Vulnerability database

15,920 results · page 129 of 319

• Apr 9, 2025WordPress Events Calendar Plugin – connectDaily: Cross-Site Request Forgery (CSRF)CVE-2025-32597 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in George Sexton WordPress Events Calendar Plugin – connectDaily connect-daily-web-calendar allows Cross-Site Scripting (XSS).This issue affects WordPress Events Calendar Plugin – connectDaily: from n/a through <= 1.5.4.

  Product

  WordPress Events Calendar Plugin – connectDaily

  Affected

  up to 1.5.4

  What to do

  Affects up to 1.5.4. Update WordPress Events Calendar Plugin – connectDaily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP Abstracts: Cross-Site Request Forgery (CSRF)CVE-2025-32591 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows Cross Site Request Forgery.This issue affects WP Abstracts: from n/a through <= 2.7.5.

  Product

  WP Abstracts

  Affected

  up to 2.7.5

  What to do

  Affects up to 2.7.5. Update WP Abstracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Chat2: Cross-Site Request Forgery (CSRF)CVE-2025-32584 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Chat2 Chat2 chat2 allows Cross Site Request Forgery.This issue affects Chat2: from n/a through <= 4.0.

  Product

  Chat2

  Affected

  up to 4.0

  What to do

  Affects up to 4.0. Update Chat2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WordPress Spam Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32581 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ankit Singla WordPress Spam Blocker cf7-manual-spam-blocker allows Stored XSS.This issue affects WordPress Spam Blocker: from n/a through <= 2.0.5.

  Product

  WordPress Spam Blocker

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update WordPress Spam Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025DeBounce Email Validator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32580 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in debounce DeBounce Email Validator debounce-io-email-validator allows Stored XSS.This issue affects DeBounce Email Validator: from n/a through <= 5.7.1.

  Product

  DeBounce Email Validator

  Affected

  up to 5.7.1

  What to do

  Affects up to 5.7.1. Update DeBounce Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP shop: Cross-Site Request Forgery (CSRF)CVE-2025-32576 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in Agence web Eoxia - Montpellier WP shop wpshop allows Upload a Web Shell to a Web Server.This issue affects WP shop: from n/a through <= 2.6.1.

  Product

  WP shop

  Affected

  up to 2.6.1

  What to do

  Affects up to 2.6.1. Update WP shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP w3all phpBB: Cross-Site Request Forgery (CSRF)CVE-2025-32575 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB wp-w3all-phpbb-integration allows Reflected XSS.This issue affects WP w3all phpBB: from n/a through <= 2.9.9.

  Product

  WP w3all phpBB

  Affected

  up to 2.9.9

  What to do

  Affects up to 2.9.9. Update WP w3all phpBB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025ChillPay WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32570 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ChillPay ChillPay WooCommerce chillpay-payment-gateway allows Stored XSS.This issue affects ChillPay WooCommerce: from n/a through <= 2.5.3.

  Product

  ChillPay WooCommerce

  Affected

  up to 2.5.3

  What to do

  Affects up to 2.5.3. Update ChillPay WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP Calais Auto Tagger: Cross-Site Request Forgery (CSRF)CVE-2025-32563 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in dangrossman WP Calais Auto Tagger calais-auto-tagger allows Cross Site Request Forgery.This issue affects WP Calais Auto Tagger: from n/a through <= 2.0.

  Product

  WP Calais Auto Tagger

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update WP Calais Auto Tagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025REVE Chat: Cross-Site Request Forgery (CSRF)CVE-2025-32559 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in REVE Chat REVE Chat revechat allows Stored XSS.This issue affects REVE Chat: from n/a through <= 6.4.4.

  Product

  REVE Chat

  Affected

  up to 6.4.4

  What to do

  Affects up to 6.4.4. Update REVE Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Simple Post Meta Manager: Cross-Site Request Forgery (CSRF)CVE-2025-32556 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Sandor Kovacs Simple Post Meta Manager simple-post-meta-manager allows Reflected XSS.This issue affects Simple Post Meta Manager: from n/a through <= 1.0.9.

  Product

  Simple Post Meta Manager

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Simple Post Meta Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025SEO, Nutrition and Print for Recipes by Edamam: Cross-Site Request Forgery (CSRF)CVE-2025-32555 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Edamam SEO, Nutrition and Print for Recipes by Edamam seo-nutrition-and-print-for-recipes-by-edamam allows Stored XSS.This issue affects SEO, Nutrition and Print for Recipes by Edamam: from n/a through <= 3.3.

  Product

  SEO, Nutrition and Print for Recipes by Edamam

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update SEO, Nutrition and Print for Recipes by Edamam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025All push notification for WP: Cross-Site Request Forgery (CSRF)CVE-2025-32547 · WordPress plugins & themes · reported by PatchstackHigh 8.2

  Cross-Site Request Forgery (CSRF) vulnerability in gtlwpdev All push notification for WP all-push-notification allows Blind SQL Injection.This issue affects All push notification for WP: from n/a through <= 1.5.3.

  Product

  All push notification for WP

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update All push notification for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Canonical Attachments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32543 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hivedigital Canonical Attachments canonical-attachments allows Reflected XSS.This issue affects Canonical Attachments: from n/a through <= 1.8.

  Product

  Canonical Attachments

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update Canonical Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025ALD Login Page: Cross-Site Request Forgery (CSRF)CVE-2025-32518 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in hossainawlad ALD Login Page ald-login-page allows Stored XSS.This issue affects ALD Login Page: from n/a through <= 1.1.

  Product

  ALD Login Page

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update ALD Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025MultiMailer: Cross-Site Request Forgery (CSRF)CVE-2025-32505 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in SCAND MultiMailer scand-multi-mailer allows Stored XSS.This issue affects MultiMailer: from n/a through <= 1.0.3.

  Product

  MultiMailer

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update MultiMailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Link Shield: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32503 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Conti Link Shield link-shield allows Stored XSS.This issue affects Link Shield: from n/a through <= 0.5.4.

  Product

  Link Shield

  Affected

  up to 0.5.4

  What to do

  Affects up to 0.5.4. Update Link Shield to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025ePaper Lister for Yumpu: Cross-Site Request Forgery (CSRF)CVE-2025-32502 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in lemmentwickler ePaper Lister for Yumpu magazine-lister-for-yumpu allows Stored XSS.This issue affects ePaper Lister for Yumpu: from n/a through <= 1.4.0.

  Product

  ePaper Lister for Yumpu

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update ePaper Lister for Yumpu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Rentsyst: Cross-Site Request Forgery (CSRF)CVE-2025-32501 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in dimafreund Rentsyst rentsyst allows Stored XSS.This issue affects Rentsyst: from n/a through <= 2.0.92.

  Product

  Rentsyst

  Affected

  up to 2.0.92

  What to do

  Affects up to 2.0.92. Update Rentsyst to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Codescar Radio Widget: Cross-Site Request Forgery (CSRF)CVE-2025-32500 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Sudavar Codescar Radio Widget codescar-radio-widget allows Stored XSS.This issue affects Codescar Radio Widget: from n/a through <= 0.4.2.

  Product

  Codescar Radio Widget

  Affected

  up to 0.4.2

  What to do

  Affects up to 0.4.2. Update Codescar Radio Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025VKontakte Cross-Post: Cross-Site Request Forgery (CSRF)CVE-2025-32498 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in oleglark VKontakte Cross-Post vkontakte-cross-post allows Stored XSS.This issue affects VKontakte Cross-Post: from n/a through <= 0.3.2.

  Product

  VKontakte Cross-Post

  Affected

  up to 0.3.2

  What to do

  Affects up to 0.3.2. Update VKontakte Cross-Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Spoiler Block: Cross-Site Request Forgery (CSRF)CVE-2025-32497 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in squiter Spoiler Block spoiler-block allows Stored XSS.This issue affects Spoiler Block: from n/a through <= 1.7.

  Product

  Spoiler Block

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Spoiler Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Ultra Demo Importer: Cross-Site Request Forgery (CSRF)CVE-2025-32496 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in Uncodethemes Ultra Demo Importer ut-demo-importer allows Upload a Web Shell to a Web Server.This issue affects Ultra Demo Importer: from n/a through <= 1.0.5.

  Product

  Ultra Demo Importer

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Ultra Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Waymark: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32495 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Waymark waymark allows Stored XSS.This issue affects Waymark: from n/a through <= 1.5.3.

  Product

  Waymark

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update Waymark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025reCAPTCHA Jetpack: Cross-Site Request Forgery (CSRF)CVE-2025-32494 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in bozdoz reCAPTCHA Jetpack recaptcha-jetpack allows Cross Site Request Forgery.This issue affects reCAPTCHA Jetpack: from n/a through <= 0.2.2.

  Product

  reCAPTCHA Jetpack

  Affected

  up to 0.2.2

  What to do

  Affects up to 0.2.2. Update reCAPTCHA Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025BP Social Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32493 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes BP Social Connect bp-social-connect allows Stored XSS.This issue affects BP Social Connect: from n/a through <= 1.6.2.

  Product

  BP Social Connect

  Affected

  up to 1.6.2

  What to do

  Affects up to 1.6.2. Update BP Social Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Admin Menu Post List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32492 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eliot Akira Admin Menu Post List admin-menu-post-list allows Stored XSS.This issue affects Admin Menu Post List: from n/a through <= 2.0.7.

  Product

  Admin Menu Post List

  Affected

  up to 2.0.7

  What to do

  Affects up to 2.0.7. Update Admin Menu Post List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Wetterwarner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32489 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Wetterwarner wetterwarner allows Stored XSS.This issue affects Wetterwarner: from n/a through <= 2.7.3.

  Product

  Wetterwarner

  Affected

  up to 2.7.3

  What to do

  Affects up to 2.7.3. Update Wetterwarner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Aria Font: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32488 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in آریا وردپرس Aria Font aria-font allows Stored XSS.This issue affects Aria Font: from n/a through <= 1.4.

  Product

  Aria Font

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Aria Font to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP Performance Pack: Cross-Site Request Forgery (CSRF)CVE-2025-32485 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Bjoern WP Performance Pack wp-performance-pack allows Cross Site Request Forgery.This issue affects WP Performance Pack: from n/a through <= 2.5.4.

  Product

  WP Performance Pack

  Affected

  up to 2.5.4

  What to do

  Affects up to 2.5.4. Update WP Performance Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP-Planification: Cross-Site Request Forgery (CSRF)CVE-2025-32484 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WP-Planification wp-planification allows Stored XSS.This issue affects WP-Planification: from n/a through <= 2.3.1.

  Product

  WP-Planification

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update WP-Planification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Request Call Back: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32483 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Salisbury Request Call Back request-call-back allows Stored XSS.This issue affects Request Call Back: from n/a through <= 1.4.1.

  Product

  Request Call Back

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Request Call Back to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Custom Smilies: Cross-Site Request Forgery (CSRF)CVE-2025-32482 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in quanganhdo Custom Smilies custom-smilies allows Stored XSS.This issue affects Custom Smilies: from n/a through <= 1.2.

  Product

  Custom Smilies

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Custom Smilies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Nino Social Connect: Cross-Site Request Forgery (CSRF)CVE-2025-32481 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ninotheme Nino Social Connect nino-social-connect allows Stored XSS.This issue affects Nino Social Connect: from n/a through <= 2.0.

  Product

  Nino Social Connect

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Nino Social Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Windows Live Writer: Cross-Site Request Forgery (CSRF)CVE-2025-32480 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in dalziel Windows Live Writer windows-live-writer allows Stored XSS.This issue affects Windows Live Writer: from n/a through <= 0.1.

  Product

  Windows Live Writer

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Windows Live Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Flags Widget: Cross-Site Request Forgery (CSRF)CVE-2025-32479 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ab-tools Flags Widget flags-widget allows Stored XSS.This issue affects Flags Widget: from n/a through <= 1.0.7.

  Product

  Flags Widget

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Flags Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP SexyLightBox: Cross-Site Request Forgery (CSRF)CVE-2025-32478 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Mario Aguiar WP SexyLightBox wp-sexylightbox allows Stored XSS.This issue affects WP SexyLightBox: from n/a through <= 0.5.3.

  Product

  WP SexyLightBox

  Affected

  up to 0.5.3

  What to do

  Affects up to 0.5.3. Update WP SexyLightBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP-Easy Menu: Cross-Site Request Forgery (CSRF)CVE-2025-32477 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Jordi Salord WP-Easy Menu wp-easy-menu allows Stored XSS.This issue affects WP-Easy Menu: from n/a through <= 0.41.

  Product

  WP-Easy Menu

  Affected

  up to 0.41

  What to do

  Affects up to 0.41. Update WP-Easy Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Advanced Tag Lists: Cross-Site Request Forgery (CSRF)CVE-2025-32476 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in blueinstyle Advanced Tag Lists advanced-tag-list allows Stored XSS.This issue affects Advanced Tag Lists: from n/a through <= 1.2.

  Product

  Advanced Tag Lists

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Advanced Tag Lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025AF Tell a Friend: Cross-Site Request Forgery (CSRF)CVE-2025-31404 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Wladyslaw Madejczyk AF Tell a Friend af-tell-a-friend allows Stored XSS.This issue affects AF Tell a Friend: from n/a through <= 1.4.

  Product

  AF Tell a Friend

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update AF Tell a Friend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025NewsBoard Post and RSS Scroller: Cross-Site Request Forgery (CSRF)CVE-2025-31402 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in NewsBoard Plugin NewsBoard Post and RSS Scroller newsboard allows Stored XSS.This issue affects NewsBoard Post and RSS Scroller: from n/a through <= 1.2.12.

  Product

  NewsBoard Post and RSS Scroller

  Affected

  up to 1.2.12

  What to do

  Affects up to 1.2.12. Update NewsBoard Post and RSS Scroller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025MMX – Make Me Christmas: Cross-Site Request Forgery (CSRF)CVE-2025-31401 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mmetrodw MMX – Make Me Christmas mmx-make-me-christmas allows Stored XSS.This issue affects MMX – Make Me Christmas: from n/a through <= 1.0.0.

  Product

  MMX – Make Me Christmas

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update MMX – Make Me Christmas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WS Audio Player: Cross-Site Request Forgery (CSRF)CVE-2025-31400 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in icyleaf WS Audio Player ws-audio-player allows Stored XSS.This issue affects WS Audio Player: from n/a through <= 1.1.8.

  Product

  WS Audio Player

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update WS Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025CG Scroll To Top: Cross-Site Request Forgery (CSRF)CVE-2025-31399 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Chandan Garg CG Scroll To Top cg-scroll-to-top allows Stored XSS.This issue affects CG Scroll To Top: from n/a through <= 3.5.

  Product

  CG Scroll To Top

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update CG Scroll To Top to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Easy Custom CSS: Cross-Site Request Forgery (CSRF)CVE-2025-31395 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in a.ankit Easy Custom CSS easy-custom-css allows Stored XSS.This issue affects Easy Custom CSS: from n/a through <= 1.0.

  Product

  Easy Custom CSS

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Easy Custom CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025More Mime Type Filters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31394 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kailey (trepmal) More Mime Type Filters more-mime-type-filters allows Stored XSS.This issue affects More Mime Type Filters: from n/a through <= 0.3.

  Product

  More Mime Type Filters

  Affected

  up to 0.3

  What to do

  Affects up to 0.3. Update More Mime Type Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Social Bookmarking RELOADED: Cross-Site Request Forgery (CSRF)CVE-2025-31393 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in vfvalent Social Bookmarking RELOADED social-bookmarking-reloaded allows Stored XSS.This issue affects Social Bookmarking RELOADED: from n/a through <= 3.18.

  Product

  Social Bookmarking RELOADED

  Affected

  up to 3.18

  What to do

  Affects up to 3.18. Update Social Bookmarking RELOADED to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Smart Product Gallery Slider: Cross-Site Request Forgery (CSRF)CVE-2025-31392 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Shameem Reza Smart Product Gallery Slider smart-product-gallery-slider allows Cross Site Request Forgery.This issue affects Smart Product Gallery Slider: from n/a through <= 1.0.4.

  Product

  Smart Product Gallery Slider

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Smart Product Gallery Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Script Compressor: Cross-Site Request Forgery (CSRF)CVE-2025-31391 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in regen Script Compressor script-compressor allows Stored XSS.This issue affects Script Compressor: from n/a through <= 1.7.1.

  Product

  Script Compressor

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update Script Compressor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Social Crowd: Cross-Site Request Forgery (CSRF)CVE-2025-31390 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in bdoga Social Crowd social-crowd allows Stored XSS.This issue affects Social Crowd: from n/a through <= 0.9.6.1.

  Product

  Social Crowd

  Affected

  up to 0.9.6.1

  What to do

  Affects up to 0.9.6.1. Update Social Crowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.