Vulnerability database

11,289 results · page 94 of 226

• May 19, 2025WPAMS: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39406 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPAMS apartment-management allows PHP Local File Inclusion.This issue affects WPAMS: from n/a through <= 44.0.

  Product

  WPAMS

  Affected

  up to 44.0

  What to do

  Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WPAMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39403 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).

  Product

  WPAMS

  Affected

  up to 44.0

  What to do

  Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WPBot Pro Wordpress Chatbot: Deserialization of Untrusted DataCVE-2025-47582 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Deserialization of Untrusted Data vulnerability in QuantumCloud WPBot Pro Wordpress Chatbot allows Object Injection.This issue affects WPBot Pro Wordpress Chatbot: from n/a through 12.7.0.

  Product

  WPBot Pro Wordpress Chatbot

  Affected

  up to 12.7.0

  What to do

  Affects up to 12.7.0. Update WPBot Pro Wordpress Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WP Vegas: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43841 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jamesdbruner WP Vegas vegas-fullscreen-background-slider allows Stored XSS.This issue affects WP Vegas: from n/a through <= 2.2.

  Product

  WP Vegas

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update WP Vegas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025cookieBAR: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43834 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tox82 cookieBAR cookiebar allows Stored XSS.This issue affects cookieBAR: from n/a through <= 1.7.0.

  Product

  cookieBAR

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update cookieBAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Absolute Links: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-43833 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amir Helzer Absolute Links absolute-links allows Blind SQL Injection.This issue affects Absolute Links: from n/a through <= 1.1.1.

  Product

  Absolute Links

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Absolute Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025JetTabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39450 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.7.

  Product

  JetTabs

  Affected

  up to 2.2.7

  What to do

  Affects up to 2.2.7. Update JetTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39448 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.4.1.

  Product

  JetElements For Elementor

  Affected

  up to 2.7.4.1

  What to do

  Affects up to 2.7.4.1. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025JetReviews: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39396 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through <= 2.3.6.

  Product

  JetReviews

  Affected

  up to 2.3.6

  What to do

  Affects up to 2.3.6. Update JetReviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Wireless Butler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26997 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in validas Wireless Butler wireless-butler allows Reflected XSS.This issue affects Wireless Butler: from n/a through <= 1.0.11.

  Product

  Wireless Butler

  Affected

  up to 1.0.11

  What to do

  Affects up to 1.0.11. Update Wireless Butler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Grip: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26735 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Candid themes Grip.This issue affects Grip: from n/a through 1.0.9.

  Product

  Grip

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Grip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Bimber - Viral Magazine: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47576 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Bringthepixel Bimber - Viral Magazine WordPress Theme.This issue affects Bimber - Viral Magazine WordPress Theme: from n/a through 9.2.5.

  Product

  Bimber - Viral Magazine

  Affected

  up to 9.2.5

  What to do

  Affects up to 9.2.5. Update Bimber - Viral Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Enhanced Paypal Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46543 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CharlyLeetham Enhanced Paypal Shortcodes enhanced-paypal-shortcodes allows Stored XSS.This issue affects Enhanced Paypal Shortcodes: from n/a through <= 0.5a.

  Product

  Enhanced Paypal Shortcodes

  Affected

  up to 0.5a

  What to do

  Affects up to 0.5a. Update Enhanced Paypal Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Author Box After Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46263 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lloyd Saunders Author Box After Posts author-box-after-posts allows Stored XSS.This issue affects Author Box After Posts: from n/a through <= 1.6.

  Product

  Author Box After Posts

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Author Box After Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Mad Mimi for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46262 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz Mad Mimi for WordPress mad-mimi allows Stored XSS.This issue affects Mad Mimi for WordPress: from n/a through <= 1.5.1.

  Product

  Mad Mimi for

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update Mad Mimi for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025iCafe Library: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39370 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cnilsson iCafe Library icafe-library allows SQL Injection.This issue affects iCafe Library: from n/a through <= 1.8.3.

  Product

  iCafe Library

  Affected

  up to 1.8.3

  What to do

  Affects up to 1.8.3. Update iCafe Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Posts for Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39369 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sihibbs Posts for Page posts-for-page allows DOM-Based XSS.This issue affects Posts for Page: from n/a through <= 2.1.

  Product

  Posts for Page

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Posts for Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Product Category Slider for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39364 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PluginEver Product Category Slider for WooCommerce woo-category-slider-by-pluginever allows PHP Local File Inclusion.This issue affects Product Category Slider for WooCommerce: from n/a through <= 4.3.4.

  Product

  Product Category Slider for WooCommerce

  Affected

  up to 4.3.4

  What to do

  Affects up to 4.3.4. Update Product Category Slider for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025TI WooCommerce Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32920 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.

  Product

  TI WooCommerce Wishlist

  Affected

  up to 2.10.0

  What to do

  Affects up to 2.10.0. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Ghostwriter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23988 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruno Cavalcante Ghostwriter allows Reflected XSS.This issue affects Ghostwriter: from n/a through 1.4.

  Product

  Ghostwriter

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Ghostwriter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Tiki Time: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23986 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fyrewurks Tiki Time allows Reflected XSS.This issue affects Tiki Time: from n/a through 1.3.

  Product

  Tiki Time

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Tiki Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Tijaji: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23983 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tijaji Tijaji tijaji allows Reflected XSS.This issue affects Tijaji: from n/a through <= 1.43.

  Product

  Tijaji

  Affected

  up to 1.43

  What to do

  Affects up to 1.43. Update Tijaji to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025CarZine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23981 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takimi Themes CarZine allows Reflected XSS.This issue affects CarZine: from n/a through 1.4.6.

  Product

  CarZine

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update CarZine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Flashy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23979 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in duwasai Flashy allows Reflected XSS.This issue affects Flashy: from n/a through 1.2.1.

  Product

  Flashy

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Flashy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Js O3 Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22792 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jinwen Js O3 Lite allows Reflected XSS.This issue affects Js O3 Lite: from n/a through 1.5.8.2.

  Product

  Js O3 Lite

  Affected

  up to 1.5.8.2

  What to do

  Affects up to 1.5.8.2. Update Js O3 Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025offset writing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22791 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in twh offset writing allows Reflected XSS.This issue affects offset writing: from n/a through 1.2.

  Product

  offset writing

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update offset writing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025moseter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22790 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in asmedia allows Reflected XSS.This issue affects moseter: from n/a through 1.3.1.

  Product

  moseter

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update moseter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025polka dots: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22789 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fyrewurks polka dots allows Reflected XSS.This issue affects polka dots: from n/a through 1.2.

  Product

  polka dots

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update polka dots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Tuaug4: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22687 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asmedia Tuaug4 allows Reflected XSS.This issue affects Tuaug4: from n/a through 1.4.

  Product

  Tuaug4

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Tuaug4 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025my white: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22678 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mythemes my white allows Reflected XSS.This issue affects my white: from n/a through 2.0.8.

  Product

  my white

  Affected

  up to 2.0.8

  What to do

  Affects up to 2.0.8. Update my white to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48341 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through <= 1.15.33.

  Product

  Form Maker by 10Web

  Affected

  up to 1.15.33

  What to do

  Affects up to 1.15.33. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025ElementInvader Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48288 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.5.

  Product

  ElementInvader Addons for Elementor

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025AutomatorWP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48280 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia AutomatorWP automatorwp allows Blind SQL Injection.This issue affects AutomatorWP: from n/a through <= 5.2.1.3.

  Product

  AutomatorWP

  Affected

  up to 5.2.1.3

  What to do

  Affects up to 5.2.1.3. Update AutomatorWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025RSVPMarker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48278 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in davidfcarr RSVPMarker rsvpmaker allows SQL Injection.This issue affects RSVPMarker : from n/a through <= 11.5.6.

  Product

  RSVPMarker

  Affected

  up to 11.5.6

  What to do

  Affects up to 11.5.6. Update RSVPMarker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Cost Calculator Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48277 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder allows Stored XSS.This issue affects Cost Calculator Builder: from n/a through <= 3.2.74.

  Product

  Cost Calculator Builder

  Affected

  up to 3.2.74

  What to do

  Affects up to 3.2.74. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Visual Composer Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48276 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Stored XSS.This issue affects Visual Composer Website Builder: from n/a through <= 45.11.0.

  Product

  Visual Composer Website Builder

  Affected

  up to 45.11.0

  What to do

  Affects up to 45.11.0. Update Visual Composer Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025SKT Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48270 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows DOM-Based XSS.This issue affects SKT Blocks: from n/a through <= 2.2.

  Product

  SKT Blocks

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update SKT Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WPAdverts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48269 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.This issue affects WPAdverts: from n/a through <= 2.2.3.

  Product

  WPAdverts

  Affected

  up to 2.2.3

  What to do

  Affects up to 2.2.3. Update WPAdverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Active Products Tables for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48266 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Stored XSS.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.6.8.

  Product

  Active Products Tables for WooCommerce

  Affected

  up to 1.0.6.8

  What to do

  Affects up to 1.0.6.8. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Product Code for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48264 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in artiosmedia Product Code for WooCommerce product-code-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Code for WooCommerce: from n/a through <= 1.5.0.

  Product

  Product Code for WooCommerce

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update Product Code for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025MultiVendorX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48263 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Stored XSS.This issue affects MultiVendorX: from n/a through <= 4.2.22.

  Product

  MultiVendorX

  Affected

  up to 4.2.22

  What to do

  Affects up to 4.2.22. Update MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Mega Menu Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48258 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jetmonsters Mega Menu Block getwid-megamenu allows Stored XSS.This issue affects Mega Menu Block: from n/a through <= 1.0.6.

  Product

  Mega Menu Block

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Mega Menu Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Projectopia: Missing AuthorizationCVE-2025-48257 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Projectopia Projectopia projectopia-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Projectopia: from n/a through <= 5.1.17.

  Product

  Projectopia

  Affected

  up to 5.1.17

  What to do

  Affects up to 5.1.17. Update Projectopia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Import Social Events: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48256 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes Import Social Events import-facebook-events allows Stored XSS.This issue affects Import Social Events: from n/a through <= 1.8.5.

  Product

  Import Social Events

  Affected

  up to 1.8.5

  What to do

  Affects up to 1.8.5. Update Import Social Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Change Add to Cart Button Text for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48254 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Change Add to Cart Button Text for WooCommerce add-to-cart-button-labels-for-woocommerce allows Stored XSS.This issue affects Change Add to Cart Button Text for WooCommerce: from n/a through <= 2.2.2.

  Product

  Change Add to Cart Button Text for WooCommerce

  Affected

  up to 2.2.2

  What to do

  Affects up to 2.2.2. Update Change Add to Cart Button Text for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Free Shipping Bar: Amount Left for Free Shipping for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48253 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce amount-left-free-shipping-woocommerce allows Stored XSS.This issue affects Free Shipping Bar: Amount Left for Free Shipping for WooCommerce: from n/a through <= 2.4.6.

  Product

  Free Shipping Bar: Amount Left for Free Shipping for WooCommerce

  Affected

  up to 2.4.6

  What to do

  Affects up to 2.4.6. Update Free Shipping Bar: Amount Left for Free Shipping for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Back Button Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48252 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button Widget back-button-widget allows Stored XSS.This issue affects Back Button Widget: from n/a through <= 1.6.8.

  Product

  Back Button Widget

  Affected

  up to 1.6.8

  What to do

  Affects up to 1.6.8. Update Back Button Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Additional Custom Emails & Recipients for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48251 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Emails & Recipients for WooCommerce custom-emails-for-woocommerce allows Stored XSS.This issue affects Additional Custom Emails & Recipients for WooCommerce: from n/a through <= 3.5.1.

  Product

  Additional Custom Emails & Recipients for WooCommerce

  Affected

  up to 3.5.1

  What to do

  Affects up to 3.5.1. Update Additional Custom Emails & Recipients for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Coupons & Add to Cart by URL Links for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48250 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Coupons & Add to Cart by URL Links for WooCommerce url-coupons-for-woocommerce-by-algoritmika allows Stored XSS.This issue affects Coupons & Add to Cart by URL Links for WooCommerce: from n/a through <= 1.7.7.

  Product

  Coupons & Add to Cart by URL Links for WooCommerce

  Affected

  up to 1.7.7

  What to do

  Affects up to 1.7.7. Update Coupons & Add to Cart by URL Links for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025EAN for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48249 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory EAN for WooCommerce ean-for-woocommerce allows Stored XSS.This issue affects EAN for WooCommerce: from n/a through <= 5.4.6.

  Product

  EAN for WooCommerce

  Affected

  up to 5.4.6

  What to do

  Affects up to 5.4.6. Update EAN for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.