Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

356new WordPress flaws this week

394,273entries in the database

15,495 results · page 139 of 310

Mar 25, 2025Simple Banner: Does not sanitise and escape some of its settingsCVE-2024-12769 · WordPress plugins & themes · reported by WPScanLow 3.5
The Simple Banner WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Simple Banner
Fixed in
3.0.4
What to do
Update Simple Banner to 3.0.4 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Smart Maintenance Mode: Does not sanitise and escape some of its settingsCVE-2024-12682 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Smart Maintenance Mode
Fixed in
1.5.2
What to do
Update Smart Maintenance Mode to 1.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025WP Tabs: Does not sanitise and escape some of its settingsCVE-2024-11503 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Tabs WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WP Tabs
Fixed in
2.2.7
What to do
Update WP Tabs to 2.2.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Contact Form & SMTP Plugin for WordPress by PirateForms: Does not sanitise and escape some of its settingsCVE-2024-11273 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Contact Form & SMTP Plugin for WordPress by PirateForms
Fixed in
2.6.0
What to do
Update Contact Form & SMTP Plugin for WordPress by PirateForms to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Contact Form & SMTP Plugin for WordPress by PirateForms: Does not sanitise and escape some of its settingsCVE-2024-11272 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Contact Form & SMTP Plugin for WordPress by PirateForms
Fixed in
2.6.0
What to do
Update Contact Form & SMTP Plugin for WordPress by PirateForms to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Registrations for the Events Calendar: Does not sanitise and escape some of its settingsCVE-2024-10703 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Registrations for the Events Calendar
Fixed in
2.13.4
What to do
Update Registrations for the Events Calendar to 2.13.4 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Quiz and Survey Master (QSM): Does not sanitise and escape some of its settingsCVE-2024-10679 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Quiz and Survey Master (QSM)
Fixed in
9.2.1
What to do
Update Quiz and Survey Master (QSM) to 9.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Slider by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10566 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Slider by 10Web
Fixed in
1.2.62
What to do
Update Slider by 10Web to 1.2.62 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Slider by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10565 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Slider by 10Web
Fixed in
1.2.62
What to do
Update Slider by 10Web to 1.2.62 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10560 · WordPress plugins & themes · reported by WPScanLow 3.5
The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Form Maker by 10Web
Fixed in
1.15.30
What to do
Update Form Maker by 10Web to 1.15.30 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025WordPress WP-Advanced-Search: Does not sanitise and escape some of its settingsCVE-2024-10554 · WordPress plugins & themes · reported by WPScanLow 3.5
The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WordPress WP-Advanced-Search
Fixed in
3.3.9.3
What to do
Update WordPress WP-Advanced-Search to 3.3.9.3 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Stylish Price List: Does not sanitise and escape some of its settingsCVE-2024-10472 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Stylish Price List WordPress plugin before 7.1.12 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Stylish Price List
Fixed in
7.1.12
What to do
Update Stylish Price List to 7.1.12 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Job Postings: Does not sanitise and escape some of its settingsCVE-2024-10105 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Job Postings
Fixed in
2.7.11
What to do
Update Job Postings to 2.7.11 or newer.
Full record and what to do →NVD record wpscan.com
Mar 24, 2025wA11y – The Web Accessibility Toolbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30623 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry wA11y – The Web Accessibility Toolbox wa11y allows Stored XSS.This issue affects wA11y – The Web Accessibility Toolbox: from n/a through <= 1.0.3.
Product
wA11y – The Web Accessibility Toolbox
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update wA11y – The Web Accessibility Toolbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025WP Social Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through <= 2.2.7.
Product
WP Social Widget
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update WP Social Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Easy Page Transition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30606 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Logan Carlile Easy Page Transition easy-page-transition allows Stored XSS.This issue affects Easy Page Transition: from n/a through <= 1.0.1.
Product
Easy Page Transition
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Easy Page Transition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Related Posts via Categories: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30602 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alphasis Related Posts via Categories related-posts-via-categories allows Stored XSS.This issue affects Related Posts via Categories: from n/a through <= 2.1.2.
Product
Related Posts via Categories
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Related Posts via Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025WP Hotjar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30600 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thiagogsrwp WP Hotjar wp-hotjar allows Stored XSS.This issue affects WP Hotjar: from n/a through <= 0.0.3.
Product
WP Hotjar
Affected
up to 0.0.3
What to do
Affects up to 0.0.3. Update WP Hotjar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025WP Parallax Content Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30599 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp-maverick WP Parallax Content Slider wp-parallax-content-slider allows Stored XSS.This issue affects WP Parallax Content Slider: from n/a through <= 0.9.8.
Product
WP Parallax Content Slider
Affected
up to 0.9.8
What to do
Affects up to 0.9.8. Update WP Parallax Content Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025IG Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30597 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iografica IG Shortcodes ig-shortcodes allows DOM-Based XSS.This issue affects IG Shortcodes: from n/a through <= 3.1.
Product
IG Shortcodes
Affected
up to 3.1
What to do
Affects up to 3.1. Update IG Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025include-file: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30595 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tstafford include-file include-file allows Stored XSS.This issue affects include-file: from n/a through <= 1.
Product
include-file
Affected
up to 1
What to do
Affects up to 1. Update include-file to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Include URL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30593 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in samsk Include URL include-url allows Stored XSS.This issue affects Include URL: from n/a through <= 0.3.5.
Product
Include URL
Affected
up to 0.3.5
What to do
Affects up to 0.3.5. Update Include URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Login Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30575 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly Login Redirect login-redirect allows Stored XSS.This issue affects Login Redirect: from n/a through <= 1.0.5.
Product
Login Redirect
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Mobile Navigation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30574 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jenst Mobile Navigation mobile-navigation allows Stored XSS.This issue affects Mobile Navigation: from n/a through <= 1.5.
Product
Mobile Navigation
Affected
up to 1.5
What to do
Affects up to 1.5. Update Mobile Navigation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025My Default Post Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30573 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mrdenny My Default Post Content my-default-post-content allows Stored XSS.This issue affects My Default Post Content: from n/a through <= 0.7.3.
Product
My Default Post Content
Affected
up to 0.7.3
What to do
Affects up to 0.7.3. Update My Default Post Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Simple Rating: Cross-Site Request Forgery (CSRF)CVE-2025-30572 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Igor Yavych Simple Rating simple-rating allows Stored XSS.This issue affects Simple Rating: from n/a through <= 1.4.
Product
Simple Rating
Affected
up to 1.4
What to do
Affects up to 1.4. Update Simple Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Clink: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30566 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aryan Themes Clink clink allows DOM-Based XSS.This issue affects Clink: from n/a through <= 1.2.2.
Product
Clink
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Clink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025GMO Font Agent: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30553 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Z.com byGMO GMO Font Agent gmo-font-agent allows Stored XSS.This issue affects GMO Font Agent: from n/a through <= 1.6.
Product
GMO Font Agent
Affected
up to 1.6
What to do
Affects up to 1.6. Update GMO Font Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Pretty file links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30551 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartredfox Pretty file links pretty-file-links allows Stored XSS.This issue affects Pretty file links: from n/a through <= 0.9.
Product
Pretty file links
Affected
up to 0.9
What to do
Affects up to 0.9. Update Pretty file links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025issuuPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30545 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline issuuPress issuupress allows Stored XSS.This issue affects issuuPress: from n/a through <= 1.3.2.
Product
issuuPress
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update issuuPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025AvaiBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30540 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in avaibook AvaiBook avaibook allows Stored XSS.This issue affects AvaiBook: from n/a through <= 1.2.
Product
AvaiBook
Affected
up to 1.2
What to do
Affects up to 1.2. Update AvaiBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025BMo Expo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30539 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benedikt Mo BMo Expo bmo-expo allows Stored XSS.This issue affects BMo Expo: from n/a through <= 1.0.15.
Product
BMo Expo
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update BMo Expo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Upload Quota per User: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30537 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristian Sarov Upload Quota per User upload-quota-per-user allows Stored XSS.This issue affects Upload Quota per User: from n/a through <= 1.3.
Product
Upload Quota per User
Affected
up to 1.3
What to do
Affects up to 1.3. Update Upload Quota per User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Beautiful Link Preview: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30536 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zeitwesentech Beautiful Link Preview beautiful-link-preview allows Stored XSS.This issue affects Beautiful Link Preview: from n/a through <= 1.5.0.
Product
Beautiful Link Preview
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Beautiful Link Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Message ticker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30533 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Message ticker message-ticker allows Stored XSS.This issue affects Message ticker: from n/a through <= 9.3.
Product
Message ticker
Affected
up to 9.3
What to do
Affects up to 9.3. Update Message ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Weather Layer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30532 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MorganF Weather Layer weather-layer allows Stored XSS.This issue affects Weather Layer: from n/a through <= 4.2.1.
Product
Weather Layer
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Weather Layer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025AI Preloader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30530 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atikul AI Preloader ai-preloader allows Stored XSS.This issue affects AI Preloader: from n/a through <= 1.0.2.
Product
AI Preloader
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update AI Preloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025My Bootstrap Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30527 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetoolbox My Bootstrap Menu my-bootstrap-menu allows Stored XSS.This issue affects My Bootstrap Menu: from n/a through <= 1.2.1.
Product
My Bootstrap Menu
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update My Bootstrap Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Slider, Gallery, and Carousel by MetaSlider: Does not sanitise and escape some of its settingsCVE-2025-1203 · WordPress plugins & themes · reported by WPScanLow 3.5
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Slider, Gallery, and Carousel by MetaSlider
Fixed in
3.95.0
What to do
Update Slider, Gallery, and Carousel by MetaSlider to 3.95.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 24, 2025Slider, Gallery, and Carousel by MetaSlider: Does not sanitise and escape some of its settingsCVE-2025-1062 · WordPress plugins & themes · reported by WPScanLow 3.5
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Slider, Gallery, and Carousel by MetaSlider
Fixed in
3.95.0
What to do
Update Slider, Gallery, and Carousel by MetaSlider to 3.95.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 24, 2025Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-13124 · WordPress plugins & themes · reported by WPScanLow 3.5
The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery by 10Web
Fixed in
1.8.33
What to do
Update Photo Gallery by 10Web to 1.8.33 or newer.
Full record and what to do →NVD record wpscan.com
Mar 24, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10558 · WordPress plugins & themes · reported by WPScanLow 3.5
The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Form Maker by 10Web
Fixed in
1.15.30
What to do
Update Form Maker by 10Web to 1.15.30 or newer.
Full record and what to do →NVD record wpscan.com
Mar 23, 2025Nested Pages: Does not sanitise and escape some of its settingsCVE-2025-0718 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nested Pages WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Nested Pages
Fixed in
3.2.13
What to do
Update Nested Pages to 3.2.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 22, 2025Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: SQL InjectionCVE-2025-2186 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to SQL Injection via the ‘automationId’ parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 22, 2025Bitspecter Suite: Stored Cross-Site ScriptingCVE-2025-2577 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bitspecter Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Bitspecter Suite
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Bitspecter Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Mar 22, 2025Multi Video Box: Reflected Cross-Site ScriptingCVE-2025-2484 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Multi Video Box plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'video_id' and 'group_id' parameters in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Multi Video Box
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Multi Video Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 22, 2025Gotcha | Gesture-based Captcha: Reflected Cross-Site ScriptingCVE-2025-2482 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Gotcha | Gesture-based Captcha plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menu' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Gotcha | Gesture-based Captcha
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Gotcha | Gesture-based Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 22, 2025Easy Custom Admin Bar: Reflected Cross-Site ScriptingCVE-2025-2479 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Custom Admin Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘msg’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Easy Custom Admin Bar
Affected
up to 1.0
What to do
Affects up to 1.0. Update Easy Custom Admin Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 22, 2025CryoKey: Reflected Cross-Site ScriptingCVE-2025-2477 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The CryoKey plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ckemail’ parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
CryoKey
Affected
up to 2.4
What to do
Affects up to 2.4. Update CryoKey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 22, 2025Newsletters: Reflected Cross-Site ScriptingCVE-2024-13739 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the "to" parameter in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link.
Product
Newsletters
Affected
up to 4.9.9.7
What to do
Affects up to 4.9.9.7. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.