Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

354new WordPress flaws this week

393,576entries in the database

15,418 results · page 103 of 309

Aug 14, 2025WP Voting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49057 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ko Min WP Voting wp-voting allows Reflected XSS.This issue affects WP Voting: from n/a through <= 1.8.
Product
WP Voting
Affected
up to 1.8
What to do
Affects up to 1.8. Update WP Voting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025多说社会化评论框: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49056 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shen2 多说社会化评论框 duoshuo allows Reflected XSS.This issue affects 多说社会化评论框: from n/a through <= 1.2.
Product
多说社会化评论框
Affected
up to 1.2
What to do
Affects up to 1.2. Update 多说社会化评论框 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Time Sheets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49054 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mrdenny Time Sheets time-sheets allows Reflected XSS.This issue affects Time Sheets: from n/a through <= 2.1.3.
Product
Time Sheets
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Time Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025WP Airdrop Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49053 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kadesthemes WP Airdrop Manager airdrop allows Stored XSS.This issue affects WP Airdrop Manager: from n/a through <= 1.0.5.
Product
WP Airdrop Manager
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update WP Airdrop Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Hide Text Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49051 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in biscia7 Hide Text Shortcode hide-text-shortcode allows Stored XSS.This issue affects Hide Text Shortcode: from n/a through <= 1.1.
Product
Hide Text Shortcode
Affected
up to 1.1
What to do
Affects up to 1.1. Update Hide Text Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Inspectlet – User Session Recording and Heatmaps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49048 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in inspectlet Inspectlet – User Session Recording and Heatmaps inspectlet-heatmaps-and-user-session-recording allows Stored XSS.This issue affects Inspectlet – User Session Recording and Heatmaps: from n/a through <= 2.0.
Product
Inspectlet – User Session Recording and Heatmaps
Affected
up to 2.0
What to do
Affects up to 2.0. Update Inspectlet – User Session Recording and Heatmaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025DigitalOcean Spaces Sync: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49047 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in keeross DigitalOcean Spaces Sync do-spaces-sync allows Stored XSS.This issue affects DigitalOcean Spaces Sync: from n/a through <= 2.2.1.
Product
DigitalOcean Spaces Sync
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update DigitalOcean Spaces Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025WP Dynamic Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49038 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Dynamic Links wp-dynamic-links allows Reflected XSS.This issue affects WP Dynamic Links: from n/a through <= 1.0.1.
Product
WP Dynamic Links
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Dynamic Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Authentication and xmlrpc log writer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49037 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Federico Rota Authentication and xmlrpc log writer authentication-and-xmlrpc-log-writer allows Reflected XSS.This issue affects Authentication and xmlrpc log writer: from n/a through <= 1.2.2.
Product
Authentication and xmlrpc log writer
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Authentication and xmlrpc log writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Video Blogster Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47689 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in johnh10 Video Blogster Lite video-blogster-lite allows Reflected XSS.This issue affects Video Blogster Lite: from n/a through <= 1.2.
Product
Video Blogster Lite
Affected
up to 1.2
What to do
Affects up to 1.2. Update Video Blogster Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025WooCommerce Fortnox Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wetail WooCommerce Fortnox Integration woocommerce-fortnox-integration allows Stored XSS.This issue affects WooCommerce Fortnox Integration: from n/a through <= 4.5.6.
Product
WooCommerce Fortnox Integration
Affected
up to 4.5.6
What to do
Affects up to 4.5.6. Update WooCommerce Fortnox Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Billplz Addon for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31007 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alvind Billplz Addon for Contact Form 7 billplz-for-contact-form-7 allows Reflected XSS.This issue affects Billplz Addon for Contact Form 7: from n/a through <= 1.2.0.
Product
Billplz Addon for Contact Form 7
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Billplz Addon for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Multimedia Playlist Slider Addon for WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30626 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Multimedia Playlist Slider Addon for WPBakery Page Builder lbg_vp_youtube_vimeo_addon_visual_composer allows Reflected XSS.This issue affects Multimedia Playlist Slider Addon for WPBakery Page Builder: from n/a through <= 2.1.
Product
Multimedia Playlist Slider Addon for WPBakery Page Builder
Affected
up to 2.1
What to do
Affects up to 2.1. Update Multimedia Playlist Slider Addon for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025FoodMenu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-29014 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomIt FoodMenu allows Reflected XSS. This issue affects FoodMenu: from n/a through 1.20.
Product
FoodMenu
Affected
up to 1.20
What to do
Affects up to 1.20. Update FoodMenu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025WooCommerce Shop Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28999 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomIt WooCommerce Shop Page Builder allows Reflected XSS. This issue affects WooCommerce Shop Page Builder: from n/a through 2.27.7.
Product
WooCommerce Shop Page Builder
Affected
up to 2.27.7
What to do
Affects up to 2.27.7. Update WooCommerce Shop Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Alike - WordPress Custom Post Comparison: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28975 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redqteam Alike - WordPress Custom Post Comparison alike allows Reflected XSS.This issue affects Alike - WordPress Custom Post Comparison: from n/a through <= 3.0.1.
Product
Alike - WordPress Custom Post Comparison
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Alike - WordPress Custom Post Comparison to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Injection Guard: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-8046 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Injection Guard WordPress plugin before 1.2.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
Injection Guard
Fixed in
1.2.8
What to do
Update Injection Guard to 1.2.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 14, 2025WP Shopify: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-7808 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Shopify WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WP Shopify
Fixed in
1.5.4
What to do
Update WP Shopify to 1.5.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 14, 2025Structured Content (JSON-LD) #wpsc: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-3414 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Structured Content (JSON-LD) #wpsc WordPress plugin before 1.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Structured Content (JSON-LD) #wpsc
Fixed in
1.7.0
What to do
Update Structured Content (JSON-LD) #wpsc to 1.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 12, 2025Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Stored Cross-Site ScriptingCVE-2025-8874 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.0.8.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations
Affected
up to 2.0.8.6
What to do
Affects up to 2.0.8.6. Update Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 12, 2025Software Issue Manager: Stored Cross-Site ScriptingCVE-2025-8314 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Software Issue Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg parameter in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Software Issue Manager
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update Software Issue Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 11, 2025Simple Responsive Slider: Stored Cross-Site ScriptingCVE-2025-8690 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Responsive Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Responsive Slider
Affected
up to 2.0
What to do
Affects up to 2.0. Update Simple Responsive Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Aug 11, 2025Inline Stock Quotes: Stored Cross-Site ScriptingCVE-2025-8688 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Inline Stock Quotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Inline Stock Quotes
Affected
up to 0.2
What to do
Affects up to 0.2. Update Inline Stock Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Aug 11, 2025Wp chart generator: Stored Cross-Site ScriptingCVE-2025-8685 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Wp chart generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpchart shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Wp chart generator
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Wp chart generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Aug 11, 2025Mosaic Generator: Stored Cross-Site ScriptingCVE-2025-8621 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mosaic Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘c’ parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mosaic Generator
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Mosaic Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 11, 2025GMap Generator: Stored Cross-Site ScriptingCVE-2025-8568 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GMap Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘h’ parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GMap Generator
Affected
up to 1.1
What to do
Affects up to 1.1. Update GMap Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Aug 11, 2025RT Easy Builder – Advanced addons for Elementor: Stored Cross-Site ScriptingCVE-2025-8462 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the social URL parameter in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
RT Easy Builder – Advanced addons for Elementor
Affected
up to 2.3
What to do
Affects up to 2.3. Update RT Easy Builder – Advanced addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 9, 2025The7: Stored Cross-Site ScriptingCVE-2025-7726 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via its lightbox rendering code in all versions up to, and including, 12.6.0 due to insufficient input sanitization and output escaping. The theme’s JavaScript reads user-supplied 'title' and 'data-dt-img-description' attributes directly via jQuery.attr(), concatenates them into an HTML string, and inserts that string into the DOM using methods such as jQuery.html() without escaping or filtering. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The7
Affected
up to 12.6.0
What to do
Affects up to 12.6.0. Update The7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record the7.io themeforest.net
Aug 8, 2025Eventin: Privilege escalationCVE-2025-4796 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. This is due to the plugin not properly validating a user's identity or capability prior to updating their details like email in the 'Eventin\Speaker\Api\SpeakerController::update_item' function. This makes it possible for unauthenticated attackers with contributor-level and above permissions to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Product
Eventin
Affected
up to 4.0.34
What to do
Affects up to 4.0.34. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 8, 2025OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-6572 · WordPress plugins & themes · reported by WPScanMedium 5.9
The OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer)
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 6, 2025Gutenverse: Stored Cross-Site ScriptingCVE-2025-7727 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutenverse plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Fun Fact blocks in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gutenverse
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Gutenverse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 6, 2025Element Pack Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2025-8100 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content' parameter in versions up to, and including, 8.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Element Pack Elementor Addons and Templates
Affected
up to 8.1.5
What to do
Affects up to 8.1.5. Update Element Pack Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 6, 2025Exclusive Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-7498 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget in all versions up to, and including, 2.7.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Exclusive Addons for Elementor
Affected
up to 2.7.9.4
What to do
Affects up to 2.7.9.4. Update Exclusive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 6, 2025Betheme: Stored Cross-Site ScriptingCVE-2025-7399 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via an Elementor display setting in all versions up to, and including, 28.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Betheme
Affected
up to 28.1.3
What to do
Affects up to 28.1.3. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 6, 2025Reveal Listing plugin by smartdatasoft: Privilege escalationCVE-2025-6994 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Reveal Listing plugin by smartdatasoft for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.3. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'listing_user_role' field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
Product
Reveal Listing plugin by smartdatasoft
Affected
up to 3.3
What to do
Affects up to 3.3. Update Reveal Listing plugin by smartdatasoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 5, 2025WPBakery Page Builder for: Stored Cross-Site ScriptingCVE-2025-7502 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several shortcodes in all versions up to, and including, 8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPBakery Page Builder for
Affected
up to 8.5
What to do
Affects up to 8.5. Update WPBakery Page Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record kb.wpbakery.com wordfence.com
Aug 5, 2025WP Tournament Registration: Stored Cross-Site ScriptingCVE-2025-6690 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Tournament Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘field’ parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Tournament Registration
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update WP Tournament Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 5, 2025esri-map-view: Stored Cross-Site ScriptingCVE-2025-6259 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The esri-map-view plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's esri-map-view shortcode in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
esri-map-view
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update esri-map-view to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 5, 2025Flex Guten: Stored Cross-Site ScriptingCVE-2025-6256 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Flex Guten
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Flex Guten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025Employee Directory: Stored Cross-Site ScriptingCVE-2025-8295 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Employee Directory
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update Employee Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025Download Counter: Stored Cross-Site ScriptingCVE-2025-8294 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Download Counter
Affected
up to 1.3
What to do
Affects up to 1.3. Update Download Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 5, 2025WP Easy Contact: Stored Cross-Site ScriptingCVE-2025-8315 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Easy Contact
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WP Easy Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025Campus Directory: Stored Cross-Site ScriptingCVE-2025-8313 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Campus Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Campus Directory
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Campus Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025Use-your-Drive | Google Drive plugin for: Stored Cross-Site ScriptingCVE-2025-7050 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Use-your-Drive | Google Drive plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in file metadata in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability can be exploited by the lowest authentication level permitted to upload files, including unauthenticated users, once a file upload shortcode is published on a publicly accessible post.
Product
Use-your-Drive | Google Drive plugin for
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Use-your-Drive | Google Drive plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpcloudplugins.gitbook.io wordfence.com
Aug 2, 2025Ocean Social Sharing: Stored Cross-Site ScriptingCVE-2025-7500 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ocean Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via social icon titles in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ocean Social Sharing
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Ocean Social Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 2, 2025Image Gallery: Reflected Cross-Site ScriptingCVE-2025-8400 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image Gallery
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Aug 2, 2025Mmm Unity Loader: Stored Cross-Site ScriptingCVE-2025-8399 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mmm Unity Loader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributes’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mmm Unity Loader
Affected
up to 1.0
What to do
Affects up to 1.0. Update Mmm Unity Loader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Aug 2, 2025Magic Edge – Lite: Stored Cross-Site ScriptingCVE-2025-8391 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Magic Edge – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Magic Edge – Lite
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Magic Edge – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Aug 2, 2025All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier: Reflected Cross-Site ScriptingCVE-2025-6832 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier
Affected
up to 2.0
What to do
Affects up to 2.0. Update All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 2, 2025Custom Word Cloud: Stored Cross-Site ScriptingCVE-2025-8317 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Custom Word Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘angle’ parameter in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Custom Word Cloud
Affected
up to 0.3
What to do
Affects up to 0.3. Update Custom Word Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.