Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,905 results · page 100 of 319
Aug 14, 2025CM On Demand Search And Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54727 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Stored XSS.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.2.
- Product
- CM On Demand Search And Replace
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update CM On Demand Search And Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025B Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54708 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows DOM-Based XSS.This issue affects B Blocks: from n/a through <= 2.0.5.
- Product
- B Blocks
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update B Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 202512 Step Meeting List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54054 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Stored XSS.This issue affects 12 Step Meeting List: from n/a through <= 3.18.3.
- Product
- 12 Step Meeting List
- Affected
- up to 3.18.3
- What to do
- Affects up to 3.18.3. Update 12 Step Meeting List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Findgo: Cross-Site Request Forgery (CSRF)CVE-2025-53587 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in ApusTheme Findgo findgo allows Cross Site Request Forgery.This issue affects Findgo: from n/a through <= 1.3.57.
- Product
- Findgo
- Affected
- up to 1.3.57
- What to do
- Affects up to 1.3.57. Update Findgo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WordLift: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53582 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordLift WordLift wordlift allows Stored XSS.This issue affects WordLift: from n/a through <= 3.54.5.
- Product
- WordLift
- Affected
- up to 3.54.5
- What to do
- Affects up to 3.54.5. Update WordLift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025RSS Feed Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53581 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artiosmedia RSS Feed Pro rss-feed-pro allows Stored XSS.This issue affects RSS Feed Pro: from n/a through <= 1.1.8.
- Product
- RSS Feed Pro
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update RSS Feed Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Primer MyData for Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53575 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in primersoftware Primer MyData for Woocommerce primer-mydata allows Reflected XSS.This issue affects Primer MyData for Woocommerce: from n/a through <= 4.2.5.
- Product
- Primer MyData for Woocommerce
- Affected
- up to 4.2.5
- What to do
- Affects up to 4.2.5. Update Primer MyData for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Kalium: Cross-Site Request Forgery (CSRF)CVE-2025-53347 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Laborator Kalium kalium allows Cross Site Request Forgery.This issue affects Kalium: from n/a through <= 3.18.3.
- Product
- Kalium
- Affected
- up to 3.18.3
- What to do
- Affects up to 3.18.3. Update Kalium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Modernize: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53342 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Modernize modernize allows Stored XSS.This issue affects Modernize: from n/a through <= 3.4.0.
- Product
- Modernize
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Modernize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WP Rentals: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53330 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpEstate WP Rentals wprentals allows Stored XSS.This issue affects WP Rentals: from n/a through <= 3.16.1.
- Product
- WP Rentals
- Affected
- up to 3.16.1
- What to do
- Affects up to 3.16.1. Update WP Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Build App Online: Cross-Site Request Forgery (CSRF)CVE-2025-53249 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in hakeemnala Build App Online build-app-online allows Cross Site Request Forgery.This issue affects Build App Online: from n/a through <= 1.0.23.
- Product
- Build App Online
- Affected
- up to 1.0.23
- What to do
- Affects up to 1.0.23. Update Build App Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WP-Database-Optimizer-Tools: Cross-Site Request Forgery (CSRF)CVE-2025-53219 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in pl4g4 WP-Database-Optimizer-Tools wp-database-optimizer-tools allows Cross Site Request Forgery.This issue affects WP-Database-Optimizer-Tools: from n/a through <= 0.2.
- Product
- WP-Database-Optimizer-Tools
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update WP-Database-Optimizer-Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025StoryMap: Cross-Site Request Forgery (CSRF)CVE-2025-52797 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in josepsitjar StoryMap wp-storymap allows SQL Injection.This issue affects StoryMap: from n/a through <= 2.1.
- Product
- StoryMap
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update StoryMap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Video Expander: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52771 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bcupham Video Expander video-expander allows Stored XSS.This issue affects Video Expander: from n/a through <= 1.0.
- Product
- Video Expander
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Video Expander to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025flexo-social-gallery: Cross-Site Request Forgery (CSRF)CVE-2025-52769 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in flexostudio flexo-social-gallery flexo-social-gallery allows Cross Site Request Forgery.This issue affects flexo-social-gallery: from n/a through <= 1.0006.
- Product
- flexo-social-gallery
- Affected
- up to 1.0006
- What to do
- Affects up to 1.0006. Update flexo-social-gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025NetInsight Analytics Implementation: Cross-Site Request Forgery (CSRF)CVE-2025-52767 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in lisensee NetInsight Analytics Implementation Plugin netinsight-analytics-implementation-plugin allows Cross Site Request Forgery.This issue affects NetInsight Analytics Implementation Plugin: from n/a through <= 1.0.3.
- Product
- NetInsight Analytics Implementation
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update NetInsight Analytics Implementation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025NetInsight Analytics Implementation: Cross-Site Request Forgery (CSRF)CVE-2025-52765 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in lisensee NetInsight Analytics Implementation Plugin netinsight-analytics-implementation-plugin allows Stored XSS.This issue affects NetInsight Analytics Implementation Plugin: from n/a through <= 1.0.3.
- Product
- NetInsight Analytics Implementation
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update NetInsight Analytics Implementation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WPBITS Addons For Elementor Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37945 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-addons-for-elementor allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: from n/a through <= 1.5.
- Product
- WPBITS Addons For Elementor Page Builder
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update WPBITS Addons For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Magical Posts Display: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54706 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Posts Display magical-posts-display allows DOM-Based XSS.This issue affects Magical Posts Display: from n/a through <= 1.2.52.
- Product
- Magical Posts Display
- Affected
- up to 1.2.52
- What to do
- Affects up to 1.2.52. Update Magical Posts Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Easy Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54704 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows DOM-Based XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.2.6.
- Product
- Easy Elementor Addons
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update Easy Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Integrate Google Drive: Cross-Site Request Forgery (CSRF)CVE-2025-54703 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in princeahmed Integrate Google Drive integrate-google-drive allows Cross Site Request Forgery.This issue affects Integrate Google Drive: from n/a through <= 1.5.2.
- Product
- Integrate Google Drive
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Ebook Store: Cross-Site Request Forgery (CSRF)CVE-2025-54702 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in motov.net Ebook Store ebook-store allows Cross Site Request Forgery.This issue affects Ebook Store: from n/a through <= 5.8013.
- Product
- Ebook Store
- Affected
- up to 5.8013
- What to do
- Affects up to 5.8013. Update Ebook Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Masteriyo - LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54699 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in masteriyo Masteriyo - LMS learning-management-system allows Stored XSS.This issue affects Masteriyo - LMS: from n/a through <= 1.18.3.
- Product
- Masteriyo - LMS
- Affected
- up to 1.18.3
- What to do
- Affects up to 1.18.3. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WPFunnels: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54696 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through <= 3.5.26.
- Product
- WPFunnels
- Affected
- up to 3.5.26
- What to do
- Affects up to 3.5.26. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Button Block: Cross-Site Request Forgery (CSRF)CVE-2025-54694 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in bPlugins Button Block button-block allows Cross Site Request Forgery.This issue affects Button Block: from n/a through <= 1.2.0.
- Product
- Button Block
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Button Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54688 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.1.2.
- Product
- JetEngine
- Affected
- up to 3.7.1.2
- What to do
- Affects up to 3.7.1.2. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025JetTabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54687 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.9.1.
- Product
- JetTabs
- Affected
- up to 2.2.9.1
- What to do
- Affects up to 2.2.9.1. Update JetTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Integration for Contact Form 7 and Constant Contact: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54684 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks Integration for Contact Form 7 and Constant Contact cf7-constant-contact allows Stored XSS.This issue affects Integration for Contact Form 7 and Constant Contact: from n/a through <= 1.1.7.
- Product
- Integration for Contact Form 7 and Constant Contact
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Integration for Contact Form 7 and Constant Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WP Modal Popup with Cookie Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54683 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify WP Modal Popup with Cookie Integration wp-modal-popup-with-cookie-integration allows Reflected XSS.This issue affects WP Modal Popup with Cookie Integration: from n/a through <= 2.4.
- Product
- WP Modal Popup with Cookie Integration
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update WP Modal Popup with Cookie Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Connector for Gravity Forms and Google Sheets: Cross-Site Request Forgery (CSRF)CVE-2025-54682 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Cross Site Request Forgery.This issue affects Connector for Gravity Forms and Google Sheets: from n/a through <= 1.2.4.
- Product
- Connector for Gravity Forms and Google Sheets
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Connector for Gravity Forms and Google Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Blogger Buzz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54680 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Blogger Buzz blogger-buzz allows Stored XSS.This issue affects Blogger Buzz: from n/a through <= 1.2.6.
- Product
- Blogger Buzz
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Blogger Buzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Online Booking & Scheduling Calendar for WordPress by vcita: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54676 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Stored XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.3.
- Product
- Online Booking & Scheduling Calendar for WordPress by vcita
- Affected
- up to 4.5.3
- What to do
- Affects up to 4.5.3. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025YITH WooCommerce Popup: Cross-Site Request Forgery (CSRF)CVE-2025-54675 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH WooCommerce Popup yith-woocommerce-popup allows Cross Site Request Forgery.This issue affects YITH WooCommerce Popup: from n/a through <= 1.48.0.
- Product
- YITH WooCommerce Popup
- Affected
- up to 1.48.0
- What to do
- Affects up to 1.48.0. Update YITH WooCommerce Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Product Configurator for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-54674 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Configurator for WooCommerce: from n/a through <= 1.4.4.
- Product
- Product Configurator for WooCommerce
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Product Configurator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Chartify: Cross-Site Request Forgery (CSRF)CVE-2025-54673 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Chartify chart-builder allows Cross Site Request Forgery.This issue affects Chartify: from n/a through <= 3.5.3.
- Product
- Chartify
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update Chartify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Photo Engine: Cross-Site Request Forgery (CSRF)CVE-2025-54672 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Jordy Meow Photo Engine wplr-sync allows Cross Site Request Forgery.This issue affects Photo Engine: from n/a through <= 6.4.3.
- Product
- Photo Engine
- Affected
- up to 6.4.3
- What to do
- Affects up to 6.4.3. Update Photo Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025oik: Cross-Site Request Forgery (CSRF)CVE-2025-54671 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide oik oik allows Cross Site Request Forgery.This issue affects oik: from n/a through <= 4.15.2.
- Product
- oik
- Affected
- up to 4.15.2
- What to do
- Affects up to 4.15.2. Update oik to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025myCred: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54668 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred allows Stored XSS.This issue affects myCred: from n/a through <= 2.9.4.3.
- Product
- myCred
- Affected
- up to 2.9.4.3
- What to do
- Affects up to 2.9.4.3. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025CaptionPix: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52788 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson CaptionPix captionpix allows Reflected XSS.This issue affects CaptionPix: from n/a through <= 1.8.
- Product
- CaptionPix
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update CaptionPix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WordPress Event Manager, Event Calendar and Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52730 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themefunction WordPress Event Manager, Event Calendar and Booking Plugin eventin-pro allows Stored XSS.This issue affects WordPress Event Manager, Event Calendar and Booking Plugin: from n/a through <= 4.0.24.
- Product
- WordPress Event Manager, Event Calendar and Booking
- Affected
- up to 4.0.24
- What to do
- Affects up to 4.0.24. Update WordPress Event Manager, Event Calendar and Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025CF7 Spreadsheets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50040 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Stored XSS.This issue affects CF7 Spreadsheets: from n/a through <= 2.3.2.
- Product
- CF7 Spreadsheets
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update CF7 Spreadsheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WP LOL Rotation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49437 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in worstguy WP LOL Rotation league-of-legends-rotation allows Stored XSS.This issue affects WP LOL Rotation: from n/a through <= 1.0.
- Product
- WP LOL Rotation
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP LOL Rotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Supermalink: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49433 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThanhD Supermalink supermalink allows DOM-Based XSS.This issue affects Supermalink: from n/a through <= 1.1.
- Product
- Supermalink
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Supermalink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Visit Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49065 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BestiaDurmiente Visit Counter visit-counter allows Stored XSS.This issue affects Visit Counter: from n/a through <= 1.0.
- Product
- Visit Counter
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Visit Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025User Language Switch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49064 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webilop User Language Switch user-language-switch allows Reflected XSS.This issue affects User Language Switch: from n/a through <= 1.6.10.
- Product
- User Language Switch
- Affected
- up to 1.6.10
- What to do
- Affects up to 1.6.10. Update User Language Switch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025BaiduXZH Submit(百度熊掌号): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49063 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in i3geek BaiduXZH Submit(百度熊掌号) i3geek-baiduxzh allows Reflected XSS.This issue affects BaiduXZH Submit(百度熊掌号): from n/a through <= 1.4.6.
- Product
- BaiduXZH Submit(百度熊掌号)
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update BaiduXZH Submit(百度熊掌号) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WP-jScrollPane: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49062 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cornfeed WP-jScrollPane wp-jscrollpane allows Reflected XSS.This issue affects WP-jScrollPane: from n/a through <= 2.0.3.
- Product
- WP-jScrollPane
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update WP-jScrollPane to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Porn Videos Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49061 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in perteus Porn Videos Embed porn-videos-embed allows Stored XSS.This issue affects Porn Videos Embed: from n/a through <= 0.9.1.
- Product
- Porn Videos Embed
- Affected
- up to 0.9.1
- What to do
- Affects up to 0.9.1. Update Porn Videos Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025SoundSt SEO Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49058 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sound Strategies SoundSt SEO Search soundst-seo-search allows Reflected XSS.This issue affects SoundSt SEO Search: from n/a through <= 1.2.3.
- Product
- SoundSt SEO Search
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update SoundSt SEO Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WP Voting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49057 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ko Min WP Voting wp-voting allows Reflected XSS.This issue affects WP Voting: from n/a through <= 1.8.
- Product
- WP Voting
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update WP Voting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.