Vulnerability database

9,245 results · page 99 of 185

• Mar 3, 2025IE CSS3 Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26589 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristopher Dino IE CSS3 Support ie-css3-support allows Reflected XSS.This issue affects IE CSS3 Support: from n/a through <= 2.0.1.

  Product

  IE CSS3 Support

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update IE CSS3 Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025TTT Crop: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26588 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gabrielperezs TTT Crop ttt-crop allows Reflected XSS.This issue affects TTT Crop: from n/a through <= 1.0.

  Product

  TTT Crop

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update TTT Crop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025sidebarTabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26587 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nghorta sidebarTabs sidebartabs allows Reflected XSS.This issue affects sidebarTabs: from n/a through <= 3.1.

  Product

  sidebarTabs

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update sidebarTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Events Planner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26586 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in abelony Events Planner events-planner allows Reflected XSS.This issue affects Events Planner: from n/a through <= 1.3.10.

  Product

  Events Planner

  Affected

  up to 1.3.10

  What to do

  Affects up to 1.3.10. Update Events Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025DL Leadback: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26585 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DyadyaLesha DL Leadback dl-leadback allows Reflected XSS.This issue affects DL Leadback: from n/a through <= 1.2.1.

  Product

  DL Leadback

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update DL Leadback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Mobile: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26563 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muneeb Mobile rocket-wp-mobile allows Reflected XSS.This issue affects Mobile: from n/a through <= 1.3.3.

  Product

  Mobile

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update Mobile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025ViperBar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26557 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in viperchill ViperBar viperbar allows Reflected XSS.This issue affects ViperBar: from n/a through <= 2.0.

  Product

  ViperBar

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update ViperBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Helloprint: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-26540 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows Path Traversal.This issue affects Helloprint: from n/a through <= 2.0.7.

  Product

  Helloprint

  Affected

  up to 2.0.7

  What to do

  Affects up to 2.0.7. Update Helloprint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Bitcoin / AltCoin Payment Gateway for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26535 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce woo-altcoin-payment-gateway allows Blind SQL Injection.This issue affects Bitcoin / AltCoin Payment Gateway for WooCommerce: from n/a through <= 1.7.6.

  Product

  Bitcoin / AltCoin Payment Gateway for WooCommerce

  Affected

  up to 1.7.6

  What to do

  Affects up to 1.7.6. Update Bitcoin / AltCoin Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Helloprint: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-26534 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows Path Traversal.This issue affects Helloprint: from n/a through <= 2.0.7.

  Product

  Helloprint

  Affected

  up to 2.0.7

  What to do

  Affects up to 2.0.7. Update Helloprint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Migrate Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25170 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DotsquaresLtd Migrate Posts migrate-post allows Reflected XSS.This issue affects Migrate Posts: from n/a through <= 1.0.

  Product

  Migrate Posts

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Migrate Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Authors Autocomplete Meta Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25169 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry Authors Autocomplete Meta Box authors-autocomplete-meta-box allows Reflected XSS.This issue affects Authors Autocomplete Meta Box: from n/a through <= 1.2.

  Product

  Authors Autocomplete Meta Box

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Authors Autocomplete Meta Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Staff Directory Plugin: Company Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25165 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in richardgabriel Staff Directory Plugin: Company Directory staff-directory-pro allows Stored XSS.This issue affects Staff Directory Plugin: Company Directory: from n/a through <= 4.3.

  Product

  Staff Directory Plugin: Company Directory

  Affected

  up to 4.3

  What to do

  Affects up to 4.3. Update Staff Directory Plugin: Company Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Meta Accelerator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25164 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yuichiro ABE Meta Accelerator meta-accelerator allows Reflected XSS.This issue affects Meta Accelerator: from n/a through <= 1.0.4.

  Product

  Meta Accelerator

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Meta Accelerator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Sports Rankings and Lists: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-25162 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in kutu62 Sports Rankings and Lists sports-rankings-lists allows Absolute Path Traversal.This issue affects Sports Rankings and Lists: from n/a through <= 1.0.2.

  Product

  Sports Rankings and Lists

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Sports Rankings and Lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Find Your Nearest: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25161 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SocialEvolution WP Find Your Nearest wp-find-your-nearest allows Reflected XSS.This issue affects WP Find Your Nearest: from n/a through <= 0.3.1.

  Product

  WP Find Your Nearest

  Affected

  up to 0.3.1

  What to do

  Affects up to 0.3.1. Update WP Find Your Nearest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Uncomplicated SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25158 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Antonio Sanchez Uncomplicated SEO uncomplicated-seo allows Reflected XSS.This issue affects Uncomplicated SEO: from n/a through <= 1.2.

  Product

  Uncomplicated SEO

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Uncomplicated SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Church Center: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25157 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpchurchteam WP Church Center wp-church-center allows Reflected XSS.This issue affects WP Church Center: from n/a through <= 1.3.3.

  Product

  WP Church Center

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update WP Church Center to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025uListing: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-25150 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix uListing ulisting allows Blind SQL Injection.This issue affects uListing: from n/a through <= 2.1.6.

  Product

  uListing

  Affected

  up to 2.1.6

  What to do

  Affects up to 2.1.6. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Less Compiler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25142 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Jake Group WP Less Compiler wp-less-compiler allows Stored XSS.This issue affects WP Less Compiler: from n/a through <= 1.3.0.

  Product

  WP Less Compiler

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update WP Less Compiler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Frontend Submit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25133 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in newbiesup WP Frontend Submit wp-frontend-submit allows Reflected XSS.This issue affects WP Frontend Submit: from n/a through <= 1.1.0.

  Product

  WP Frontend Submit

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update WP Frontend Submit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Visitor Details: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25132 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ravi Singh Visitor Details visitors-details allows Stored XSS.This issue affects Visitor Details: from n/a through <= 1.0.1.

  Product

  Visitor Details

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Visitor Details to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025RJ Quickcharts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25131 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in randyjensen RJ Quickcharts rj-quickcharts allows Stored XSS.This issue affects RJ Quickcharts: from n/a through <= 0.6.1.

  Product

  RJ Quickcharts

  Affected

  up to 0.6.1

  What to do

  Affects up to 0.6.1. Update RJ Quickcharts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Callback Request: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25129 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Callback Request allows Reflected XSS. This issue affects Callback Request: from n/a through 1.4.

  Product

  Callback Request

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Callback Request to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Contact Us By Lord Linus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25127 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rohitashv Singhal Contact Us By Lord Linus contact-us-by-lord-linus allows Reflected XSS.This issue affects Contact Us By Lord Linus: from n/a through <= 2.6.

  Product

  Contact Us By Lord Linus

  Affected

  up to 2.6

  What to do

  Affects up to 2.6. Update Contact Us By Lord Linus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Status Updater: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25124 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devu Status Updater fb-status-updater allows Reflected XSS.This issue affects Status Updater: from n/a through <= 1.9.2.

  Product

  Status Updater

  Affected

  up to 1.9.2

  What to do

  Affects up to 1.9.2. Update Status Updater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Woocommerce osCommerce Sync: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25119 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alejandro Aranda Woocommerce osCommerce Sync woo-oscommerce-sync allows Reflected XSS.This issue affects Woocommerce osCommerce Sync: from n/a through <= 2.0.20.

  Product

  Woocommerce osCommerce Sync

  Affected

  up to 2.0.20

  What to do

  Affects up to 2.0.20. Update Woocommerce osCommerce Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Top Bar – PopUps – by WPOptin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25118 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Danish Ali Malik Top Bar – PopUps – by WPOptin wpoptin allows Reflected XSS.This issue affects Top Bar – PopUps – by WPOptin: from n/a through <= 2.0.8.

  Product

  Top Bar – PopUps – by WPOptin

  Affected

  up to 2.0.8

  What to do

  Affects up to 2.0.8. Update Top Bar – PopUps – by WPOptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Like dislike plus counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25115 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zeshan Abdullah Like dislike plus counter like-dislike-plus-counter allows Stored XSS.This issue affects Like dislike plus counter: from n/a through <= 1.0.

  Product

  Like dislike plus counter

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Like dislike plus counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025User Role: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25114 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ehabstar User Role user-roles allows Reflected XSS.This issue affects User Role: from n/a through <= 1.0.

  Product

  User Role

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update User Role to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Implied Cookie Consent: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25113 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Senktec Implied Cookie Consent implied-cookie-consent allows Reflected XSS.This issue affects Implied Cookie Consent: from n/a through <= 1.3.

  Product

  Implied Cookie Consent

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Implied Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Social Links: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-25112 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kareemsultan Social Links social-links allows Command Line Execution through SQL Injection.This issue affects Social Links: from n/a through <= 1.2.

  Product

  Social Links

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Social Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Vehicle Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-25109 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky WP Vehicle Manager js-vehicle-manager allows PHP Local File Inclusion.This issue affects WP Vehicle Manager: from n/a through <= 3.1.

  Product

  WP Vehicle Manager

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update WP Vehicle Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025SW Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25108 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shalomworld SW Plus shalom-world-media-gallery allows Reflected XSS.This issue affects SW Plus: from n/a through <= 2.1.

  Product

  SW Plus

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update SW Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Yahoo BOSS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25102 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Harrison Yahoo BOSS yahoo-boss allows Reflected XSS.This issue affects Yahoo BOSS: from n/a through <= 0.7.

  Product

  Yahoo BOSS

  Affected

  up to 0.7

  What to do

  Affects up to 0.7. Update Yahoo BOSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Appointment Buddy Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25099 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in accreteinfosolution Appointment Buddy Widget appointment-buddy-online-appointment-booking-by-accrete allows Cross-Site Scripting (XSS).This issue affects Appointment Buddy Widget: from n/a through <= 1.2.

  Product

  Appointment Buddy Widget

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Appointment Buddy Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025All push notification for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25092 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gtlwpdev All push notification for WP all-push-notification allows Reflected XSS.This issue affects All push notification for WP: from n/a through <= 1.5.3.

  Product

  All push notification for WP

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update All push notification for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Dreamstime Stock Photos: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25090 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dreamstime Dreamstime Stock Photos dreamstime-stock-photos allows Reflected XSS.This issue affects Dreamstime Stock Photos: from n/a through <= 4.1.

  Product

  Dreamstime Stock Photos

  Affected

  up to 4.1

  What to do

  Affects up to 4.1. Update Dreamstime Stock Photos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Image Rotator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25089 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in appten Image Rotator appten-image-rotator allows Reflected XSS.This issue affects Image Rotator: from n/a through <= 2.0.

  Product

  Image Rotator

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Image Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025seekXL Snapr: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25087 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim seekXL Snapr seekxl-snapr allows Reflected XSS.This issue affects seekXL Snapr: from n/a through <= 2.0.6.

  Product

  seekXL Snapr

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update seekXL Snapr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025UniTimetable: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25084 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antrouss UniTimetable unitimetable allows Stored XSS.This issue affects UniTimetable: from n/a through <= 1.1.

  Product

  UniTimetable

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update UniTimetable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025EP4 More Embeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25083 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dave Lavoie EP4 More Embeds ep4-more-embeds allows Stored XSS.This issue affects EP4 More Embeds: from n/a through <= 1.0.0.

  Product

  EP4 More Embeds

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update EP4 More Embeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Album Reviewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25070 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ed atrero Album Reviewer albumreviewer allows Stored XSS.This issue affects Album Reviewer: from n/a through <= 2.0.2.

  Product

  Album Reviewer

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update Album Reviewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025CM Map Locations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24758 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations cm-map-locations allows Reflected XSS.This issue affects CM Map Locations: from n/a through <= 2.0.8.

  Product

  CM Map Locations

  Affected

  up to 2.0.8

  What to do

  Affects up to 2.0.8. Update CM Map Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025CM Pop-Up banners: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24694 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Pop-Up banners cm-pop-up-banners allows Reflected XSS.This issue affects CM Pop-Up banners: from n/a through <= 1.7.6.

  Product

  CM Pop-Up banners

  Affected

  up to 1.7.6

  What to do

  Affects up to 1.7.6. Update CM Pop-Up banners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Easy Post Mailer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23956 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Leishman WP Easy Post Mailer wp-mailer allows Reflected XSS.This issue affects WP Easy Post Mailer: from n/a through <= 0.64.

  Product

  WP Easy Post Mailer

  Affected

  up to 0.64

  What to do

  Affects up to 0.64. Update WP Easy Post Mailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Popliup: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-23945 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Webliup Popliup popliup allows PHP Local File Inclusion.This issue affects Popliup: from n/a through <= 1.1.1.

  Product

  Popliup

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Popliup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Rebrand Fluent Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23904 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rebrandpress Rebrand Fluent Forms rebrand-fluent-forms allows Reflected XSS.This issue affects Rebrand Fluent Forms: from n/a through <= 1.0.

  Product

  Rebrand Fluent Forms

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Rebrand Fluent Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Local Shipping Labels for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23903 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woofx Local Shipping Labels for WooCommerce local-shipping-labels-for-woocommerce allows Reflected XSS.This issue affects Local Shipping Labels for WooCommerce: from n/a through <= 1.0.0.

  Product

  Local Shipping Labels for WooCommerce

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Local Shipping Labels for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Stray Random Quotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23883 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in unalignedcoder Stray Random Quotes stray-quotes allows Reflected XSS.This issue affects Stray Random Quotes: from n/a through <= 1.9.9.

  Product

  Stray Random Quotes

  Affected

  up to 1.9.9

  What to do

  Affects up to 1.9.9. Update Stray Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.