Vulnerability database

8,934 results · page 95 of 179

• Mar 24, 2025WP Featured Entries: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30569 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jahertor WP Featured Entries wp-featured-entries allows SQL Injection.This issue affects WP Featured Entries: from n/a through <= 1.0.

  Product

  WP Featured Entries

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP Featured Entries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Clink: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30566 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aryan Themes Clink clink allows DOM-Based XSS.This issue affects Clink: from n/a through <= 1.2.2.

  Product

  Clink

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Clink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025GMO Font Agent: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30553 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Z.com byGMO GMO Font Agent gmo-font-agent allows Stored XSS.This issue affects GMO Font Agent: from n/a through <= 1.6.

  Product

  GMO Font Agent

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update GMO Font Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Pretty file links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30551 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartredfox Pretty file links pretty-file-links allows Stored XSS.This issue affects Pretty file links: from n/a through <= 0.9.

  Product

  Pretty file links

  Affected

  up to 0.9

  What to do

  Affects up to 0.9. Update Pretty file links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025issuuPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30545 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline issuuPress issuupress allows Stored XSS.This issue affects issuuPress: from n/a through <= 1.3.2.

  Product

  issuuPress

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update issuuPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025AvaiBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30540 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in avaibook AvaiBook avaibook allows Stored XSS.This issue affects AvaiBook: from n/a through <= 1.2.

  Product

  AvaiBook

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update AvaiBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025BMo Expo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30539 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benedikt Mo BMo Expo bmo-expo allows Stored XSS.This issue affects BMo Expo: from n/a through <= 1.0.15.

  Product

  BMo Expo

  Affected

  up to 1.0.15

  What to do

  Affects up to 1.0.15. Update BMo Expo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Upload Quota per User: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30537 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristian Sarov Upload Quota per User upload-quota-per-user allows Stored XSS.This issue affects Upload Quota per User: from n/a through <= 1.3.

  Product

  Upload Quota per User

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Upload Quota per User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Beautiful Link Preview: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30536 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zeitwesentech Beautiful Link Preview beautiful-link-preview allows Stored XSS.This issue affects Beautiful Link Preview: from n/a through <= 1.5.0.

  Product

  Beautiful Link Preview

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update Beautiful Link Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Message ticker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30533 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Message ticker message-ticker allows Stored XSS.This issue affects Message ticker: from n/a through <= 9.3.

  Product

  Message ticker

  Affected

  up to 9.3

  What to do

  Affects up to 9.3. Update Message ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Weather Layer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30532 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MorganF Weather Layer weather-layer allows Stored XSS.This issue affects Weather Layer: from n/a through <= 4.2.1.

  Product

  Weather Layer

  Affected

  up to 4.2.1

  What to do

  Affects up to 4.2.1. Update Weather Layer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025AI Preloader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30530 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atikul AI Preloader ai-preloader allows Stored XSS.This issue affects AI Preloader: from n/a through <= 1.0.2.

  Product

  AI Preloader

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update AI Preloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025My Bootstrap Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30527 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetoolbox My Bootstrap Menu my-bootstrap-menu allows Stored XSS.This issue affects My Bootstrap Menu: from n/a through <= 1.2.1.

  Product

  My Bootstrap Menu

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update My Bootstrap Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WP Profitshare: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30525 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ProfitShare.ro WP Profitshare wp-profitshare allows SQL Injection.This issue affects WP Profitshare: from n/a through <= 1.4.9.

  Product

  WP Profitshare

  Affected

  up to 1.4.9

  What to do

  Affects up to 1.4.9. Update WP Profitshare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Super Simple Subscriptions: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30523 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Marcel-NL Super Simple Subscriptions super-simple-subscriptions allows SQL Injection.This issue affects Super Simple Subscriptions: from n/a through <= 1.1.0.

  Product

  Super Simple Subscriptions

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Super Simple Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 19, 2025Site Reviews: Does not properly sanitise and escape some of its Review fieldsCVE-2025-1232 · WordPress plugins & themes · reported by WPScanHigh 8.8

  The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks

  Product

  Site Reviews

  Fixed in

  7.2.5

  What to do

  Update Site Reviews to 7.2.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Mar 15, 2025All In Menu: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-27281 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cookforweb All In Menu all-in-menu allows Blind SQL Injection.This issue affects All In Menu: from n/a through <= 1.1.5.

  Product

  All In Menu

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update All In Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025FS Poster: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26978 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through <= 6.5.8.

  Product

  FS Poster

  Affected

  up to 6.5.8

  What to do

  Affects up to 6.5.8. Update FS Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025PrivateContent: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26976 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aldo Latino PrivateContent private-content.This issue affects PrivateContent: from n/a through <= 8.11.4.

  Product

  PrivateContent

  Affected

  up to 8.11.4

  What to do

  Affects up to 8.11.4. Update PrivateContent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025PrivateContent: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26972 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5.

  Product

  PrivateContent

  Affected

  up to 8.11.5

  What to do

  Affects up to 8.11.5. Update PrivateContent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025Ohio Extra: Improper Control of Generation of Code ('Code Injection')CVE-2025-26924 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Control of Generation of Code ('Code Injection') vulnerability in colabrio Ohio Extra ohio-extra allows Code Injection.This issue affects Ohio Extra: from n/a through <= 3.4.7.

  Product

  Ohio Extra

  Affected

  up to 3.4.7

  What to do

  Affects up to 3.4.7. Update Ohio Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025m1.DownloadList: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26895 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maennchen1.de m1.DownloadList m1downloadlist allows DOM-Based XSS.This issue affects m1.DownloadList: from n/a through <= 0.19.

  Product

  m1.DownloadList

  Affected

  up to 0.19

  What to do

  Affects up to 0.19. Update m1.DownloadList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025PublishPress Authors: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26886 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Authors publishpress-authors allows SQL Injection.This issue affects PublishPress Authors: from n/a through <= 4.7.3.

  Product

  PublishPress Authors

  Affected

  up to 4.7.3

  What to do

  Affects up to 4.7.3. Update PublishPress Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025Multiple Shipping And Billing Address For Woocommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26875 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silverplugins217 Multiple Shipping And Billing Address For Woocommerce different-shipping-and-billing-address-for-woocommerce allows SQL Injection.This issue affects Multiple Shipping And Billing Address For Woocommerce: from n/a through <= 1.3.

  Product

  Multiple Shipping And Billing Address For Woocommerce

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Multiple Shipping And Billing Address For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025WP AntiDDOS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26556 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zzmaster WP AntiDDOS wpantiddos allows Reflected XSS.This issue affects WP AntiDDOS: from n/a through <= 2.0.

  Product

  WP AntiDDOS

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update WP AntiDDOS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025Debug-Bar-Extender: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26555 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thorsten Ott Debug-Bar-Extender debug-bar-extender allows Reflected XSS.This issue affects Debug-Bar-Extender: from n/a through <= 0.5.

  Product

  Debug-Bar-Extender

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update Debug-Bar-Extender to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025WP Discord Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26554 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicola Mustone WP Discord Post wp-discord-post allows Reflected XSS.This issue affects WP Discord Post: from n/a through <= 2.1.0.

  Product

  WP Discord Post

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update WP Discord Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025Pre Order Addon for WooCommerce – Advance Order/Backorder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26553 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spring Devs Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin wc-pre-order allows Reflected XSS.This issue affects Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin: from n/a through <= 2.2.

  Product

  Pre Order Addon for WooCommerce – Advance Order/Backorder

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Pre Order Addon for WooCommerce – Advance Order/Backorder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025Random Image Selector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26548 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kdmurray Random Image Selector random-image-selector allows Reflected XSS.This issue affects Random Image Selector: from n/a through <= 2.4.

  Product

  Random Image Selector

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update Random Image Selector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025Random Posts, Mp3 Player + ShareButton: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23744 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dvs11 Random Posts, Mp3 Player + ShareButton random-posts-mp3-player-sharebutton allows Reflected XSS.This issue affects Random Posts, Mp3 Player + ShareButton: from n/a through <= 1.4.1.

  Product

  Random Posts, Mp3 Player + ShareButton

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Random Posts, Mp3 Player + ShareButton to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025DP ALTerminator - Missing ALT manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28943 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mylo2h2s DP ALTerminator - Missing ALT manager dp-alterminator-missing-alt-manager allows Stored XSS.This issue affects DP ALTerminator - Missing ALT manager: from n/a through <= 1.0.2.

  Product

  DP ALTerminator - Missing ALT manager

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update DP ALTerminator - Missing ALT manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025Lava Ajax Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28937 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lavacode Lava Ajax Search lava-ajax-search allows Stored XSS.This issue affects Lava Ajax Search: from n/a through <= 1.1.9.

  Product

  Lava Ajax Search

  Affected

  up to 1.1.9

  What to do

  Affects up to 1.1.9. Update Lava Ajax Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025Lunar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28936 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sakurapixel Lunar lunar-sell-photos-online allows Stored XSS.This issue affects Lunar: from n/a through <= 1.3.0.

  Product

  Lunar

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Lunar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025List Mixcloud: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28930 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rodolphe MOULIN List Mixcloud list-mixcloud allows Stored XSS.This issue affects List Mixcloud: from n/a through <= 1.4.

  Product

  List Mixcloud

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update List Mixcloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025Tabbed Login Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28929 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vivek Marakana Tabbed Login Widget tabbed-login allows Stored XSS.This issue affects Tabbed Login Widget: from n/a through <= 1.1.2.

  Product

  Tabbed Login Widget

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Tabbed Login Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025Post Read Time: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28926 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in popeating Post Read Time post-read-time allows Stored XSS.This issue affects Post Read Time: from n/a through <= 1.2.6.

  Product

  Post Read Time

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update Post Read Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025Easy Image Display: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28919 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shellbot Easy Image Display easy-image-display allows Stored XSS.This issue affects Easy Image Display: from n/a through <= 1.2.5.

  Product

  Easy Image Display

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Easy Image Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025Featured Image Thumbnail Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28918 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A. Jones Featured Image Thumbnail Grid thumbnail-grid allows Stored XSS.This issue affects Featured Image Thumbnail Grid: from n/a through <= 6.8.

  Product

  Featured Image Thumbnail Grid

  Affected

  up to 6.8

  What to do

  Affects up to 6.8. Update Featured Image Thumbnail Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025wordpress login form to anywhere: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28914 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Sharma wordpress login form to anywhere wp-show-login-form allows Stored XSS.This issue affects wordpress login form to anywhere: from n/a through <= 0.2.

  Product

  wordpress login form to anywhere

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update wordpress login form to anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025pipDisqus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28908 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pipdig pipDisqus pipdisqus allows Stored XSS.This issue affects pipDisqus: from n/a through <= 1.6.

  Product

  pipDisqus

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update pipDisqus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025WP Last Modified: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28907 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rahul Arora WP Last Modified wp-last-modified allows Stored XSS.This issue affects WP Last Modified: from n/a through <= 0.1.

  Product

  WP Last Modified

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update WP Last Modified to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025Skitter Slideshow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28906 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thiago S.F. Skitter Slideshow wp-skitter-slideshow allows Stored XSS.This issue affects Skitter Slideshow: from n/a through <= 2.5.2.

  Product

  Skitter Slideshow

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update Skitter Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025Featured Posts Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28905 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chaser324 Featured Posts Grid featured-posts-grid allows Stored XSS.This issue affects Featured Posts Grid: from n/a through <= 1.7.

  Product

  Featured Posts Grid

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Featured Posts Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025Custom top bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28895 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suman Biswas Custom top bar custom-top-bar allows Stored XSS.This issue affects Custom top bar: from n/a through <= 2.1.

  Product

  Custom top bar

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Custom top bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025Bee Layer Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28879 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aumsrini Bee Layer Slider bee-layer-slider allows Stored XSS.This issue affects Bee Layer Slider: from n/a through <= 1.1.

  Product

  Bee Layer Slider

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Bee Layer Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025Awesome Surveys: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28878 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Will Brubaker Awesome Surveys awesome-surveys allows Stored XSS.This issue affects Awesome Surveys: from n/a through <= 2.0.10.

  Product

  Awesome Surveys

  Affected

  up to 2.0.10

  What to do

  Affects up to 2.0.10. Update Awesome Surveys to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025BP Email Assign Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28875 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Stored XSS.This issue affects BP Email Assign Templates: from n/a through <= 1.6.

  Product

  BP Email Assign Templates

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update BP Email Assign Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025Block Spam By Math Reloaded: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28871 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Stored XSS.This issue affects Block Spam By Math Reloaded: from n/a through <= 2.2.4.

  Product

  Block Spam By Math Reloaded

  Affected

  up to 2.2.4

  What to do

  Affects up to 2.2.4. Update Block Spam By Math Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025amoCRM WebForm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28870 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in amocrm amoCRM WebForm amocrm-webform allows DOM-Based XSS.This issue affects amoCRM WebForm: from n/a through <= 1.1.

  Product

  amoCRM WebForm

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update amoCRM WebForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 10, 2025Fresh Framework: Improper Control of Generation of Code ('Code Injection')CVE-2025-26936 · WordPress plugins & themes · reported by PatchstackCritical 10

  Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Fresh Framework fresh-framework allows Code Injection.This issue affects Fresh Framework: from n/a through <= 1.70.0.

  Product

  Fresh Framework

  Affected

  up to 1.70.0

  What to do

  Affects up to 1.70.0. Update Fresh Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.