Vulnerability database

12,192 results · page 104 of 244

• Apr 17, 2025Restrict Taxonomies: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27289 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Antoine Guillien Restrict Taxonomies restrict-taxonomies allows Reflected XSS.This issue affects Restrict Taxonomies: from n/a through <= 1.3.3.

  Product

  Restrict Taxonomies

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update Restrict Taxonomies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025File Icons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27288 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BjornW File Icons file-icons allows Reflected XSS.This issue affects File Icons: from n/a through <= 2.1.

  Product

  File Icons

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update File Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Easy Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27285 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Easy Form easy-form allows Reflected XSS.This issue affects Easy Form: from n/a through <= 2.6.9.

  Product

  Easy Form

  Affected

  up to 2.6.9

  What to do

  Affects up to 2.6.9. Update Easy Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Flagged Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27284 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in divspark Flagged Content flagged-content allows Reflected XSS.This issue affects Flagged Content: from n/a through <= 1.0.2.

  Product

  Flagged Content

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Flagged Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Essential Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24752 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Reflected XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.0.14.

  Product

  Essential Addons for Elementor

  Affected

  up to 6.0.14

  What to do

  Affects up to 6.0.14. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Classified Listing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24745 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Classified Listing classified-listing allows Reflected XSS.This issue affects Classified Listing: from n/a through <= 4.0.1.

  Product

  Classified Listing

  Affected

  up to 4.0.1

  What to do

  Affects up to 4.0.1. Update Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Term Taxonomy Converter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24670 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dhanendran Rajagopal Term Taxonomy Converter term-taxonomy-converter allows Reflected XSS.This issue affects Term Taxonomy Converter: from n/a through <= 1.2.

  Product

  Term Taxonomy Converter

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Term Taxonomy Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24655 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Wishlist wishlist allows Reflected XSS.This issue affects Wishlist: from n/a through <= 1.0.39.

  Product

  Wishlist

  Affected

  up to 1.0.39

  What to do

  Affects up to 1.0.39. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Eazy Under Construction: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24645 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rob Scott Eazy Under Construction eazy-under-construction allows Reflected XSS.This issue affects Eazy Under Construction: from n/a through <= 1.0.

  Product

  Eazy Under Construction

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Eazy Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Empty Tags Remover: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24640 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan-Lucian Stefancu Empty Tags Remover empty-tags-remover allows Reflected XSS.This issue affects Empty Tags Remover: from n/a through <= 1.0.

  Product

  Empty Tags Remover

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Empty Tags Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Beacon Lead Magnets and Lead Capture: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24637 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Beacon Lead Magnets and Lead Capture beacon-by allows Reflected XSS.This issue affects Beacon Lead Magnets and Lead Capture: from n/a through <= 1.5.7.

  Product

  Beacon Lead Magnets and Lead Capture

  Affected

  up to 1.5.7

  What to do

  Affects up to 1.5.7. Update Beacon Lead Magnets and Lead Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025HT Event: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24624 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems HT Event ht-event allows Reflected XSS.This issue affects HT Event: from n/a through <= 1.4.6.

  Product

  HT Event

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update HT Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Arconix Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24621 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Reflected XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.15.

  Product

  Arconix Shortcodes

  Affected

  up to 2.1.15

  What to do

  Affects up to 2.1.15. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP Log Action: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24619 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webheadcoder WP Log Action wp-log-action allows Reflected XSS.This issue affects WP Log Action: from n/a through <= 0.51.

  Product

  WP Log Action

  Affected

  up to 0.51

  What to do

  Affects up to 0.51. Update WP Log Action to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Shipment Tracker for Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24586 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bitsstech Shipment Tracker for Woocommerce shipment-tracker-for-woocommerce allows Reflected XSS.This issue affects Shipment Tracker for Woocommerce: from n/a through <= 1.4.23.

  Product

  Shipment Tracker for Woocommerce

  Affected

  up to 1.4.23

  What to do

  Affects up to 1.4.23. Update Shipment Tracker for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Shipping with Venipak for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24553 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Akadrama Shipping with Venipak for WooCommerce wc-venipak-shipping allows Reflected XSS.This issue affects Shipping with Venipak for WooCommerce: from n/a through <= 1.22.3.

  Product

  Shipping with Venipak for WooCommerce

  Affected

  up to 1.22.3

  What to do

  Affects up to 1.22.3. Update Shipping with Venipak for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Job Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24550 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JobScore Job Manager job-manager-by-jobscore allows Stored XSS.This issue affects Job Manager: from n/a through <= 2.2.

  Product

  Job Manager

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Autoglot – Automatic WordPress Translation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24548 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Autoglot Autoglot – Automatic WordPress Translation autoglot allows Reflected XSS.This issue affects Autoglot – Automatic WordPress Translation: from n/a through <= 2.4.7.

  Product

  Autoglot – Automatic WordPress Translation

  Affected

  up to 2.4.7

  What to do

  Affects up to 2.4.7. Update Autoglot – Automatic WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025DeBounce Email Validator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24539 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in debounce DeBounce Email Validator debounce-io-email-validator allows Reflected XSS.This issue affects DeBounce Email Validator: from n/a through <= 5.6.5.

  Product

  DeBounce Email Validator

  Affected

  up to 5.6.5

  What to do

  Affects up to 5.6.5. Update DeBounce Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Custom Users Order: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23858 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hiren Patel Custom Users Order custom-users-order allows Reflected XSS.This issue affects Custom Users Order: from n/a through <= 4.2.

  Product

  Custom Users Order

  Affected

  up to 4.2

  What to do

  Affects up to 4.2. Update Custom Users Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025SpiderDisplay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23855 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fyljp SpiderDisplay spiderdisplay allows Reflected XSS.This issue affects SpiderDisplay: from n/a through <= 1.9.1.

  Product

  SpiderDisplay

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update SpiderDisplay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025TotalContest Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23782 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TotalSuite TotalContest Lite totalcontest-lite allows Reflected XSS.This issue affects TotalContest Lite: from n/a through <= 2.8.1.

  Product

  TotalContest Lite

  Affected

  up to 2.8.1

  What to do

  Affects up to 2.8.1. Update TotalContest Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025visualslider Sldier: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23448 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dastan800 visualslider Sldier visual-slider allows Reflected XSS.This issue affects visualslider Sldier: from n/a through <= 1.1.1.

  Product

  visualslider Sldier

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update visualslider Sldier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Author Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23443 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Claire Ryan Author Showcase author-showcase allows Reflected XSS.This issue affects Author Showcase: from n/a through <= 1.4.3.

  Product

  Author Showcase

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update Author Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP-Asambleas: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22796 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in platcom WP-Asambleas wp-asambleas allows Reflected XSS.This issue affects WP-Asambleas: from n/a through <= 2.85.0.

  Product

  WP-Asambleas

  Affected

  up to 2.85.0

  What to do

  Affects up to 2.85.0. Update WP-Asambleas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025CRUDLab Scroll to Top: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22774 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRUDLab CRUDLab Scroll to Top crudlab-scroll-to-top allows Reflected XSS.This issue affects CRUDLab Scroll to Top: from n/a through <= 1.0.1.

  Product

  CRUDLab Scroll to Top

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update CRUDLab Scroll to Top to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025The Great Firewords of China: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22771 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Studio Hyperset The Great Firewords of China sensitive-chinese-words-scanner allows Stored XSS.This issue affects The Great Firewords of China: from n/a through <= 1.2.

  Product

  The Great Firewords of China

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update The Great Firewords of China to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Sponsered Link: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22692 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rachanaS Sponsered Link sponsered-link allows Reflected XSS.This issue affects Sponsered Link: from n/a through <= 4.0.

  Product

  Sponsered Link

  Affected

  up to 4.0

  What to do

  Affects up to 4.0. Update Sponsered Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Stylish Google Sheet Reader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22651 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wppluginboxdev Stylish Google Sheet Reader stylish-google-sheet-reader allows Reflected XSS.This issue affects Stylish Google Sheet Reader: from n/a through <= 4.0.

  Product

  Stylish Google Sheet Reader

  Affected

  up to 4.0

  What to do

  Affects up to 4.0. Update Stylish Google Sheet Reader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025VR-Frases: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22636 · WordPress plugins & themes · reported by PatchstackHigh 8.2

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vicente Ruiz Gálvez VR-Frases vr-frases allows Reflected XSS.This issue affects VR-Frases: from n/a through <= 4.0.1.

  Product

  VR-Frases

  Affected

  up to 4.0.1

  What to do

  Affects up to 4.0.1. Update VR-Frases to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025vooPlayer v4: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22565 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bill Zimmerman vooPlayer v4 vooplayer allows Reflected XSS.This issue affects vooPlayer v4: from n/a through <= 4.0.4.

  Product

  vooPlayer v4

  Affected

  up to 4.0.4

  What to do

  Affects up to 4.0.4. Update vooPlayer v4 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Data Dash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22340 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Data Dash data-dash allows Stored XSS.This issue affects Data Dash: from n/a through <= 1.2.3.

  Product

  Data Dash

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Data Dash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2025-3487 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ parameter in all versions up to, and including, 1.42.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Forminator Forms – Contact Form, Payment Form & Custom Form Builder

  Affected

  up to 1.42.0

  What to do

  Affects up to 1.42.0. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 17, 2025Fluent Forms: Stored Cross-Site ScriptingCVE-2025-3615 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form-submission.js script in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Fluent Forms

  Affected

  up to 6.0.2

  What to do

  Affects up to 6.0.2. Update Fluent Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 16, 2025WP Subscription Forms: Missing AuthorizationCVE-2025-39591 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in WP Shuffle WP Subscription Forms wp-subscription-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Subscription Forms: from n/a through <= 1.2.3.

  Product

  WP Subscription Forms

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update WP Subscription Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025Essential Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39590 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.1.9.

  Product

  Essential Addons for Elementor

  Affected

  up to 6.1.9

  What to do

  Affects up to 6.1.9. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025Travelfic Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39585 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Travelfic Toolkit travelfic-toolkit allows Stored XSS.This issue affects Travelfic Toolkit: from n/a through <= 1.2.1.

  Product

  Travelfic Toolkit

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Travelfic Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025WP Data Access: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39582 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows DOM-Based XSS.This issue affects WP Data Access: from n/a through <= 5.5.36.

  Product

  WP Data Access

  Affected

  up to 5.5.36

  What to do

  Affects up to 5.5.36. Update WP Data Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025Themify Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39581 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Shortcodes themify-shortcodes allows Stored XSS.This issue affects Themify Shortcodes: from n/a through <= 2.1.3.

  Product

  Themify Shortcodes

  Affected

  up to 2.1.3

  What to do

  Affects up to 2.1.3. Update Themify Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025Membership For WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39579 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows DOM-Based XSS.This issue affects Membership For WooCommerce: from n/a through <= 2.8.0.

  Product

  Membership For WooCommerce

  Affected

  up to 2.8.0

  What to do

  Affects up to 2.8.0. Update Membership For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025Responsive Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39578 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Stored XSS.This issue affects Responsive Blocks: from n/a through <= 2.0.2.

  Product

  Responsive Blocks

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update Responsive Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025PropertyHive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39577 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Stored XSS.This issue affects PropertyHive: from n/a through <= 2.1.2.

  Product

  PropertyHive

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025WPAdverts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39576 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Stored XSS.This issue affects WPAdverts: from n/a through <= 2.2.1.

  Product

  WPAdverts

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update WPAdverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025WPCasa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39575 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPSight WPCasa wpcasa allows Stored XSS.This issue affects WPCasa: from n/a through <= 1.3.2.

  Product

  WPCasa

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update WPCasa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025Uix Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39574 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UIUX Lab Uix Shortcodes uix-shortcodes allows Stored XSS.This issue affects Uix Shortcodes: from n/a through <= 2.0.4.

  Product

  Uix Shortcodes

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update Uix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025WP Posts Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39573 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Stored XSS.This issue affects WP Posts Carousel: from n/a through <= 1.3.10.

  Product

  WP Posts Carousel

  Affected

  up to 1.3.10

  What to do

  Affects up to 1.3.10. Update WP Posts Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025Checkout for PayPal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39572 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Checkout for PayPal checkout-for-paypal allows Stored XSS.This issue affects Checkout for PayPal: from n/a through <= 1.0.38.

  Product

  Checkout for PayPal

  Affected

  up to 1.0.38

  What to do

  Affects up to 1.0.38. Update Checkout for PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025Church Admin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39555 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin allows Stored XSS.This issue affects Church Admin: from n/a through <= 5.0.23.

  Product

  Church Admin

  Affected

  up to 5.0.23

  What to do

  Affects up to 5.0.23. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025Most And Least Read Posts Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39549 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in whiletrue Most And Least Read Posts Widget most-and-least-read-posts-widget allows Stored XSS.This issue affects Most And Least Read Posts Widget: from n/a through <= 2.5.20.

  Product

  Most And Least Read Posts Widget

  Affected

  up to 2.5.20

  What to do

  Affects up to 2.5.20. Update Most And Least Read Posts Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39543 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through <= 1.3.977.

  Product

  Royal Elementor Addons

  Affected

  up to 1.3.977

  What to do

  Affects up to 1.3.977. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.