Vulnerability database

15,531 results · page 153 of 311

• Feb 4, 2025WP Dream Carousel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13331 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The WP Dream Carousel WordPress plugin through 1.0.1b does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

  Product

  WP Dream Carousel

  Affected

  up to 1.0.1b

  What to do

  Affects up to 1.0.1b. Update WP Dream Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Feb 4, 2025JustRows free: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13330 · WordPress plugins & themes · reported by WPScanHigh 7.1

  The JustRows free WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

  Product

  JustRows free

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update JustRows free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Feb 4, 2025Solidres: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13329 · WordPress plugins & themes · reported by WPScanHigh 7.1

  The Solidres WordPress plugin through 0.9.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

  Product

  Solidres

  Affected

  up to 0.9.4

  What to do

  Affects up to 0.9.4. Update Solidres to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Feb 4, 2025Giga Messenger: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13328 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Giga Messenger WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

  Product

  Giga Messenger

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update Giga Messenger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Feb 4, 2025Musicbox: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13327 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

  Product

  Musicbox

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update Musicbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Feb 4, 2025iBuildApp: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13326 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

  Product

  iBuildApp

  Affected

  up to 0.2.0

  What to do

  Affects up to 0.2.0. Update iBuildApp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Feb 4, 2025Glossy: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13325 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Glossy WordPress plugin through 2.3.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

  Product

  Glossy

  Affected

  up to 2.3.5

  What to do

  Affects up to 2.3.5. Update Glossy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Feb 4, 2025WP Projects Portfolio with Client Testimonials: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13114 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

  Product

  WP Projects Portfolio with Client Testimonials

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update WP Projects Portfolio with Client Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Feb 3, 2025Eventer: Stored Cross-Site ScriptingCVE-2024-11132 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Eventer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.9.9.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Eventer

  Affected

  up to 3.9.9.4

  What to do

  Affects up to 3.9.9.4. Update Eventer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodecanyon.networdfence.com

• Feb 3, 2025WPJobBoard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24781 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WPJobBoard allows Reflected XSS. This issue affects WPJobBoard: from n/a through 5.10.1.

  Product

  WPJobBoard

  Affected

  up to 5.10.1

  What to do

  Affects up to 5.10.1. Update WPJobBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24707 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Reflected XSS.This issue affects Photo Gallery: from n/a through <= 2.7.7.24.

  Product

  Photo Gallery

  Affected

  up to 2.7.7.24

  What to do

  Affects up to 2.7.7.24. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Media Downloader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24684 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ederson Peka Media Downloader media-downloader allows Reflected XSS.This issue affects Media Downloader: from n/a through <= 0.4.7.5.

  Product

  Media Downloader

  Affected

  up to 0.4.7.5

  What to do

  Affects up to 0.4.7.5. Update Media Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Custom WP Store Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24676 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in umangmetatagg Custom WP Store Locator custom-store-locator allows Reflected XSS.This issue affects Custom WP Store Locator: from n/a through <= 1.4.7.

  Product

  Custom WP Store Locator

  Affected

  up to 1.4.7

  What to do

  Affects up to 1.4.7. Update Custom WP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Simple Membership Custom Messages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24660 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership Custom Messages simple-membership-custom-messages allows Reflected XSS.This issue affects Simple Membership Custom Messages: from n/a through <= 2.4.

  Product

  Simple Membership Custom Messages

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update Simple Membership Custom Messages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Realtyna Provisioning: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24656 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Realtyna Realtyna Provisioning realtyna-provisioning allows Reflected XSS.This issue affects Realtyna Provisioning: from n/a through <= 1.2.2.

  Product

  Realtyna Provisioning

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Realtyna Provisioning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025XML for Avito: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24646 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc XML for Avito xml-for-avito allows Reflected XSS.This issue affects XML for Avito: from n/a through <= 2.5.2.

  Product

  XML for Avito

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update XML for Avito to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025BP Email Assign Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24631 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Reflected XSS.This issue affects BP Email Assign Templates: from n/a through <= 1.5.

  Product

  BP Email Assign Templates

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update BP Email Assign Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Sikshya LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24630 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MantraBrain Sikshya LMS sikshya allows Reflected XSS.This issue affects Sikshya LMS: from n/a through <= 0.0.21.

  Product

  Sikshya LMS

  Affected

  up to 0.0.21

  What to do

  Affects up to 0.0.21. Update Sikshya LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Import Excel to Gravity Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24629 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpgear Import Excel to Gravity Forms gf-excel-import allows Reflected XSS.This issue affects Import Excel to Gravity Forms: from n/a through <= 1.18.

  Product

  Import Excel to Gravity Forms

  Affected

  up to 1.18

  What to do

  Affects up to 1.18. Update Import Excel to Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025AIO Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24620 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hkharpreetkumar1 AIO Shortcodes aio-shortcodes allows Stored XSS.This issue affects AIO Shortcodes: from n/a through <= 1.3.

  Product

  AIO Shortcodes

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update AIO Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Landing Page Cat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24576 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Landing Page Cat landing-page-cat allows Reflected XSS.This issue affects Landing Page Cat: from n/a through <= 1.7.7.

  Product

  Landing Page Cat

  Affected

  up to 1.7.7

  What to do

  Affects up to 1.7.7. Update Landing Page Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025PeproDev WooCommerce Receipt Uploader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24574 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev WooCommerce Receipt Uploader pepro-bacs-receipt-upload-for-woocommerce allows Reflected XSS.This issue affects PeproDev WooCommerce Receipt Uploader: from n/a through <= 2.6.9.

  Product

  PeproDev WooCommerce Receipt Uploader

  Affected

  up to 2.6.9

  What to do

  Affects up to 2.6.9. Update PeproDev WooCommerce Receipt Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025WP Mailster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24559 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.This issue affects WP Mailster: from n/a through <= 1.8.15.0.

  Product

  WP Mailster

  Affected

  up to 1.8.15.0

  What to do

  Affects up to 1.8.15.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025PlainInventory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24557 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware PlainInventory z-inventory-manager allows Reflected XSS.This issue affects PlainInventory: from n/a through <= 3.1.5.

  Product

  PlainInventory

  Affected

  up to 3.1.5

  What to do

  Affects up to 3.1.5. Update PlainInventory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025BSK Forms Validation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24545 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK Forms Validation bsk-gravity-forms-custom-validation allows Reflected XSS.This issue affects BSK Forms Validation: from n/a through <= 1.7.

  Product

  BSK Forms Validation

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update BSK Forms Validation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Bitcoin and Altcoin Wallets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24544 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashed-slug.net Bitcoin and Altcoin Wallets wallets allows Reflected XSS.This issue affects Bitcoin and Altcoin Wallets: from n/a through <= 6.3.1.

  Product

  Bitcoin and Altcoin Wallets

  Affected

  up to 6.3.1

  What to do

  Affects up to 6.3.1. Update Bitcoin and Altcoin Wallets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025DK White Label: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24541 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dinamiko DK White Label dk-white-label allows Reflected XSS.This issue affects DK White Label: from n/a through <= 1.0.

  Product

  DK White Label

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update DK White Label to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025ThriveDesk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24536 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThriveDesk ThriveDesk thrivedesk allows Reflected XSS.This issue affects ThriveDesk: from n/a through <= 2.0.6.

  Product

  ThriveDesk

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update ThriveDesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Dynamic URL SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23984 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainvireinfo Dynamic URL SEO dynamic-url-seo allows Reflected XSS.This issue affects Dynamic URL SEO: from n/a through <= 1.0.

  Product

  Dynamic URL SEO

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Dynamic URL SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Lockets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23923 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wackey Lockets lockets allows Reflected XSS.This issue affects Lockets: from n/a through <= 0.999.

  Product

  Lockets

  Affected

  up to 0.999

  What to do

  Affects up to 0.999. Update Lockets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025ApplicantPro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23920 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sourcing Team ApplicantPro applicantpro allows Reflected XSS.This issue affects ApplicantPro: from n/a through <= 1.3.9.

  Product

  ApplicantPro

  Affected

  up to 1.3.9

  What to do

  Affects up to 1.3.9. Update ApplicantPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025.TUBE Video Curator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23799 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tubegtld .TUBE Video Curator tube-video-curator allows Reflected XSS.This issue affects .TUBE Video Curator: from n/a through <= 1.1.9.

  Product

  .TUBE Video Curator

  Affected

  up to 1.1.9

  What to do

  Affects up to 1.1.9. Update .TUBE Video Curator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025PAFacile: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23755 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tosend.it PAFacile pafacile allows Reflected XSS.This issue affects PAFacile: from n/a through <= 2.6.1.

  Product

  PAFacile

  Affected

  up to 2.6.1

  What to do

  Affects up to 2.6.1. Update PAFacile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Awesome Timeline: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23747 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nitesh Awesome Timeline awesome-timeline allows Stored XSS.This issue affects Awesome Timeline: from n/a through <= 1.0.1.

  Product

  Awesome Timeline

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Awesome Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025RomanCart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23685 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebTechGlobal RomanCart romancart-on-wordpress allows Reflected XSS.This issue affects RomanCart: from n/a through <= 0.0.2.

  Product

  RomanCart

  Affected

  up to 0.0.2

  What to do

  Affects up to 0.0.2. Update RomanCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025WordPress Additional Logins: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23614 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in niksudan WordPress Additional Logins wp-additional-logins allows Reflected XSS.This issue affects WordPress Additional Logins: from n/a through <= 1.0.0.

  Product

  WordPress Additional Logins

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update WordPress Additional Logins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025eMarksheet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23599 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aarvansh Infotech eMarksheet emarksheet allows Reflected XSS.This issue affects eMarksheet: from n/a through <= 5.4.3.

  Product

  eMarksheet

  Affected

  up to 5.4.3

  What to do

  Affects up to 5.4.3. Update eMarksheet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Google Map With Fancybox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23594 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uzzal Mondal Google Map With Fancybox location-piker allows Reflected XSS.This issue affects Google Map With Fancybox: from n/a through <= 2.1.0.

  Product

  Google Map With Fancybox

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Google Map With Fancybox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025EmailPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23593 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kvvaradha EmailPress emailpress allows Reflected XSS.This issue affects EmailPress: from n/a through <= 1.0.

  Product

  EmailPress

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update EmailPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025blu Logistics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23591 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blulogistics1 blu Logistics blu-logistics allows Reflected XSS.This issue affects blu Logistics: from n/a through <= 1.0.0.

  Product

  blu Logistics

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update blu Logistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Dezdy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23590 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dezdy.com Dezdy dezdy-mcommerce allows Reflected XSS.This issue affects Dezdy: from n/a through <= 1.0.

  Product

  Dezdy

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Dezdy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025WOW Best CSS Compiler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23588 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in baonguyenyam WOW Best CSS Compiler best-css-compiler allows Reflected XSS.This issue affects WOW Best CSS Compiler: from n/a through <= 2.0.2.

  Product

  WOW Best CSS Compiler

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update WOW Best CSS Compiler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Bulk Categories Assign: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23582 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Haider Ali Bulk Categories Assign bulk-categories-assign allows Reflected XSS.This issue affects Bulk Categories Assign: from n/a through <= 1.0.

  Product

  Bulk Categories Assign

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Bulk Categories Assign to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Demo User DZS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23581 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalzoomstudio Demo User DZS demo-user-dzs-showcase-your-admin-safely allows Stored XSS.This issue affects Demo User DZS: from n/a through <= 1.1.0.

  Product

  Demo User DZS

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Demo User DZS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025MLL Audio Player MP3 Ajax: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23561 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robertkay MLL Audio Player MP3 Ajax music-let-loose-mp3-audio-player allows Stored XSS.This issue affects MLL Audio Player MP3 Ajax: from n/a through <= 0.7.

  Product

  MLL Audio Player MP3 Ajax

  Affected

  up to 0.7

  What to do

  Affects up to 0.7. Update MLL Audio Player MP3 Ajax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025VSTEMPLATE Creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23491 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikash Srivastava VSTEMPLATE Creator vstemplate-creator allows Reflected XSS.This issue affects VSTEMPLATE Creator: from n/a through <= 2.0.2.

  Product

  VSTEMPLATE Creator

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update VSTEMPLATE Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Catalog Importer, Scraper & Crawler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22775 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in idiatech Catalog Importer, Scraper & Crawler intelligent-importer allows Reflected XSS.This issue affects Catalog Importer, Scraper & Crawler: from n/a through <= 5.1.3.

  Product

  Catalog Importer, Scraper & Crawler

  Affected

  up to 5.1.3

  What to do

  Affects up to 5.1.3. Update Catalog Importer, Scraper & Crawler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025WordPress Signature: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22704 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abinav Thakuri WordPress Signature wordpress-signature allows Reflected XSS.This issue affects WordPress Signature: from n/a through <= 0.1.

  Product

  WordPress Signature

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update WordPress Signature to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025WP BASE Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22684 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hakan Ozevin WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Stored XSS.This issue affects WP BASE Booking: from n/a through <= 5.0.0.

  Product

  WP BASE Booking

  Affected

  up to 5.0.0

  What to do

  Affects up to 5.0.0. Update WP BASE Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025NotificationX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22683 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper NotificationX notificationx allows Stored XSS.This issue affects NotificationX: from n/a through <= 2.9.5.

  Product

  NotificationX

  Affected

  up to 2.9.5

  What to do

  Affects up to 2.9.5. Update NotificationX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.