Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

546new WordPress flaws this week

391,964entries in the database

9,245 results · page 108 of 185

Jan 24, 2025PDF Invoice Builder for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24755 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Stored XSS.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 4.6.0.
Product
PDF Invoice Builder for WooCommerce
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update PDF Invoice Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Popup Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24746 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Iser Popup Maker popup-maker allows Stored XSS.This issue affects Popup Maker: from n/a through <= 1.20.2.
Product
Popup Maker
Affected
up to 1.20.2
What to do
Affects up to 1.20.2. Update Popup Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Post Grid Master: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-24733 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Akhtarujjaman Shuvo Post Grid Master ajax-filter-posts allows PHP Local File Inclusion.This issue affects Post Grid Master: from n/a through <= 3.4.12.
Product
Post Grid Master
Affected
up to 3.4.12
What to do
Affects up to 3.4.12. Update Post Grid Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025BookingPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24732 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems BookingPress bookingpress-appointment-booking allows DOM-Based XSS.This issue affects BookingPress: from n/a through <= 1.1.25.
Product
BookingPress
Affected
up to 1.1.25
What to do
Affects up to 1.1.25. Update BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Download IP2Location Country Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24731 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IP2Location Download IP2Location Country Blocker ip2location-country-blocker allows Stored XSS.This issue affects Download IP2Location Country Blocker: from n/a through <= 2.38.3.
Product
Download IP2Location Country Blocker
Affected
up to 2.38.3
What to do
Affects up to 2.38.3. Update Download IP2Location Country Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025WP VR: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24730 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affects WP VR: from n/a through <= 8.5.14.
Product
WP VR
Affected
up to 8.5.14
What to do
Affects up to 8.5.14. Update WP VR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025ElementInvader Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24729 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.3.
Product
ElementInvader Addons for Elementor
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Bug Library: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24728 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yannick Lefebvre Bug Library bug-library allows Blind SQL Injection.This issue affects Bug Library: from n/a through <= 2.1.4.
Product
Bug Library
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Bug Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Contact Form Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24727 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through <= 1.3.52.
Product
Contact Form Email
Affected
up to 1.3.52
What to do
Affects up to 1.3.52. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025HT Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24726 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored XSS.This issue affects HT Contact Form 7: from n/a through <= 1.2.1.
Product
HT Contact Form 7
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update HT Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Booking Calendar Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24723 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through <= 1.2.55.
Product
Booking Calendar Contact Form
Affected
up to 1.2.55
What to do
Affects up to 1.2.55. Update Booking Calendar Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025FAQ Builder AYS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24722 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro FAQ Builder AYS faq-builder-ays allows Stored XSS.This issue affects FAQ Builder AYS: from n/a through <= 1.7.3.
Product
FAQ Builder AYS
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update FAQ Builder AYS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Easy YouTube Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24721 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Urošević Easy YouTube Gallery easy-youtube-gallery allows Stored XSS.This issue affects Easy YouTube Gallery: from n/a through <= 1.0.4.
Product
Easy YouTube Gallery
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Easy YouTube Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Widget Countdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24719 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Widget Countdown widget-countdown allows Stored XSS.This issue affects Widget Countdown: from n/a through <= 2.7.1.
Product
Widget Countdown
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Widget Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Plethora Plugins Tabs + Accordions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24709 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plethora Plugins Plethora Plugins Tabs + Accordions plethora-tabs-accordions allows Stored XSS.This issue affects Plethora Plugins Tabs + Accordions: from n/a through <= 1.1.5.
Product
Plethora Plugins Tabs + Accordions
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Plethora Plugins Tabs + Accordions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025MultiVendorX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24706 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Stored XSS.This issue affects MultiVendorX: from n/a through <= 4.2.13.
Product
MultiVendorX
Affected
up to 4.2.13
What to do
Affects up to 4.2.13. Update MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Magic the Gathering Card Tooltips: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24704 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grimdonkey Magic the Gathering Card Tooltips magic-the-gathering-card-tooltips allows Stored XSS.This issue affects Magic the Gathering Card Tooltips: from n/a through <= 3.4.0.
Product
Magic the Gathering Card Tooltips
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update Magic the Gathering Card Tooltips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Comment Edit Core – Simple Comment Editing: Server-Side Request Forgery (SSRF)CVE-2025-24703 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Ronald Huereca Comment Edit Core – Simple Comment Editing simple-comment-editing allows Server Side Request Forgery.This issue affects Comment Edit Core – Simple Comment Editing: from n/a through <= 3.0.33.
Product
Comment Edit Core – Simple Comment Editing
Affected
up to 3.0.33
What to do
Affects up to 3.0.33. Update Comment Edit Core – Simple Comment Editing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Xagio SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24702 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xagio SEO Xagio SEO xagio-seo allows Stored XSS.This issue affects Xagio SEO: from n/a through <= 7.0.0.20.
Product
Xagio SEO
Affected
up to 7.0.0.20
What to do
Affects up to 7.0.0.20. Update Xagio SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Show/Hide Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24687 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lars Wallenborn Show/Hide Shortcode showhide-shortcode allows Stored XSS.This issue affects Show/Hide Shortcode: from n/a through <= 1.0.0.
Product
Show/Hide Shortcode
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Show/Hide Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025RSVP and Event Management: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24683 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill RSVP and Event Management rsvp allows SQL Injection.This issue affects RSVP and Event Management: from n/a through <= 2.7.14.
Product
RSVP and Event Management
Affected
up to 2.7.14
What to do
Affects up to 2.7.14. Update RSVP and Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Product Carousel Slider & Grid Ultimate for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24681 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Product Carousel Slider & Grid Ultimate for WooCommerce woo-product-carousel-slider-and-grid-ultimate allows Stored XSS.This issue affects Product Carousel Slider & Grid Ultimate for WooCommerce: from n/a through <= 1.10.0.
Product
Product Carousel Slider & Grid Ultimate for WooCommerce
Affected
up to 1.10.0
What to do
Affects up to 1.10.0. Update Product Carousel Slider & Grid Ultimate for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Listamester: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-24678 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in listamester Listamester listamester allows Stored XSS.This issue affects Listamester: from n/a through <= 2.3.4.
Product
Listamester
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update Listamester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24675 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Stored XSS.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 7.2.
Product
WP Visitor Statistics (Real Time Traffic)
Affected
up to 7.2
What to do
Affects up to 7.2. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025ShMapper by Teplitsa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24674 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denis Cherniatev ShMapper by Teplitsa shmapper-by-teplitsa allows Stored XSS.This issue affects ShMapper by Teplitsa: from n/a through <= 1.5.0.
Product
ShMapper by Teplitsa
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update ShMapper by Teplitsa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Ketchup Shortcodes: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-24673 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AyeCode Ketchup Shortcodes ketchup-shortcodes-pack allows Stored XSS.This issue affects Ketchup Shortcodes: from n/a through <= 0.1.2.
Product
Ketchup Shortcodes
Affected
up to 0.1.2
What to do
Affects up to 0.1.2. Update Ketchup Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Form Builder CP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24672 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople Form Builder CP cp-easy-form-builder allows SQL Injection.This issue affects Form Builder CP: from n/a through <= 1.2.41.
Product
Form Builder CP
Affected
up to 1.2.41
What to do
Affects up to 1.2.41. Update Form Builder CP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025SERPed.net: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24669 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in serpednet SERPed.net serped-net allows SQL Injection.This issue affects SERPed.net: from n/a through <= 4.4.
Product
SERPed.net
Affected
up to 4.4
What to do
Affects up to 4.4. Update SERPed.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025PPOM for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24668 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Stored XSS.This issue affects PPOM for WooCommerce: from n/a through <= 33.0.8.
Product
PPOM for WooCommerce
Affected
up to 33.0.8
What to do
Affects up to 33.0.8. Update PPOM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025AI Chatbot for WordPress – Hyve Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24666 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Stored XSS.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through <= 1.2.2.
Product
AI Chatbot for WordPress – Hyve Lite
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update AI Chatbot for WordPress – Hyve Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Simple Download Monitor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24663 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mra13 Simple Download Monitor simple-download-monitor allows Blind SQL Injection.This issue affects Simple Download Monitor: from n/a through <= 3.9.25.
Product
Simple Download Monitor
Affected
up to 3.9.25
What to do
Affects up to 3.9.25. Update Simple Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025WPDM – Premium Packages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24659 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Blind SQL Injection.This issue affects WPDM – Premium Packages: from n/a through <= 5.9.6.
Product
WPDM – Premium Packages
Affected
up to 5.9.6
What to do
Affects up to 5.9.6. Update WPDM – Premium Packages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Auction Nudge – Your eBay on Your Site: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24658 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Auction Nudge – Your eBay on Your Site auction-nudge allows Stored XSS.This issue affects Auction Nudge – Your eBay on Your Site: from n/a through <= 7.2.0.
Product
Auction Nudge – Your eBay on Your Site
Affected
up to 7.2.0
What to do
Affects up to 7.2.0. Update Auction Nudge – Your eBay on Your Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Wishlist for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24657 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee Wishlist for WooCommerce wt-woocommerce-wishlist allows Stored XSS.This issue affects Wishlist for WooCommerce: from n/a through <= 2.1.2.
Product
Wishlist for WooCommerce
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24644 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels print-invoices-packing-slip-labels-for-woocommerce allows Stored XSS.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through <= 4.7.1.
Product
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
Affected
up to 4.7.1
What to do
Affects up to 4.7.1. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Create with Code: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24638 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pddring Create with Code create-with-code allows DOM-Based XSS.This issue affects Create with Code: from n/a through <= 1.4.
Product
Create with Code
Affected
up to 1.4
What to do
Affects up to 1.4. Update Create with Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Orbisius Simple Notice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24634 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Svetoslav Marinov Orbisius Simple Notice orbisius-simple-notice allows Stored XSS.This issue affects Orbisius Simple Notice: from n/a through <= 1.1.3.
Product
Orbisius Simple Notice
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Orbisius Simple Notice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Blur Text: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24627 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linnea Huxford Blur Text blur-text allows Stored XSS.This issue affects Blur Text: from n/a through <= 1.0.0.
Product
Blur Text
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Blur Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Really Simple SSL: Cross-Site Request Forgery (CSRF)CVE-2025-24623 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Cross Site Request Forgery.This issue affects Really Simple SSL: from n/a through <= 9.1.4.
Product
Really Simple SSL
Affected
up to 9.1.4
What to do
Affects up to 9.1.4. Update Really Simple SSL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025WP Ultimate Exporter: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-24611 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Smackcoders Inc., WP Ultimate Exporter wp-ultimate-exporter allows Absolute Path Traversal.This issue affects WP Ultimate Exporter: from n/a through <= 2.9.
Product
WP Ultimate Exporter
Affected
up to 2.9
What to do
Affects up to 2.9. Update WP Ultimate Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Restrict Anonymous Access: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christian Leuenberg Restrict Anonymous Access restrict-anonymous-access allows Stored XSS.This issue affects Restrict Anonymous Access: from n/a through <= 1.2.
Product
Restrict Anonymous Access
Affected
up to 1.2
What to do
Affects up to 1.2. Update Restrict Anonymous Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025All Embed – Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24595 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins All Embed – Elementor Addons all-embed-addons-for-elementor allows Stored XSS.This issue affects All Embed – Elementor Addons: from n/a through <= 1.1.3.
Product
All Embed – Elementor Addons
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update All Embed – Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Email Subscription Popup: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24587 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nks Email Subscription Popup email-subscribe allows Blind SQL Injection.This issue affects Email Subscription Popup: from n/a through <= 1.2.23.
Product
Email Subscription Popup
Affected
up to 1.2.23
What to do
Affects up to 1.2.23. Update Email Subscription Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24585 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This issue affects Event post: from n/a through <= 5.9.7.
Product
Event post
Affected
up to 5.9.7
What to do
Affects up to 5.9.7. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Nested Pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24579 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Nested Pages wp-nested-pages allows Stored XSS.This issue affects Nested Pages: from n/a through <= 3.2.9.
Product
Nested Pages
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update Nested Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025ElementInvader Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24578 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows DOM-Based XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.0.
Product
ElementInvader Addons for Elementor
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025HelloAsso: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24575 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso HelloAsso helloasso allows Stored XSS.This issue affects HelloAsso: from n/a through <= 1.1.11.
Product
HelloAsso
Affected
up to 1.1.11
What to do
Affects up to 1.1.11. Update HelloAsso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025PageLayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24573 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softaculous PageLayer pagelayer allows DOM-Based XSS.This issue affects PageLayer: from n/a through <= 1.9.4.
Product
PageLayer
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update PageLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Atarim: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24570 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Stored XSS.This issue affects Atarim: from n/a through <= 4.0.8.
Product
Atarim
Affected
up to 4.0.8
What to do
Affects up to 4.0.8. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Caching Compatible Cookie Opt-In and JavaScript: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24547 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthias.wagner Caching Compatible Cookie Opt-In and JavaScript caching-compatible-cookie-optin-and-javascript allows Stored XSS.This issue affects Caching Compatible Cookie Opt-In and JavaScript: from n/a through <= 0.0.10.
Product
Caching Compatible Cookie Opt-In and JavaScript
Affected
up to 0.0.10
What to do
Affects up to 0.0.10. Update Caching Compatible Cookie Opt-In and JavaScript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.