Vulnerability database

11,289 results · page 96 of 226

• May 15, 2025Secure Downloads: Is vulnerable does not properly restrictCVE-2024-8031 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php.

  Product

  Secure Downloads

  Fixed in

  1.2.3

  What to do

  Update Secure Downloads to 1.2.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• May 15, 2025In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of thCVE-2024-7761 · WordPress plugins & themes · reported by WPScanMedium 6.1

  In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor

  Product

  process of testing the Simple Job Board

  Fixed in

  2.12.2

  What to do

  Update process of testing the Simple Job Board to 2.12.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• May 15, 2025Simple Video Directory: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6809 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

  Product

  Simple Video Directory

  Fixed in

  1.4.3

  What to do

  Update Simple Video Directory to 1.4.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• May 15, 2025User Profile Builder: Does not sanitise and escape some parameters before outputting its content on the admin areaCVE-2024-6708 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks.

  Product

  User Profile Builder

  Fixed in

  3.12.2

  What to do

  Update User Profile Builder to 3.12.2 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 15, 2025wccp-pro: Does not sanitise and escape some of its settingsCVE-2024-6693 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

  Product

  wccp-pro

  Fixed in

  15.3

  What to do

  Update wccp-pro to 15.3 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 15, 2025wccp-pro: Contains an open-redirect flaw via the referrer parameterCVE-2024-6690 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites

  Product

  wccp-pro

  Fixed in

  15.3

  What to do

  Update wccp-pro to 15.3 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 15, 2025ProfilePro: Does not sanitise and escape some parameters and lacks proper access controlsCVE-2024-6668 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks

  Product

  ProfilePro

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update ProfilePro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 15, 2025The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.CVE-2024-6584 · WordPress plugins & themes · reported by WPScanCritical 9.1

  The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.

  Fixed in

  3.4.7

  What to do

  Update the plugin to 3.4.7 or newer.

  Full record and what to do →NVD recordwpscan.com

• May 15, 2025Push Notification for Post and BuddyPress: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6159 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

  Product

  Push Notification for Post and BuddyPress

  Fixed in

  1.9.4

  What to do

  Update Push Notification for Post and BuddyPress to 1.9.4 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 15, 2025EventPrime: Does not properly validate permissionsCVE-2024-4665 · WordPress plugins & themes · reported by WPScanMedium 6.4

  The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce.

  Product

  EventPrime

  Fixed in

  3.5.0

  What to do

  Update EventPrime to 3.5.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• May 15, 2025Genesis Blocks: Does not properly escape attributes provided to some of its custom blocksCVE-2024-3901 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allowed to write posts (like those with the contributor role) to conduct Stored XSS attacks.

  Product

  Genesis Blocks

  Affected

  up to 3.1.3

  What to do

  Affects up to 3.1.3. Update Genesis Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• May 15, 2025Easy Property Listings: Does not sanitise and escape some of its settingsCVE-2024-2869 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

  Product

  Easy Property Listings

  Fixed in

  3.5.4

  What to do

  Update Easy Property Listings to 3.5.4 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 15, 2025360 Product Rotation: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13823 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.

  Product

  360 Product Rotation

  Affected

  up to 1.5.8

  What to do

  Affects up to 1.5.8. Update 360 Product Rotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 15, 2025The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private postsCVE-2024-12767 · WordPress plugins & themes · reported by WPScanLow 3.5

  The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts

  Product

  buddyboss-platform

  Fixed in

  2.7.60

  What to do

  Update buddyboss-platform to 2.7.60 or newer.

  Full record and what to do →NVD recordwpscan.com

• May 15, 2025Sailthru Triggermail: Does not sanitise and escape some of its settings and is missing CSRF protectionCVE-2024-11141 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings and is missing CSRF protection which could allow subscribers to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

  Product

  Sailthru Triggermail

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Sailthru Triggermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 15, 2025ApplyOnline: Does not protect uploaded files during the application processCVE-2024-10098 · WordPress plugins & themes · reported by WPScanLow 2.7

  The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain

  Product

  ApplyOnline

  Fixed in

  2.6.3

  What to do

  Update ApplyOnline to 2.6.3 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 15, 2025illi Link Party!: Lacks proper access controlsCVE-2023-7231 · WordPress plugins & themes · reported by WPScanHigh 7.3

  The illi Link Party! WordPress plugin through 1.0 lacks proper access controls, allowing unauthenticated visitors to delete links.

  Product

  illi Link Party!

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update illi Link Party! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• May 15, 2025edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector: Does not have CSRF checkCVE-2023-2334 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack

  Product

  edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector

  Fixed in

  1.4

  What to do

  Update edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector to 1.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• May 12, 2025SMS Alert Order Notifications: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47682 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows SQL Injection.This issue affects SMS Alert Order Notifications: from n/a through <= 3.8.1.

  Product

  SMS Alert Order Notifications

  Affected

  up to 3.8.1

  What to do

  Affects up to 3.8.1. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 12, 2025BNS Twitter Follow Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47578 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edward Caissie BNS Twitter Follow Button bns-twitter-follow-button allows DOM-Based XSS.This issue affects BNS Twitter Follow Button: from n/a through <= 0.3.8.

  Product

  BNS Twitter Follow Button

  Affected

  up to 0.3.8

  What to do

  Affects up to 0.3.8. Update BNS Twitter Follow Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 9, 2025Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode: Unauthorized access of dataCVE-2025-3949 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'seedprod_lite_get_revisisons' function in all versions up to, and including, 6.18.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the content of arbitrary landing page revisions.

  Product

  Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode

  Affected

  up to 6.18.15

  What to do

  Affects up to 6.18.15. Update Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 7, 2025Ultimate Member: Improper Control of Generation of Code ('Code Injection')CVE-2025-47691 · WordPress plugins & themes · reported by PatchstackMedium 5.5

  Improper Control of Generation of Code ('Code Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Code Injection.This issue affects Ultimate Member: from n/a through <= 2.10.3.

  Product

  Ultimate Member

  Affected

  up to 2.10.3

  What to do

  Affects up to 2.10.3. Update Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025DELUCKS SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47686 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Stored XSS.This issue affects DELUCKS SEO: from n/a through <= 2.5.9.

  Product

  DELUCKS SEO

  Affected

  up to 2.5.9

  What to do

  Affects up to 2.5.9. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025RS WP Book Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47679 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RS WP THEMES RS WP Book Showcase rs-wp-books-showcase allows DOM-Based XSS.This issue affects RS WP Book Showcase: from n/a through <= 6.7.59.

  Product

  RS WP Book Showcase

  Affected

  up to 6.7.59

  What to do

  Affects up to 6.7.59. Update RS WP Book Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47677 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Stored XSS.This issue affects Photo Gallery: from n/a through <= 2.7.7.25.

  Product

  Photo Gallery

  Affected

  up to 2.7.7.25

  What to do

  Affects up to 2.7.7.25. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025User Login History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47676 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Faiyaz Alam User Login History user-login-history allows Stored XSS.This issue affects User Login History: from n/a through <= 2.1.6.

  Product

  User Login History

  Affected

  up to 2.1.6

  What to do

  Affects up to 2.1.6. Update User Login History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025Woobox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47675 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woobox Woobox woobox allows DOM-Based XSS.This issue affects Woobox: from n/a through <= 1.6.

  Product

  Woobox

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Woobox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025CBX Map for Google Map & OpenStreetMap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47669 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sabuj Kundu CBX Map for Google Map & OpenStreetMap cbxgooglemap allows DOM-Based XSS.This issue affects CBX Map for Google Map & OpenStreetMap: from n/a through <= 1.1.12.

  Product

  CBX Map for Google Map & OpenStreetMap

  Affected

  up to 1.1.12

  What to do

  Affects up to 1.1.12. Update CBX Map for Google Map & OpenStreetMap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025CookieCode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47668 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cookiecode CookieCode cookiecode allows Stored XSS.This issue affects CookieCode: from n/a through <= 2.4.4.

  Product

  CookieCode

  Affected

  up to 2.4.4

  What to do

  Affects up to 2.4.4. Update CookieCode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025N360 | Splash Screen: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47665 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bistromatic N360 | Splash Screen n360-splash-screen allows Stored XSS.This issue affects N360 | Splash Screen: from n/a through <= 1.0.6.

  Product

  N360 | Splash Screen

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update N360 | Splash Screen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025Woobox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47662 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woobox Woobox woobox allows Stored XSS.This issue affects Woobox: from n/a through <= 1.6.

  Product

  Woobox

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Woobox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025WPBakery Visual Composer WHMCS Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47659 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidcoders WPBakery Visual Composer WHMCS Elements void-visual-whmcs-element allows Stored XSS.This issue affects WPBakery Visual Composer WHMCS Elements: from n/a through <= 1.0.4.3.

  Product

  WPBakery Visual Composer WHMCS Elements

  Affected

  up to 1.0.4.3

  What to do

  Affects up to 1.0.4.3. Update WPBakery Visual Composer WHMCS Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025Productive Commerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47657 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Productive Minds Productive Commerce productive-commerce allows SQL Injection.This issue affects Productive Commerce: from n/a through <= 1.1.40.

  Product

  Productive Commerce

  Affected

  up to 1.1.40

  What to do

  Affects up to 1.1.40. Update Productive Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025Spiraclethemes Site Library: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47656 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiracle Themes Spiraclethemes Site Library spiraclethemes-site-library allows Stored XSS.This issue affects Spiraclethemes Site Library: from n/a through <= 1.5.4.

  Product

  Spiraclethemes Site Library

  Affected

  up to 1.5.4

  What to do

  Affects up to 1.5.4. Update Spiraclethemes Site Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025WP-Recall: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47653 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in tggfref WP-Recall allows PHP Local File Inclusion. This issue affects WP-Recall: from n/a through 16.26.14.

  Product

  WP-Recall

  Affected

  up to 16.26.14

  What to do

  Affects up to 16.26.14. Update WP-Recall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025ELEX Product Feed for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47643 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX Product Feed for WooCommerce allows SQL Injection. This issue affects ELEX Product Feed for WooCommerce: from n/a through 3.1.2.

  Product

  ELEX Product Feed for WooCommerce

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update ELEX Product Feed for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025Supertext Translation and Proofreading: Cross-Site Request Forgery (CSRF)CVE-2025-47639 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Supertext Supertext Translation and Proofreading polylang-supertext allows Stored XSS.This issue affects Supertext Translation and Proofreading: from n/a through <= 4.26.

  Product

  Supertext Translation and Proofreading

  Affected

  up to 4.26

  What to do

  Affects up to 4.26. Update Supertext Translation and Proofreading to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025WP Discord Invite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47638 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarvesh M Rao WP Discord Invite wp-discord-invite allows Stored XSS.This issue affects WP Discord Invite: from n/a through <= 2.5.3.

  Product

  WP Discord Invite

  Affected

  up to 2.5.3

  What to do

  Affects up to 2.5.3. Update WP Discord Invite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025Awesome Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47632 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raihanul Islam Awesome Gallery awesome-gallery allows Stored XSS.This issue affects Awesome Gallery: from n/a through <= 1.0.

  Product

  Awesome Gallery

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Awesome Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025Ajax Load More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47630 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney Ajax Load More ajax-load-more allows Stored XSS.This issue affects Ajax Load More: from n/a through <= 7.3.1.2.

  Product

  Ajax Load More

  Affected

  up to 7.3.1.2

  What to do

  Affects up to 7.3.1.2. Update Ajax Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025Submission DOM tracking for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47626 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados Submission DOM tracking for Contact Form 7 cf7-submission-dom-tracking allows Stored XSS.This issue affects Submission DOM tracking for Contact Form 7: from n/a through <= 2.1.

  Product

  Submission DOM tracking for Contact Form 7

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Submission DOM tracking for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025DoFollow Case by Case: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47625 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case allows Stored XSS.This issue affects DoFollow Case by Case: from n/a through <= 3.5.1.

  Product

  DoFollow Case by Case

  Affected

  up to 3.5.1

  What to do

  Affects up to 3.5.1. Update DoFollow Case by Case to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025Easy PayPal Buy Now Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47623 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Easy PayPal Buy Now Button wp-ecommerce-paypal allows Stored XSS.This issue affects Easy PayPal Buy Now Button: from n/a through <= 2.0.

  Product

  Easy PayPal Buy Now Button

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Easy PayPal Buy Now Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025Email Notification on Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47622 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados Email Notification on Login email-notification-on-login allows Stored XSS.This issue affects Email Notification on Login: from n/a through <= 1.7.0.

  Product

  Email Notification on Login

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update Email Notification on Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025Meks Flexible Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47621 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks Flexible Shortcodes meks-flexible-shortcodes allows Stored XSS.This issue affects Meks Flexible Shortcodes: from n/a through <= 1.3.6.

  Product

  Meks Flexible Shortcodes

  Affected

  up to 1.3.6

  What to do

  Affects up to 1.3.6. Update Meks Flexible Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025WP Front User Submit / Front Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47617 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aharonyan WP Front User Submit / Front Editor front-editor allows Stored XSS.This issue affects WP Front User Submit / Front Editor: from n/a through <= 5.0.6.

  Product

  WP Front User Submit / Front Editor

  Affected

  up to 5.0.6

  What to do

  Affects up to 5.0.6. Update WP Front User Submit / Front Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025aBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47616 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Stored XSS.This issue affects aBlocks: from n/a through <= 1.9.2.

  Product

  aBlocks

  Affected

  up to 1.9.2

  What to do

  Affects up to 1.9.2. Update aBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025Amazon Product in a Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47615 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flowdee Amazon Product in a Post amazon-product-in-a-post-plugin allows Stored XSS.This issue affects Amazon Product in a Post: from n/a through <= 5.2.2.

  Product

  Amazon Product in a Post

  Affected

  up to 5.2.2

  What to do

  Affects up to 5.2.2. Update Amazon Product in a Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025Show All Comments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47607 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AppJetty Show All Comments show-all-comments-in-one-page allows Stored XSS.This issue affects Show All Comments: from n/a through <= 7.0.1.

  Product

  Show All Comments

  Affected

  up to 7.0.1

  What to do

  Affects up to 7.0.1. Update Show All Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 7, 2025WP jQuery DataTable: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47605 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AppJetty WP jQuery DataTable wp-jquery-datatable allows Stored XSS.This issue affects WP jQuery DataTable: from n/a through <= 4.1.0.

  Product

  WP jQuery DataTable

  Affected

  up to 4.1.0

  What to do

  Affects up to 4.1.0. Update WP jQuery DataTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.