job-manager-colors allows Stored XSS.This issue affects Job Colors for WP Job Manager: from n/a through <= 1.0.4.

  Product

  Job Colors for WP Job Manager

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Job Colors for WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26898 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.

  Product

  Traveler

  What to do

  Update Traveler to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025HUSKY: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26890 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY woocommerce-products-filter allows PHP Local File Inclusion.This issue affects HUSKY: from n/a through <= 1.3.6.4.

  Product

  HUSKY

  Affected

  up to 1.3.6.4

  What to do

  Affects up to 1.3.6.4. Update HUSKY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025MemberSpace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26874 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in memberspace MemberSpace memberspace allows Reflected XSS.This issue affects MemberSpace: from n/a through <= 2.1.13.

  Product

  MemberSpace

  Affected

  up to 2.1.13

  What to do

  Affects up to 2.1.13. Update MemberSpace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Hide My WP Ghost: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26909 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows PHP Local File Inclusion.This issue affects Hide My WP Ghost: from n/a through <= 5.4.01.

  Product

  Hide My WP Ghost

  Affected

  up to 5.4.01

  What to do

  Affects up to 5.4.01. Update Hide My WP Ghost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26762 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through <= 9.7.0.

  Product

  WooCommerce

  Affected

  up to 9.7.0

  What to do

  Affects up to 9.7.0. Update WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025SEO Plugin by Squirrly SEO: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22783 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SEO Squirrly SEO Plugin by Squirrly SEO squirrly-seo allows SQL Injection.This issue affects SEO Plugin by Squirrly SEO: from n/a through <= 12.4.03.

  Product

  SEO Plugin by Squirrly SEO

  Affected

  up to 12.4.03

  What to do

  Affects up to 12.4.03. Update SEO Plugin by Squirrly SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Paytm Payment Donation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22640 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in integrationdevpaytm Paytm Payment Donation paytm-donation allows Stored XSS.This issue affects Paytm Payment Donation: from n/a through <= 2.3.3.

  Product

  Paytm Payment Donation

  Affected

  up to 2.3.3

  What to do

  Affects up to 2.3.3. Update Paytm Payment Donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Product Table For WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22638 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in acowebs Product Table For WooCommerce product-table-for-woocommerce allows Stored XSS.This issue affects Product Table For WooCommerce: from n/a through <= 1.2.3.

  Product

  Product Table For WooCommerce

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Product Table For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Filled In: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22628 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision Filled In filled-in allows Stored XSS.This issue affects Filled In: from n/a through <= 1.9.2.

  Product

  Filled In

  Affected

  up to 1.9.2

  What to do

  Affects up to 1.9.2. Update Filled In to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Simple Google Calendar Outlook Events Block Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22497 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bramwaas Simple Google Calendar Outlook Events Block Widget simple-google-icalendar-widget allows Stored XSS.This issue affects Simple Google Calendar Outlook Events Block Widget: from n/a through <= 2.5.0.

  Product

  Simple Google Calendar Outlook Events Block Widget

  Affected

  up to 2.5.0

  What to do

  Affects up to 2.5.0. Update Simple Google Calendar Outlook Events Block Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Notif Bell: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22496 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MarMar8x Notif Bell notif-bell allows Stored XSS.This issue affects Notif Bell: from n/a through <= 0.9.8.

  Product

  Notif Bell

  Affected

  up to 0.9.8

  What to do

  Affects up to 0.9.8. Update Notif Bell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Whitish Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22278 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yudleethemes Whitish Lite allows Stored XSS.This issue affects Whitish Lite: from n/a through 2.1.13.

  Product

  Whitish Lite

  Affected

  up to 2.1.13

  What to do

  Affects up to 2.1.13. Update Whitish Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Include Mastodon Feed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22660 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wolfgang Include Mastodon Feed include-mastodon-feed allows DOM-Based XSS.This issue affects Include Mastodon Feed: from n/a through <= 1.9.9.

  Product

  Include Mastodon Feed

  Affected

  up to 1.9.9

  What to do

  Affects up to 1.9.9. Update Include Mastodon Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Orbit Fox by ThemeIsle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22659 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allows Stored XSS.This issue affects Orbit Fox by ThemeIsle: from n/a through <= 2.10.44.

  Product

  Orbit Fox by ThemeIsle

  Affected

  up to 2.10.44

  What to do

  Affects up to 2.10.44. Update Orbit Fox by ThemeIsle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Payment Forms for Paystack: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22652 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kendysond Payment Forms for Paystack payment-forms-for-paystack allows SQL Injection.This issue affects Payment Forms for Paystack: from n/a through <= 4.0.1.

  Product

  Payment Forms for Paystack

  Affected

  up to 4.0.1

  What to do

  Affects up to 4.0.1. Update Payment Forms for Paystack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WP Project Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22649 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager wedevs-project-manager allows Stored XSS.This issue affects WP Project Manager: from n/a through <= 2.6.22.

  Product

  WP Project Manager

  Affected

  up to 2.6.22

  What to do

  Affects up to 2.6.22. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Blog, Posts and Category Filter for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22648 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Devs Blog, Posts and Category Filter for Elementor blog-posts-and-category-for-elementor allows Stored XSS.This issue affects Blog, Posts and Category Filter for Elementor: from n/a through <= 2.0.1.

  Product

  Blog, Posts and Category Filter for Elementor

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Blog, Posts and Category Filter for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025aThemes Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22646 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.0.8.

  Product

  aThemes Addons for Elementor

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update aThemes Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22644 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce vayu-blocks allows Stored XSS.This issue affects Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: from n/a through <= 1.4.7.

  Product

  Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce

  Affected

  up to 1.4.7

  What to do

  Affects up to 1.4.7. Update Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Quick Interest Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26738 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Graham Quick Interest Slider quick-interest-slider allows DOM-Based XSS.This issue affects Quick Interest Slider: from n/a through <= 3.1.5.

  Product

  Quick Interest Slider

  Affected

  up to 3.1.5

  What to do

  Affects up to 3.1.5. Update Quick Interest Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025City Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26737 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yudleethemes City Store allows DOM-Based XSS.This issue affects City Store: from n/a through 1.4.5.

  Product

  City Store

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update City Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025MorningTime Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26736 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in victortihai MorningTime Lite morningtime-lite allows Stored XSS.This issue affects MorningTime Lite: from n/a through <= 1.3.2.

  Product

  MorningTime Lite

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update MorningTime Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Hester: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26734 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in peregrinethemes Hester hester allows Stored XSS.This issue affects Hester: from n/a through <= 1.1.10.

  Product

  Hester

  Affected

  up to 1.1.10

  What to do

  Affects up to 1.1.10. Update Hester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025StoreBiz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26732 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burgersoftware StoreBiz storebiz allows DOM-Based XSS.This issue affects StoreBiz: from n/a through <= 1.0.32.

  Product

  StoreBiz

  Affected

  up to 1.0.32

  What to do

  Affects up to 1.0.32. Update StoreBiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025ARPrice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26731 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARPrice arprice allows Stored XSS.This issue affects ARPrice: from n/a through <= 4.1.3.

  Product

  ARPrice

  Affected

  up to 4.1.3

  What to do

  Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Power Mag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22816 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetrendy Power Mag power-mag allows DOM-Based XSS.This issue affects Power Mag: from n/a through <= 1.1.5.

  Product

  Power Mag

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update Power Mag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025The Pack Elementor addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30925 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through <= 2.1.1.

  Product

  The Pack Elementor addons

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Simplebooklet PDF Viewer and Embedder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30922 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in simplebooklet Simplebooklet PDF Viewer and Embedder simplebooklet allows Stored XSS.This issue affects Simplebooklet PDF Viewer and Embedder: from n/a through <= 1.1.1.

  Product

  Simplebooklet PDF Viewer and Embedder

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Simplebooklet PDF Viewer and Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Newsletters: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30921 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through <= 4.9.9.7.

  Product

  Newsletters

  Affected

  up to 4.9.9.7

  What to do

  Affects up to 4.9.9.7. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WP Posts Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30920 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Stored XSS.This issue affects WP Posts Carousel: from n/a through <= 1.3.7.

  Product

  WP Posts Carousel

  Affected

  up to 1.3.7

  What to do

  Affects up to 1.3.7. Update WP Posts Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Structured Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30918 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme Structured Content structured-content allows Stored XSS.This issue affects Structured Content: from n/a through <= 1.6.3.

  Product

  Structured Content

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update Structured Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025SecuPress Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30907 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SecuPress SecuPress Free secupress allows DOM-Based XSS.This issue affects SecuPress Free: from n/a through <= 2.2.5.3.

  Product

  SecuPress Free

  Affected

  up to 2.2.5.3

  What to do

  Affects up to 2.2.5.3. Update SecuPress Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Chartify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30904 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Chartify chart-builder allows Stored XSS.This issue affects Chartify: from n/a through <= 3.1.7.

  Product

  Chartify

  Affected

  up to 3.1.7

  What to do

  Affects up to 3.1.7. Update Chartify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025SyntaxHighlighter Evolved: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30903 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Mills SyntaxHighlighter Evolved syntaxhighlighter allows DOM-Based XSS.This issue affects SyntaxHighlighter Evolved: from n/a through <= 3.7.1.

  Product

  SyntaxHighlighter Evolved

  Affected

  up to 3.7.1

  What to do

  Affects up to 3.7.1. Update SyntaxHighlighter Evolved to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.