Vulnerability database

15,920 results · page 137 of 319

• Mar 31, 2025JetBlocks For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30987 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.16.

  Product

  JetBlocks For Elementor

  Affected

  up to 1.3.16

  What to do

  Affects up to 1.3.16. Update JetBlocks For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 29, 2025ElementsKit Elementor addons: Stored Cross-Site ScriptingCVE-2024-11180 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer Widget ekit_countdown_timer_title parameter in all versions up to, and including, 3.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  ElementsKit Elementor addons

  Affected

  up to 3.4.7

  What to do

  Affects up to 3.4.7. Update ElementsKit Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 28, 2025SimplyRETS Real Estate IDX: Cross-Site Request Forgery (CSRF)CVE-2025-31010 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets allows Cross Site Request Forgery.This issue affects SimplyRETS Real Estate IDX: from n/a through <= 3.0.5.

  Product

  SimplyRETS Real Estate IDX

  Affected

  up to 3.0.5

  What to do

  Affects up to 3.0.5. Update SimplyRETS Real Estate IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025GlobalPayments WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22767 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Global Payments GlobalPayments WooCommerce global-payments-woocommerce allows Reflected XSS.This issue affects GlobalPayments WooCommerce: from n/a through <= 1.13.2.

  Product

  GlobalPayments WooCommerce

  Affected

  up to 1.13.2

  What to do

  Affects up to 1.13.2. Update GlobalPayments WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025SUPER RESPONSIVE SLIDER: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22575 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendyourweb SUPER RESPONSIVE SLIDER super-slider allows Reflected XSS.This issue affects SUPER RESPONSIVE SLIDER: from n/a through <= 1.4.

  Product

  SUPER RESPONSIVE SLIDER

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update SUPER RESPONSIVE SLIDER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025ULTIMATE VIDEO GALLERY: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22566 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendyourweb ULTIMATE VIDEO GALLERY ultimate-gallery allows Reflected XSS.This issue affects ULTIMATE VIDEO GALLERY: from n/a through <= 1.4.

  Product

  ULTIMATE VIDEO GALLERY

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update ULTIMATE VIDEO GALLERY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025WP Azure offload: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22360 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in promact WP Azure offload wp-azure-offload allows Reflected XSS.This issue affects WP Azure offload: from n/a through <= 2.0.

  Product

  WP Azure offload

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update WP Azure offload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Stencies: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22356 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stencies Stencies stencies allows Reflected XSS.This issue affects Stencies: from n/a through <= 0.58.

  Product

  Stencies

  Affected

  up to 0.58

  What to do

  Affects up to 0.58. Update Stencies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Já-Já Pagamentos for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51624 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jajapagamentos Já-Já Pagamentos for WooCommerce wc-ja-ja-pagamentos-multicaixa-express allows Reflected XSS.This issue affects Já-Já Pagamentos for WooCommerce: from n/a through <= 1.3.0.

  Product

  Já-Já Pagamentos for WooCommerce

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Já-Já Pagamentos for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025WP Database Optimizer: Cross-Site Request Forgery (CSRF)CVE-2025-31474 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in matthewprice1178 WP Database Optimizer wp-database-optimizer allows Cross Site Request Forgery.This issue affects WP Database Optimizer: from n/a through <= 1.2.1.3.

  Product

  WP Database Optimizer

  Affected

  up to 1.2.1.3

  What to do

  Affects up to 1.2.1.3. Update WP Database Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025WP Database Optimizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31473 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthewprice1178 WP Database Optimizer wp-database-optimizer allows Stored XSS.This issue affects WP Database Optimizer: from n/a through <= 1.2.1.3.

  Product

  WP Database Optimizer

  Affected

  up to 1.2.1.3

  What to do

  Affects up to 1.2.1.3. Update WP Database Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Flatty: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31472 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michele Marri Flatty flatty-flat-admin-theme allows Stored XSS.This issue affects Flatty: from n/a through <= 2.0.0.

  Product

  Flatty

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Flatty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Duplicate Page and Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31471 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Falcon Solutions Duplicate Page and Post duplicate-post-and-page allows Stored XSS.This issue affects Duplicate Page and Post: from n/a through <= 1.0.

  Product

  Duplicate Page and Post

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Duplicate Page and Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Page Takeover: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31470 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FancyThemes Page Takeover page-takeover allows Stored XSS.This issue affects Page Takeover: from n/a through <= 1.1.6.

  Product

  Page Takeover

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Page Takeover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Better Section Navigation Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31465 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cornershop Better Section Navigation Widget better-section-navigation allows Stored XSS.This issue affects Better Section Navigation Widget: from n/a through <= 1.6.1.

  Product

  Better Section Navigation Widget

  Affected

  up to 1.6.1

  What to do

  Affects up to 1.6.1. Update Better Section Navigation Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Text Selection Color: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31464 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nazmur Rahman Text Selection Color text-selection-color allows Stored XSS.This issue affects Text Selection Color: from n/a through <= 1.6.

  Product

  Text Selection Color

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Text Selection Color to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025TGG WP Optimizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31463 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in preetindersodhi TGG WP Optimizer tgg-wp-optimizer allows Stored XSS.This issue affects TGG WP Optimizer: from n/a through <= 1.25.

  Product

  TGG WP Optimizer

  Affected

  up to 1.25

  What to do

  Affects up to 1.25. Update TGG WP Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025OmniLeads Scripts and Tags Manager: Cross-Site Request Forgery (CSRF)CVE-2025-31460 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in danielmuldernl OmniLeads Scripts and Tags Manager omnileads-scripts-and-tags-manager allows Stored XSS.This issue affects OmniLeads Scripts and Tags Manager: from n/a through <= 1.3.

  Product

  OmniLeads Scripts and Tags Manager

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update OmniLeads Scripts and Tags Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Login Alert: Cross-Site Request Forgery (CSRF)CVE-2025-31459 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in PasqualePuzio Login Alert login-alert allows Stored XSS.This issue affects Login Alert: from n/a through <= 0.2.1.

  Product

  Login Alert

  Affected

  up to 0.2.1

  What to do

  Affects up to 0.2.1. Update Login Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Video Embedder: Cross-Site Request Forgery (CSRF)CVE-2025-31458 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in forsgren Video Embedder video-embedder allows Stored XSS.This issue affects Video Embedder: from n/a through <= 1.7.1.

  Product

  Video Embedder

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update Video Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025LWS SMS: Cross-Site Request Forgery (CSRF)CVE-2025-31457 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Aurélien LWS LWS SMS lws-sms allows Cross Site Request Forgery.This issue affects LWS SMS: from n/a through <= 2.4.1.

  Product

  LWS SMS

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update LWS SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Ultimate Security Checker: Cross-Site Request Forgery (CSRF)CVE-2025-31456 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in bsndev Ultimate Security Checker ultimate-security-checker allows Cross Site Request Forgery.This issue affects Ultimate Security Checker: from n/a through <= 4.2.

  Product

  Ultimate Security Checker

  Affected

  up to 4.2

  What to do

  Affects up to 4.2. Update Ultimate Security Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025YouTube SimpleGallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31453 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stian Andreassen YouTube SimpleGallery youtube-simplegallery allows Stored XSS.This issue affects YouTube SimpleGallery: from n/a through <= 2.0.6.

  Product

  YouTube SimpleGallery

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update YouTube SimpleGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025WP Ultimate Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31452 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mindshare Labs, Inc. WP Ultimate Search wp-ultimate-search allows Stored XSS.This issue affects WP Ultimate Search: from n/a through <= 2.0.3.

  Product

  WP Ultimate Search

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update WP Ultimate Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025wBounce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31451 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kevinweber wBounce wbounce allows Stored XSS.This issue affects wBounce: from n/a through <= 1.8.1.

  Product

  wBounce

  Affected

  up to 1.8.1

  What to do

  Affects up to 1.8.1. Update wBounce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Toggle Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31450 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phantom.omaga Toggle Box toggle-box allows Stored XSS.This issue affects Toggle Box: from n/a through <= 1.6.

  Product

  Toggle Box

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Toggle Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025The Visitor Counter: Cross-Site Request Forgery (CSRF)CVE-2025-31449 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in EricH The Visitor Counter the-visitor-counter allows Stored XSS.This issue affects The Visitor Counter: from n/a through <= 1.4.3.

  Product

  The Visitor Counter

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update The Visitor Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Simple Trackback Disabler: Cross-Site Request Forgery (CSRF)CVE-2025-31448 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in misteraon Simple Trackback Disabler simple-trackback-disabler allows Cross Site Request Forgery.This issue affects Simple Trackback Disabler: from n/a through <= 1.4.

  Product

  Simple Trackback Disabler

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Simple Trackback Disabler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025NertWorks All in One Social Share Tools: Cross-Site Request Forgery (CSRF)CVE-2025-31447 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in nertworks NertWorks All in One Social Share Tools nertworks-all-in-one-social-share-tools allows Cross Site Request Forgery.This issue affects NertWorks All in One Social Share Tools: from n/a through <= 1.26.

  Product

  NertWorks All in One Social Share Tools

  Affected

  up to 1.26

  What to do

  Affects up to 1.26. Update NertWorks All in One Social Share Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025ShowTime Slideshow: Cross-Site Request Forgery (CSRF)CVE-2025-31444 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in youtag ShowTime Slideshow showtime-slideshow allows Stored XSS.This issue affects ShowTime Slideshow: from n/a through <= 1.6.

  Product

  ShowTime Slideshow

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update ShowTime Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025KK I Like It: Cross-Site Request Forgery (CSRF)CVE-2025-31443 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Krzysztof Furtak KK I Like It kk-i-like-it allows Stored XSS.This issue affects KK I Like It: from n/a through <= 1.7.5.3.

  Product

  KK I Like It

  Affected

  up to 1.7.5.3

  What to do

  Affects up to 1.7.5.3. Update KK I Like It to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Terms of Use: Cross-Site Request Forgery (CSRF)CVE-2025-31440 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Team Terms of Use terms-of-use-2 allows Stored XSS.This issue affects Terms of Use: from n/a through <= 2.0.

  Product

  Terms of Use

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Terms of Use to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Browser Caching with .htaccess: Cross-Site Request Forgery (CSRF)CVE-2025-31439 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in tobias_.MerZ Browser Caching with .htaccess allows Cross Site Request Forgery. This issue affects Browser Caching with .htaccess: from 1.2.1 through n/a.

  Product

  Browser Caching with .htaccess

  What to do

  Update Browser Caching with .htaccess to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025WP Supersized: Cross-Site Request Forgery (CSRF)CVE-2025-31438 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Benoit De Boeck WP Supersized wp-supersized allows Cross Site Request Forgery.This issue affects WP Supersized: from n/a through <= 3.1.6.

  Product

  WP Supersized

  Affected

  up to 3.1.6

  What to do

  Affects up to 3.1.6. Update WP Supersized to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025WP-OGP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31437 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Miller WP-OGP wp-ogp allows Stored XSS.This issue affects WP-OGP: from n/a through <= 1.0.5.

  Product

  WP-OGP

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update WP-OGP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Microblog Poster: Cross-Site Request Forgery (CSRF)CVE-2025-31435 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Efficient Scripts Microblog Poster microblog-poster allows Stored XSS.This issue affects Microblog Poster: from n/a through <= 2.1.6.

  Product

  Microblog Poster

  Affected

  up to 2.1.6

  What to do

  Affects up to 2.1.6. Update Microblog Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025FormLift for Infusionsoft Web Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31434 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms formlift allows Stored XSS.This issue affects FormLift for Infusionsoft Web Forms: from n/a through <= 7.5.19.

  Product

  FormLift for Infusionsoft Web Forms

  Affected

  up to 7.5.19

  What to do

  Affects up to 7.5.19. Update FormLift for Infusionsoft Web Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Magic Embeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31433 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Miguel Sirvent Magic Embeds wp-embed-facebook allows Stored XSS.This issue affects Magic Embeds: from n/a through <= 3.1.2.

  Product

  Magic Embeds

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update Magic Embeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Hostel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31102 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects Hostel: from n/a through <= 1.1.5.5.

  Product

  Hostel

  Affected

  up to 1.1.5.5

  What to do

  Affects up to 1.1.5.5. Update Hostel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025PostX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31096 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post allows DOM-Based XSS.This issue affects PostX: from n/a through <= 4.1.25.

  Product

  PostX

  Affected

  up to 4.1.25

  What to do

  Affects up to 4.1.25. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025WP Posts Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31094 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Stored XSS.This issue affects WP Posts Carousel: from n/a through <= 1.3.8.

  Product

  WP Posts Carousel

  Affected

  up to 1.3.8

  What to do

  Affects up to 1.3.8. Update WP Posts Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025RPS Include Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31093 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redpixelstudios RPS Include Content rps-include-content allows DOM-Based XSS.This issue affects RPS Include Content: from n/a through <= 1.2.1.

  Product

  RPS Include Content

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update RPS Include Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Dropdown Multisite selector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31090 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alordiel Dropdown Multisite selector dropdown-multisite-selector allows Stored XSS.This issue affects Dropdown Multisite selector: from n/a through < 0.9.4.

  Product

  Dropdown Multisite selector

  What to do

  Update Dropdown Multisite selector to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Paid Member Subscriptions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31088 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Stored XSS.This issue affects Paid Member Subscriptions: from n/a through <= 2.14.3.

  Product

  Paid Member Subscriptions

  Affected

  up to 2.14.3

  What to do

  Affects up to 2.14.3. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Leaky Paywall: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31083 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Stored XSS.This issue affects Leaky Paywall: from n/a through <= 4.21.7.

  Product

  Leaky Paywall

  Affected

  up to 4.21.7

  What to do

  Affects up to 4.21.7. Update Leaky Paywall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Usermaven: Cross-Site Request Forgery (CSRF)CVE-2025-31079 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in usermaven Usermaven usermaven allows Cross Site Request Forgery.This issue affects Usermaven: from n/a through <= 1.2.1.

  Product

  Usermaven

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Usermaven to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Ultimate Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31077 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows DOM-Based XSS.This issue affects Ultimate Blocks: from n/a through <= 3.2.7.

  Product

  Ultimate Blocks

  Affected

  up to 3.2.7

  What to do

  Affects up to 3.2.7. Update Ultimate Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Unlimited: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31073 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bensibley Unlimited unlimited allows Stored XSS.This issue affects Unlimited: from n/a through <= 1.45.

  Product

  Unlimited

  Affected

  up to 1.45

  What to do

  Affects up to 1.45. Update Unlimited to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025tagDiv Composer: Cross-Site Request ForgeryCVE-2025-1705 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The tagDiv Composer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due to missing or incorrect nonce validation within the td_ajax_get_views AJAX action. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  tagDiv Composer

  Affected

  up to 5.3

  What to do

  Affects up to 5.3. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordtagdiv.comtagdiv.com

• Mar 28, 2025The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_usernamCVE-2025-2804 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_username' parameters in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Affected

  up to 5.3

  What to do

  Affects up to 5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordtagdiv.comwordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.