Vulnerability database

15,908 results · page 106 of 319

• Jun 27, 2025Beauty Contact Popup Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53325 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dilip kumar Beauty Contact Popup Form beauty-contact-popup-form allows Stored XSS.This issue affects Beauty Contact Popup Form: from n/a through <= 6.0.

  Product

  Beauty Contact Popup Form

  Affected

  up to 6.0

  What to do

  Affects up to 6.0. Update Beauty Contact Popup Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Raise The Money: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53321 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raise The Money Raise The Money raise-the-money allows DOM-Based XSS.This issue affects Raise The Money: from n/a through <= 5.2.

  Product

  Raise The Money

  Affected

  up to 5.2

  What to do

  Affects up to 5.2. Update Raise The Money to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Free Downloads EDD: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53320 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wp Enhanced Free Downloads EDD allows DOM-Based XSS. This issue affects Free Downloads EDD: from n/a through 1.0.4.

  Product

  Free Downloads EDD

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Free Downloads EDD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WPShapere - WordPress admin: Cross-Site Request Forgery (CSRF)CVE-2025-53317 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in AcmeeDesign WPShapere - WordPress admin theme wpshapere-lite allows Stored XSS.This issue affects WPShapere - WordPress admin theme: from n/a through <= 1.4.1.

  Product

  WPShapere - WordPress admin

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update WPShapere - WordPress admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Relocate Upload: Cross-Site Request Forgery (CSRF)CVE-2025-53315 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in alanft Relocate Upload relocate-upload allows Stored XSS.This issue affects Relocate Upload: from n/a through <= 0.24.1.

  Product

  Relocate Upload

  Affected

  up to 0.24.1

  What to do

  Affects up to 0.24.1. Update Relocate Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WP Optimizer: Cross-Site Request Forgery (CSRF)CVE-2025-53314 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in sh1zen WP Optimizer wp-optimizer allows SQL Injection.This issue affects WP Optimizer: from n/a through <= 2.5.0.

  Product

  WP Optimizer

  Affected

  up to 2.5.0

  What to do

  Affects up to 2.5.0. Update WP Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Twitch TV Embed Suite: Cross-Site Request Forgery (CSRF)CVE-2025-53313 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in plumwd Twitch TV Embed Suite twitch-tv-embed-suite allows Stored XSS.This issue affects Twitch TV Embed Suite: from n/a through <= 2.1.0.

  Product

  Twitch TV Embed Suite

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Twitch TV Embed Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025OnionBuzz: Cross-Site Request Forgery (CSRF)CVE-2025-53312 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Looks Awesome OnionBuzz onionbuzz-viral-quiz allows Stored XSS.This issue affects OnionBuzz: from n/a through <= 1.0.7.

  Product

  OnionBuzz

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update OnionBuzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Navayan Subscribe: Cross-Site Request Forgery (CSRF)CVE-2025-53311 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Amol Nirmala Waman Navayan Subscribe navayan-subscribe allows Stored XSS.This issue affects Navayan Subscribe: from n/a through <= 1.13.

  Product

  Navayan Subscribe

  Affected

  up to 1.13

  What to do

  Affects up to 1.13. Update Navayan Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025HidePost: Cross-Site Request Forgery (CSRF)CVE-2025-53310 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Funnnny HidePost hidepost allows Reflected XSS.This issue affects HidePost: from n/a through <= 2.3.8.

  Product

  HidePost

  Affected

  up to 2.3.8

  What to do

  Affects up to 2.3.8. Update HidePost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Image Slider With Description: Cross-Site Request Forgery (CSRF)CVE-2025-53308 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in gopi_plus Image Slider With Description image-slider-with-description allows Stored XSS.This issue affects Image Slider With Description: from n/a through <= 9.2.

  Product

  Image Slider With Description

  Affected

  up to 9.2

  What to do

  Affects up to 9.2. Update Image Slider With Description to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WP Forum Server: Cross-Site Request Forgery (CSRF)CVE-2025-53305 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in lucidcrew WP Forum Server forum-server allows Stored XSS.This issue affects WP Forum Server: from n/a through <= 1.8.2.

  Product

  WP Forum Server

  Affected

  up to 1.8.2

  What to do

  Affects up to 1.8.2. Update WP Forum Server to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Theme Junkie Team Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53301 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Junkie Theme Junkie Team Content theme-junkie-team-content allows DOM-Based XSS.This issue affects Theme Junkie Team Content: from n/a through <= 0.1.1.

  Product

  Theme Junkie Team Content

  Affected

  up to 0.1.1

  What to do

  Affects up to 0.1.1. Update Theme Junkie Team Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Podcast Feed Player Widget and Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53300 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in douglaskarr Podcast Feed Player Widget and Shortcode podcast-feed-player-widget allows Stored XSS.This issue affects Podcast Feed Player Widget and Shortcode: from n/a through <= 2.2.0.

  Product

  Podcast Feed Player Widget and Shortcode

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update Podcast Feed Player Widget and Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025EC Stars Rating: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53296 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ecoal95 EC Stars Rating ec-stars-rating allows Stored XSS.This issue affects EC Stars Rating: from n/a through <= 1.0.11.

  Product

  EC Stars Rating

  Affected

  up to 1.0.11

  What to do

  Affects up to 1.0.11. Update EC Stars Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Smart Agenda: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53294 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smart Agenda Smart Agenda smart-agenda-prise-de-rendez-vous-en-ligne allows Stored XSS.This issue affects Smart Agenda: from n/a through <= 4.9.

  Product

  Smart Agenda

  Affected

  up to 4.9

  What to do

  Affects up to 4.9. Update Smart Agenda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WP DataTable: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53292 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in samsk WP DataTable wp-datatable allows DOM-Based XSS.This issue affects WP DataTable: from n/a through <= 0.2.7.

  Product

  WP DataTable

  Affected

  up to 0.2.7

  What to do

  Affects up to 0.2.7. Update WP DataTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WP Visual Sitemap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53290 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MS WP Visual Sitemap wp-visual-sitemap allows Stored XSS.This issue affects WP Visual Sitemap: from n/a through <= 1.0.2.

  Product

  WP Visual Sitemap

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update WP Visual Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Quick Favicon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53287 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Cummings Quick Favicon quick-favicon allows Stored XSS.This issue affects Quick Favicon: from n/a through <= 0.22.8.

  Product

  Quick Favicon

  Affected

  up to 0.22.8

  What to do

  Affects up to 0.22.8. Update Quick Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Add & Replace Affiliate Links for Amazon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53285 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Website Flip Add & Replace Affiliate Links for Amazon add-replace-affiliate-links-for-amazon allows Stored XSS.This issue affects Add & Replace Affiliate Links for Amazon: from n/a through <= 1.0.6.

  Product

  Add & Replace Affiliate Links for Amazon

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Add & Replace Affiliate Links for Amazon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Thumbnail Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53282 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Thumbnail Editor thumbnail-editor allows Stored XSS.This issue affects Thumbnail Editor: from n/a through <= 2.3.3.

  Product

  Thumbnail Editor

  Affected

  up to 2.3.3

  What to do

  Affects up to 2.3.3. Update Thumbnail Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Football Pool: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53280 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.This issue affects Football Pool: from n/a through <= 2.12.5.

  Product

  Football Pool

  Affected

  up to 2.12.5

  What to do

  Affects up to 2.12.5. Update Football Pool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Popup addon for Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53279 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Popup addon for Ninja Forms popup-addon-for-ninja-forms allows DOM-Based XSS.This issue affects Popup addon for Ninja Forms: from n/a through <= 3.4.

  Product

  Popup addon for Ninja Forms

  Affected

  up to 3.4

  What to do

  Affects up to 3.4. Update Popup addon for Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WP AdCenter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53278 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPeka WP AdCenter wpadcenter allows Stored XSS.This issue affects WP AdCenter: from n/a through <= 2.6.0.

  Product

  WP AdCenter

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update WP AdCenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025IS-theme-companion: Cross-Site Request Forgery (CSRF)CVE-2025-53277 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in Infigo Software IS-theme-companion weblizar-companion allows Object Injection.This issue affects IS-theme-companion: from n/a through <= 1.59.

  Product

  IS-theme-companion

  Affected

  up to 1.59

  What to do

  Affects up to 1.59. Update IS-theme-companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Omnipress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53276 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows DOM-Based XSS.This issue affects Omnipress: from n/a through <= 1.6.4.

  Product

  Omnipress

  Affected

  up to 1.6.4

  What to do

  Affects up to 1.6.4. Update Omnipress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Leyka: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53275 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka leyka allows DOM-Based XSS.This issue affects Leyka: from n/a through <= 3.32.1.

  Product

  Leyka

  Affected

  up to 3.32.1

  What to do

  Affects up to 3.32.1. Update Leyka to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WP Permalink Translator: Cross-Site Request Forgery (CSRF)CVE-2025-53274 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Hossin Asaadi WP Permalink Translator wp-permalink-translator allows Stored XSS.This issue affects WP Permalink Translator: from n/a through <= 1.7.6.

  Product

  WP Permalink Translator

  Affected

  up to 1.7.6

  What to do

  Affects up to 1.7.6. Update WP Permalink Translator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Slickstream: Cross-Site Request Forgery (CSRF)CVE-2025-53273 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Slickstream Slickstream slick-engagement allows Cross Site Request Forgery.This issue affects Slickstream: from n/a through <= 2.0.3.

  Product

  Slickstream

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update Slickstream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Image Cleanup: Cross-Site Request Forgery (CSRF)CVE-2025-53272 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in opicron Image Cleanup image-cleanup allows Cross Site Request Forgery.This issue affects Image Cleanup: from n/a through <= 1.9.2.

  Product

  Image Cleanup

  Affected

  up to 1.9.2

  What to do

  Affects up to 1.9.2. Update Image Cleanup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Additional Order Filters for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-53271 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Anton Bond Additional Order Filters for WooCommerce additional-order-filters-for-woocommerce allows Stored XSS.This issue affects Additional Order Filters for WooCommerce: from n/a through <= 1.22.

  Product

  Additional Order Filters for WooCommerce

  Affected

  up to 1.22

  What to do

  Affects up to 1.22. Update Additional Order Filters for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WordPress CTA: Cross-Site Request Forgery (CSRF)CVE-2025-53270 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Cross Site Request Forgery.This issue affects WordPress CTA: from n/a through <= 1.7.0.

  Product

  WordPress CTA

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update WordPress CTA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025My Wp Brand: Cross-Site Request Forgery (CSRF)CVE-2025-53269 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in imw3 My Wp Brand my-wp-brand allows Cross Site Request Forgery.This issue affects My Wp Brand: from n/a through <= 1.1.3.

  Product

  My Wp Brand

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update My Wp Brand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Import external attachments: Cross-Site Request Forgery (CSRF)CVE-2025-53268 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Cross Site Request Forgery.This issue affects Import external attachments: from n/a through <= 1.5.12.

  Product

  Import external attachments

  Affected

  up to 1.5.12

  What to do

  Affects up to 1.5.12. Update Import external attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Hide Admin Bar From Front End: Cross-Site Request Forgery (CSRF)CVE-2025-53267 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Aftab Husain Hide Admin Bar From Front End hide-admin-bar-from-front-end allows Cross Site Request Forgery.This issue affects Hide Admin Bar From Front End: from n/a through <= 1.0.0.

  Product

  Hide Admin Bar From Front End

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Hide Admin Bar From Front End to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Virusdie: Cross-Site Request Forgery (CSRF)CVE-2025-53265 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Virusdie Virusdie virusdie allows Cross Site Request Forgery.This issue affects Virusdie: from n/a through <= 1.1.3.

  Product

  Virusdie

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Virusdie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025ONet Regenerate Thumbnails: Cross-Site Request Forgery (CSRF)CVE-2025-53264 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Konrád Koller ONet Regenerate Thumbnails onet-regenerate-thumbnails allows Cross Site Request Forgery.This issue affects ONet Regenerate Thumbnails: from n/a through <= 1.5.

  Product

  ONet Regenerate Thumbnails

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update ONet Regenerate Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Address Autocomplete via Google for Gravity Forms: Cross-Site Request Forgery (CSRF)CVE-2025-53263 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in PluginsCafe Address Autocomplete via Google for Gravity Forms gf-google-address-autocomplete allows Cross Site Request Forgery.This issue affects Address Autocomplete via Google for Gravity Forms: from n/a through <= 1.3.4.

  Product

  Address Autocomplete via Google for Gravity Forms

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update Address Autocomplete via Google for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Writesonic: Cross-Site Request Forgery (CSRF)CVE-2025-53262 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Writesonic Writesonic writesonic allows Cross Site Request Forgery.This issue affects Writesonic: from n/a through <= 1.0.5.

  Product

  Writesonic

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Writesonic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WP YouTube Live: Cross-Site Request Forgery (CSRF)CVE-2025-53261 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in macbookandrew WP YouTube Live wp-youtube-live allows Cross Site Request Forgery.This issue affects WP YouTube Live: from n/a through <= 1.10.0.

  Product

  WP YouTube Live

  Affected

  up to 1.10.0

  What to do

  Affects up to 1.10.0. Update WP YouTube Live to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Cyrlitera: Cross-Site Request Forgery (CSRF)CVE-2025-53254 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Cyrlitera cyrlitera allows Cross Site Request Forgery.This issue affects Cyrlitera: from n/a through <= 1.3.0.

  Product

  Cyrlitera

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Cyrlitera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WP Edit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53253 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh WP Edit wp-edit allows Stored XSS.This issue affects WP Edit: from n/a through <= 4.0.4.

  Product

  WP Edit

  Affected

  up to 4.0.4

  What to do

  Affects up to 4.0.4. Update WP Edit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025HT Mega – Absolute Addons for WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53206 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Mega – Absolute Addons for WPBakery Page Builder ht-mega-for-wpbakery allows Stored XSS.This issue affects HT Mega – Absolute Addons for WPBakery Page Builder: from n/a through <= 1.0.8.

  Product

  HT Mega – Absolute Addons for WPBakery Page Builder

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update HT Mega – Absolute Addons for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WooCommerce PDF Invoice Builder: Cross-Site Request Forgery (CSRF)CVE-2025-53203 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Cross Site Request Forgery.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 1.2.148.

  Product

  WooCommerce PDF Invoice Builder

  Affected

  up to 1.2.148

  What to do

  Affects up to 1.2.148. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Responsive Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53202 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows DOM-Based XSS.This issue affects Responsive Blocks: from n/a through <= 2.0.6.

  Product

  Responsive Blocks

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update Responsive Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025HT Slider For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53199 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Slider For Elementor ht-slider-for-elementor allows DOM-Based XSS.This issue affects HT Slider For Elementor: from n/a through <= 1.6.5.

  Product

  HT Slider For Elementor

  Affected

  up to 1.6.5

  What to do

  Affects up to 1.6.5. Update HT Slider For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Cookiebot: Cross-Site Request Forgery (CSRF)CVE-2025-53197 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in cookiebot Cookiebot cookiebot allows Cross Site Request Forgery.This issue affects Cookiebot: from n/a through <= 4.5.8.

  Product

  Cookiebot

  Affected

  up to 4.5.8

  What to do

  Affects up to 4.5.8. Update Cookiebot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Burst Statistics: Cross-Site Request Forgery (CSRF)CVE-2025-53193 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Burst Statistics B.V. Burst Statistics burst-statistics allows Cross Site Request Forgery.This issue affects Burst Statistics: from n/a through <= 2.0.6.

  Product

  Burst Statistics

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update Burst Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52799 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes LMS lms allows Reflected XSS.This issue affects LMS: from n/a through <= 9.2.

  Product

  LMS

  Affected

  up to 9.2

  What to do

  Affects up to 9.2. Update LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025xili-dictionary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52778 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-dictionary xili-dictionary allows Reflected XSS.This issue affects xili-dictionary: from n/a through <= 2.12.5.2.

  Product

  xili-dictionary

  Affected

  up to 2.12.5.2

  What to do

  Affects up to 2.12.5.2. Update xili-dictionary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.