Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

5,850 results · page 13 of 117

Mar 5, 2026Metro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27382 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Metro metro allows DOM-Based XSS.This issue affects Metro: from n/a through <= 2.13.
Product
Metro
Affected
up to 2.13
What to do
Affects up to 2.13. Update Metro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Claue - Clean, Minimal Elementor WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27376 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JanStudio Claue - Clean, Minimal Elementor WooCommerce Theme claue allows Reflected XSS.This issue affects Claue - Clean, Minimal Elementor WooCommerce Theme: from n/a through <= 2.2.7.
Product
Claue - Clean, Minimal Elementor WooCommerce
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update Claue - Clean, Minimal Elementor WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Gecko: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27375 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JanStudio Gecko gecko allows Reflected XSS.This issue affects Gecko: from n/a through <= 1.9.8.
Product
Gecko
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update Gecko to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Musico: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27367 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Musico musico allows Reflected XSS.This issue affects Musico: from n/a through < 3.4.5.
Product
Musico
What to do
Update Musico to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026WP Bakery Autoresponder Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27363 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kamleshyadav WP Bakery Autoresponder Addon vc-autoresponder-addon allows Stored XSS.This issue affects WP Bakery Autoresponder Addon: from n/a through <= 1.0.6.
Product
WP Bakery Autoresponder Addon
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update WP Bakery Autoresponder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Awa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27359 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Awa Plugins awa-plugins allows Reflected XSS.This issue affects Awa Plugins: from n/a through <= 1.4.4.
Product
Awa
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Awa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Architecturer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27358 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Architecturer architecturer allows Reflected XSS.This issue affects Architecturer: from n/a through < 3.9.5.
Product
Architecturer
What to do
Update Architecturer to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026WooCommerce Coming Soon Product with Countdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27354 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows Stored XSS.This issue affects WooCommerce Coming Soon Product with Countdown: from n/a through <= 5.0.
Product
WooCommerce Coming Soon Product with Countdown
Affected
up to 5.0
What to do
Affects up to 5.0. Update WooCommerce Coming Soon Product with Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Grand News: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27353 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand News grandnews allows Reflected XSS.This issue affects Grand News: from n/a through <= 3.4.3.
Product
Grand News
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update Grand News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Starto: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27352 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Starto starto allows Reflected XSS.This issue affects Starto: from n/a through < 2.2.5.
Product
Starto
What to do
Update Starto to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Photography: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27348 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Photography photography allows DOM-Based XSS.This issue affects Photography: from n/a through < 7.7.6.
Product
Photography
What to do
Update Photography to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Agrofood: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27332 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Agrofood agrofood allows Reflected XSS.This issue affects Agrofood: from n/a through < 1.4.0.
Product
Agrofood
What to do
Update Agrofood to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026DeepDigital: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22467 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mwtemplates DeepDigital deepdigital allows Reflected XSS.This issue affects DeepDigital: from n/a through <= 1.0.2.
Product
DeepDigital
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update DeepDigital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026BuddyApp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22465 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen BuddyApp buddyapp allows Reflected XSS.This issue affects BuddyApp: from n/a through <= 1.9.2.
Product
BuddyApp
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update BuddyApp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Thebe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22455 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foreverpinetree Thebe thebe allows Reflected XSS.This issue affects Thebe: from n/a through <= 1.3.0.
Product
Thebe
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Thebe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Thecs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22440 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foreverpinetree Thecs thecs allows Reflected XSS.This issue affects Thecs: from n/a through <= 1.4.7.
Product
Thecs
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Thecs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026TheBi: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22438 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foreverpinetree TheBi thebi allows Reflected XSS.This issue affects TheBi: from n/a through <= 1.0.5.
Product
TheBi
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update TheBi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Theater for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69343 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress theatre allows Stored XSS.This issue affects Theater for WordPress: from n/a through <= 0.19.
Product
Theater for
Affected
up to 0.19
What to do
Affects up to 0.19. Update Theater for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 26, 2026Flatsome: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28083 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UX-themes Flatsome flatsome allows Stored XSS.This issue affects Flatsome: from n/a through <= 3.20.5.
Product
Flatsome
Affected
up to 3.20.5
What to do
Affects up to 3.20.5. Update Flatsome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026PixelYourSite – Your smart PIXEL (TAG) Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27072 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager pixelyoursite allows Stored XSS.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through <= 11.2.0.1.
Product
PixelYourSite – Your smart PIXEL (TAG) Manager
Affected
up to 11.2.0.1
What to do
Affects up to 11.2.0.1. Update PixelYourSite – Your smart PIXEL (TAG) Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Whizz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24955 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Whizz Plugins whizz-plugins allows Reflected XSS.This issue affects Whizz Plugins: from n/a through <= 1.9.
Product
Whizz
Affected
up to 1.9
What to do
Affects up to 1.9. Update Whizz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026PhotoMe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24949 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods PhotoMe photome allows DOM-Based XSS.This issue affects PhotoMe: from n/a through <= 5.7.1.
Product
PhotoMe
Affected
up to 5.7.1
What to do
Affects up to 5.7.1. Update PhotoMe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Reflector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24948 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Reflector reflector-plugins allows Reflected XSS.This issue affects Reflector: from n/a through <= 1.2.2.
Product
Reflector
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Reflector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Grand Conference: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24943 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Conference grandconference allows Reflected XSS.This issue affects Grand Conference: from n/a through <= 5.3.4.
Product
Grand Conference
Affected
up to 5.3.4
What to do
Affects up to 5.3.4. Update Grand Conference to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Link Whisper Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22357 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through <= 0.9.2.
Product
Link Whisper Free
Affected
up to 0.9.2
What to do
Affects up to 0.9.2. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Persian Woocommerce SMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22352 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows Reflected XSS.This issue affects Persian Woocommerce SMS: from n/a through <= 7.1.1.
Product
Persian Woocommerce SMS
Affected
up to 7.1.1
What to do
Affects up to 7.1.1. Update Persian Woocommerce SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026iMoney: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69392 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in itex iMoney imoney allows Reflected XSS.This issue affects iMoney: from n/a through <= 0.36.
Product
iMoney
Affected
up to 0.36
What to do
Affects up to 0.36. Update iMoney to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Diamond: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69391 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes Diamond diamond allows Reflected XSS.This issue affects Diamond: from n/a through <= 2.4.8.
Product
Diamond
Affected
up to 2.4.8
What to do
Affects up to 2.4.8. Update Diamond to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Business Template Blocks for WPBakery (Visual Composer) Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69390 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Business Template Blocks for WPBakery (Visual Composer) Page Builder templates-and-addons-for-wpbakery-page-builder allows Reflected XSS.This issue affects Business Template Blocks for WPBakery (Visual Composer) Page Builder: from n/a through <= 1.3.2.
Product
Business Template Blocks for WPBakery (Visual Composer) Page Builder
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Business Template Blocks for WPBakery (Visual Composer) Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Visitor Maps Extended Referer Field: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69389 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hugh Mungus Visitor Maps Extended Referer Field visitor-maps-extended-referer-field allows Reflected XSS.This issue affects Visitor Maps Extended Referer Field: from n/a through <= 1.2.6.
Product
Visitor Maps Extended Referer Field
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Visitor Maps Extended Referer Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026RVCFDI para Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69386 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realvirtualmx RVCFDI para Woocommerce rvcfdi-para-woocommerce allows Reflected XSS.This issue affects RVCFDI para Woocommerce: from n/a through <= 8.1.8.
Product
RVCFDI para Woocommerce
Affected
up to 8.1.8
What to do
Affects up to 8.1.8. Update RVCFDI para Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Timeline Event History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69384 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Timeline Event History timeline-event-history allows Reflected XSS.This issue affects Timeline Event History: from n/a through <= 3.2.
Product
Timeline Event History
Affected
up to 3.2
What to do
Affects up to 3.2. Update Timeline Event History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026SOHO - Photography: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69368 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes SOHO - Photography WordPress Theme soho allows DOM-Based XSS.This issue affects SOHO - Photography WordPress Theme: from n/a through <= 3.0.3.
Product
SOHO - Photography
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update SOHO - Photography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Oyster - Photography: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69367 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes Oyster - Photography WordPress Theme oyster allows DOM-Based XSS.This issue affects Oyster - Photography WordPress Theme: from n/a through <= 4.4.3.
Product
Oyster - Photography
Affected
up to 4.4.3
What to do
Affects up to 4.4.3. Update Oyster - Photography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Prestige: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69330 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jthemes Prestige prestige allows Reflected XSS.This issue affects Prestige: from n/a through < 1.4.1.
Product
Prestige
What to do
Update Prestige to the newest version.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026NEX-Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69326 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through <= 9.1.7.
Product
NEX-Forms
Affected
up to 9.1.7
What to do
Affects up to 9.1.7. Update NEX-Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026NEX-Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69324 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Stored XSS.This issue affects NEX-Forms: from n/a through <= 9.1.7.
Product
NEX-Forms
Affected
up to 9.1.7
What to do
Affects up to 9.1.7. Update NEX-Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Slimstat Analytics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69323 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs Slimstat Analytics wp-slimstat allows Reflected XSS.This issue affects Slimstat Analytics: from n/a through <= 5.3.2.
Product
Slimstat Analytics
Affected
up to 5.3.2
What to do
Affects up to 5.3.2. Update Slimstat Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026DesignThemes Core Features: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69302 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core Features designthemes-core-features allows Reflected XSS.This issue affects DesignThemes Core Features: from n/a through <= 2.3.
Product
DesignThemes Core Features
Affected
up to 2.3
What to do
Affects up to 2.3. Update DesignThemes Core Features to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Aardvark: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69296 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhostPool Aardvark aardvark allows Reflected XSS.This issue affects Aardvark: from n/a through <= 4.6.3.
Product
Aardvark
Affected
up to 4.6.3
What to do
Affects up to 4.6.3. Update Aardvark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Cool Tag Cloud: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69011 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Cool Tag Cloud cool-tag-cloud allows Stored XSS.This issue affects Cool Tag Cloud: from n/a through <= 2.29.
Product
Cool Tag Cloud
Affected
up to 2.29
What to do
Affects up to 2.29. Update Cool Tag Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Simple Archive Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68880 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Reflected XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.
Product
Simple Archive Generator
Affected
up to 5.2
What to do
Affects up to 5.2. Update Simple Archive Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026iContact for Gravity Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68863 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz iContact for Gravity Forms gravity-forms-icontact allows Reflected XSS.This issue affects iContact for Gravity Forms: from n/a through <= 1.3.2.
Product
iContact for Gravity Forms
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update iContact for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Mopinion Feedback Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68856 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in keeswolters Mopinion Feedback Form mopinion-feedback-form allows DOM-Based XSS.This issue affects Mopinion Feedback Form: from n/a through <= 1.1.1.
Product
Mopinion Feedback Form
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Mopinion Feedback Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026ID Arrays: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68854 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in harman79 ID Arrays id-arrays allows DOM-Based XSS.This issue affects ID Arrays: from n/a through <= 2.1.2.
Product
ID Arrays
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update ID Arrays to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Court Reservation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68852 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webmuehle Court Reservation court-reservation allows Reflected XSS.This issue affects Court Reservation: from n/a through <= 1.10.13.
Product
Court Reservation
Affected
up to 1.10.13
What to do
Affects up to 1.10.13. Update Court Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026amr cron manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68848 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anmari amr cron manager amr-cron-manager allows Reflected XSS.This issue affects amr cron manager: from n/a through <= 2.3.
Product
amr cron manager
Affected
up to 2.3
What to do
Affects up to 2.3. Update amr cron manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026iSape: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68847 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in itex iSape isape allows Reflected XSS.This issue affects iSape: from n/a through <= 0.72.
Product
iSape
Affected
up to 0.72
What to do
Affects up to 0.72. Update iSape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Asynchronous Javascript: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68846 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paris Holley Asynchronous Javascript asynchronous-javascript allows Reflected XSS.This issue affects Asynchronous Javascript: from n/a through <= 1.3.5.
Product
Asynchronous Javascript
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Asynchronous Javascript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026eDS Responsive Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68845 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Reflected XSS.This issue affects eDS Responsive Menu: from n/a through <= 1.2.
Product
eDS Responsive Menu
Affected
up to 1.2
What to do
Affects up to 1.2. Update eDS Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.