Vulnerability database

9,245 results · page 110 of 185

• Jan 22, 2025WordPress Local SEO: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23931 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oliver Fuhrmann WordPress Local SEO dh-local-seo allows Blind SQL Injection.This issue affects WordPress Local SEO: from n/a through <= 2.3.

  Product

  WordPress Local SEO

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update WordPress Local SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Menus Plus+: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23910 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in keighl Menus Plus+ menus-plus allows SQL Injection.This issue affects Menus Plus+: from n/a through <= 1.9.6.

  Product

  Menus Plus+

  Affected

  up to 1.9.6

  What to do

  Affects up to 1.9.6. Update Menus Plus+ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025WP Download Codes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23882 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in misanthrop WP Download Codes wp-download-codes allows Reflected XSS.This issue affects WP Download Codes: from n/a through <= 2.5.4.

  Product

  WP Download Codes

  Affected

  up to 2.5.4

  What to do

  Affects up to 2.5.4. Update WP Download Codes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025WP Block Pack: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23874 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FalconTheme Team WP Block Pack wp-block-pack allows Reflected XSS.This issue affects WP Block Pack: from n/a through <= 1.1.6.

  Product

  WP Block Pack

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update WP Block Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025WordPress File Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23867 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markcoker WordPress File Search wpfilesearch allows Reflected XSS.This issue affects WordPress File Search: from n/a through <= 1.2.

  Product

  WordPress File Search

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update WordPress File Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025EU DSGVO Helper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23866 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E. Marten EU DSGVO Helper dsgvo allows Reflected XSS.This issue affects EU DSGVO Helper: from n/a through <= 1.0.6.1.

  Product

  EU DSGVO Helper

  Affected

  up to 1.0.6.1

  What to do

  Affects up to 1.0.6.1. Update EU DSGVO Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Flexible Blogtitle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23846 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thaikolja Flexible Blogtitle flexible-blogtitle allows Reflected XSS.This issue affects Flexible Blogtitle: from n/a through <= 0.1.

  Product

  Flexible Blogtitle

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Flexible Blogtitle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Contact Form 7 Round Robin Lead Distribution: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23812 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Jeffrey Contact Form 7 Round Robin Lead Distribution contact-form-7-round-robin-lead-distribution allows Reflected XSS.This issue affects Contact Form 7 Round Robin Lead Distribution: from n/a through <= 1.2.1.

  Product

  Contact Form 7 Round Robin Lead Distribution

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Contact Form 7 Round Robin Lead Distribution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025WP2APP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23811 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ghasemy14 WP2APP wp2appir allows Reflected XSS.This issue affects WP2APP: from n/a through <= 2.6.2.

  Product

  WP2APP

  Affected

  up to 2.6.2

  What to do

  Affects up to 2.6.2. Update WP2APP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Mass Messaging in BuddyPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23798 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ElbowRobo Mass Messaging in BuddyPress mass-messaging-in-buddypress allows Reflected XSS.This issue affects Mass Messaging in BuddyPress: from n/a through <= 2.2.1.

  Product

  Mass Messaging in BuddyPress

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update Mass Messaging in BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Contact Form 7 Round Robin Lead Distribution: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23784 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Jeffrey Contact Form 7 Round Robin Lead Distribution contact-form-7-round-robin-lead-distribution allows SQL Injection.This issue affects Contact Form 7 Round Robin Lead Distribution: from n/a through <= 1.2.1.

  Product

  Contact Form 7 Round Robin Lead Distribution

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Contact Form 7 Round Robin Lead Distribution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025WM Options Import Export: Insertion of Sensitive Information Into Sent DataCVE-2025-23781 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Insertion of Sensitive Information Into Sent Data vulnerability in Web Mumbai WM Options Import Export wm-options-import-export allows Retrieve Embedded Sensitive Data.This issue affects WM Options Import Export: from n/a through <= 1.0.1.

  Product

  WM Options Import Export

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update WM Options Import Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Fast Tube: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23770 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caspie Fast Tube fast-tube allows Reflected XSS.This issue affects Fast Tube: from n/a through <= 2.3.1.

  Product

  Fast Tube

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update Fast Tube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Content Mirror: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23769 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dreamsofmatter Content Mirror content-mirror allows Reflected XSS.This issue affects Content Mirror: from n/a through <= 1.2.

  Product

  Content Mirror

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Content Mirror to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025InFunding: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23768 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in inwavethemes InFunding infunding allows Reflected XSS.This issue affects InFunding: from n/a through <= 1.0.

  Product

  InFunding

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update InFunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Pootle button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23758 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pootlepress Pootle button pootle-button allows Reflected XSS.This issue affects Pootle button: from n/a through <= 1.2.0.

  Product

  Pootle button

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Pootle button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025CMC MIGRATE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23746 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edem CMC MIGRATE cmc-migrate allows Reflected XSS.This issue affects CMC MIGRATE: from n/a through <= 0.0.3.

  Product

  CMC MIGRATE

  Affected

  up to 0.0.3

  What to do

  Affects up to 0.0.3. Update CMC MIGRATE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Easy Filtering: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23732 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in franciscopalacios Easy Filtering easy-filtering allows Reflected XSS.This issue affects Easy Filtering: from n/a through <= 2.5.0.

  Product

  Easy Filtering

  Affected

  up to 2.5.0

  What to do

  Affects up to 2.5.0. Update Easy Filtering to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Formatted post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23709 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kiroro Formatted post formatted-post allows Reflected XSS.This issue affects Formatted post: from n/a through <= 1.01.

  Product

  Formatted post

  Affected

  up to 1.01

  What to do

  Affects up to 1.01. Update Formatted post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Jet Skinner for BuddyPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23706 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in milordk Jet Skinner for BuddyPress jet-skinner-for-buddypress allows Reflected XSS.This issue affects Jet Skinner for BuddyPress: from n/a through <= 1.2.5.

  Product

  Jet Skinner for BuddyPress

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Jet Skinner for BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Lime Developer Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23701 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in limesquare Lime Developer Login lime-developer-login allows Reflected XSS.This issue affects Lime Developer Login: from n/a through <= 1.4.0.

  Product

  Lime Developer Login

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Lime Developer Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025yCyclista: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23700 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonisink yCyclista ycyclista allows Reflected XSS.This issue affects yCyclista: from n/a through <= 1.2.3.

  Product

  yCyclista

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update yCyclista to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Podčlánková inzerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23697 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webdeal Podčlánková inzerce podclankova-inzerce allows Reflected XSS.This issue affects Podčlánková inzerce: from n/a through <= 2.4.0.

  Product

  Podčlánková inzerce

  Affected

  up to 2.4.0

  What to do

  Affects up to 2.4.0. Update Podčlánková inzerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Staging CDN: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23696 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronan Mockett Staging CDN staging-cdn allows Reflected XSS.This issue affects Staging CDN: from n/a through <= 1.0.0.

  Product

  Staging CDN

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Staging CDN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025CtyGrid Hyp3rL0cal Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23695 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kinlane CtyGrid Hyp3rL0cal Search hyp3rl0cal-city-search allows Reflected XSS.This issue affects CtyGrid Hyp3rL0cal Search: from n/a through <= 0.1.1.1.

  Product

  CtyGrid Hyp3rL0cal Search

  Affected

  up to 0.1.1.1

  What to do

  Affects up to 0.1.1.1. Update CtyGrid Hyp3rL0cal Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Admin Menu Organizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23686 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phpdevca Admin Menu Organizer admin-menu-organizer allows Reflected XSS.This issue affects Admin Menu Organizer: from n/a through <= 1.0.1.

  Product

  Admin Menu Organizer

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Admin Menu Organizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025MACME: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23683 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xdxdVSxdxd MACME macme allows Reflected XSS.This issue affects MACME: from n/a through <= 1.2.

  Product

  MACME

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update MACME to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Preloader Quotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23682 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bhuvnesh Gupta Preloader Quotes preloader-quotes allows Reflected XSS.This issue affects Preloader Quotes: from n/a through <= 1.0.0.

  Product

  Preloader Quotes

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Preloader Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025REDIRECTION PLUS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23681 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat REDIRECTION PLUS redirection-plus allows Reflected XSS.This issue affects REDIRECTION PLUS: from n/a through <= 2.0.0.

  Product

  REDIRECTION PLUS

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update REDIRECTION PLUS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025FP RSS Category Excluder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23679 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flourish Pixel FP RSS Category Excluder fp-rss-category-excluder allows Reflected XSS.This issue affects FP RSS Category Excluder: from n/a through <= 1.0.0.

  Product

  FP RSS Category Excluder

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update FP RSS Category Excluder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025LocalGrid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23678 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Imranur Rahman LocalGrid localgrid allows Reflected XSS.This issue affects LocalGrid: from n/a through <= 1.0.1.

  Product

  LocalGrid

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update LocalGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025LH Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23676 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH Email lh-email allows Reflected XSS.This issue affects LH Email: from n/a through <= 1.12.

  Product

  LH Email

  Affected

  up to 1.12

  What to do

  Affects up to 1.12. Update LH Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Bit.ly linker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23674 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andygauk Bit.ly linker bitly-linker allows Reflected XSS.This issue affects Bit.ly linker: from n/a through <= 1.1.

  Product

  Bit.ly linker

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Bit.ly linker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Instant Appointment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23672 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tenteeglobal Instant Appointment instant-appointment allows Reflected XSS.This issue affects Instant Appointment: from n/a through <= 1.2.

  Product

  Instant Appointment

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Instant Appointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025ReadMe Creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23643 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in a.ankit ReadMe Creator readme-creator allows Reflected XSS.This issue affects ReadMe Creator: from n/a through <= 1.0.

  Product

  ReadMe Creator

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update ReadMe Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Content Planner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23631 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Lewis Content Planner content-planner allows Reflected XSS.This issue affects Content Planner: from n/a through <= 1.0.

  Product

  Content Planner

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Content Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Cyber Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23630 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Irshad A.Khan Cyber Slider cyber-new-slider allows Reflected XSS.This issue affects Cyber Slider: from n/a through <= 1.1.

  Product

  Cyber Slider

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Cyber Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Unique UX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23625 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode Unique UX unique-ux allows Reflected XSS.This issue affects Unique UX: from n/a through <= 0.9.2.

  Product

  Unique UX

  Affected

  up to 0.9.2

  What to do

  Affects up to 0.9.2. Update Unique UX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025WH Cache & Security: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23611 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webhue WH Cache & Security wh-cache-and-security allows Reflected XSS.This issue affects WH Cache & Security: from n/a through <= 1.1.2.

  Product

  WH Cache & Security

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update WH Cache & Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Ultimate Events: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23610 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tehsmash Ultimate Events ultimate-events allows Reflected XSS.This issue affects Ultimate Events: from n/a through <= 1.3.3.

  Product

  Ultimate Events

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update Ultimate Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Tagesteller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23609 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Helle1 Tagesteller tagesteller allows Reflected XSS.This issue affects Tagesteller: from n/a through <= v.1.1.

  Product

  Tagesteller

  What to do

  Update Tagesteller to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025CAMOO SMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23607 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camoo Sarl CAMOO SMS camoo-sms allows Reflected XSS.This issue affects CAMOO SMS: from n/a through <= 3.0.1.

  Product

  CAMOO SMS

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update CAMOO SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Calendi: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23606 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sebkay Calendi calendi allows Reflected XSS.This issue affects Calendi: from n/a through <= 1.1.1.

  Product

  Calendi

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Calendi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Call To Action Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23605 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lampd Call To Action Popup call-to-action-popup allows Reflected XSS.This issue affects Call To Action Popup: from n/a through <= 1.0.2.

  Product

  Call To Action Popup

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Call To Action Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Rezdy Reloaded: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23604 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maeve Lander Rezdy Reloaded reloaded-rezdy allows Stored XSS.This issue affects Rezdy Reloaded: from n/a through <= 1.0.1.

  Product

  Rezdy Reloaded

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Rezdy Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Group category creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23603 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MohammadJafar Khajeh Group category creator group-category-creator allows Reflected XSS.This issue affects Group category creator: from n/a through <= 1.3.0.3.

  Product

  Group category creator

  Affected

  up to 1.3.0.3

  What to do

  Affects up to 1.3.0.3. Update Group category creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025EELV Newsletter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23602 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Europe Ecologie Les Verts EELV Newsletter eelv-newsletter allows Reflected XSS.This issue affects EELV Newsletter: from n/a through <= 4.8.2.

  Product

  EELV Newsletter

  Affected

  up to 4.8.2

  What to do

  Affects up to 4.8.2. Update EELV Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Tab My Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23601 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in patrice Tab My Content tab-my-content allows Reflected XSS.This issue affects Tab My Content: from n/a through <= 1.0.0.

  Product

  Tab My Content

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Tab My Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Rio Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23597 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sabareesha Rio Photo Gallery rio-photo-gallery allows Reflected XSS.This issue affects Rio Photo Gallery: from n/a through <= 0.1.

  Product

  Rio Photo Gallery

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Rio Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025dForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23592 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in animexxx dForms dforms allows Reflected XSS.This issue affects dForms: from n/a through <= 1.0.

  Product

  dForms

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update dForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.