Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,150entries in the database

15,923 results · page 154 of 319

Feb 14, 2025URL Shortener | Conversion Tracking | AB Testing | WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23789 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat URL Shortener | Conversion Tracking | AB Testing | WooCommerce easy-broken-link-checker allows Reflected XSS.This issue affects URL Shortener | Conversion Tracking | AB Testing | WooCommerce: from n/a through <= 9.0.2.
Product
URL Shortener | Conversion Tracking | AB Testing | WooCommerce
Affected
up to 9.0.2
What to do
Affects up to 9.0.2. Update URL Shortener | Conversion Tracking | AB Testing | WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Easy Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23788 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roni Saha Easy Filter easy-filter allows Reflected XSS.This issue affects Easy Filter: from n/a through <= 1.10.
Product
Easy Filter
Affected
up to 1.10
What to do
Affects up to 1.10. Update Easy Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Easy Bet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23787 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foxskav Easy Bet easy-bet allows Reflected XSS.This issue affects Easy Bet: from n/a through <= 1.0.7.
Product
Easy Bet
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Easy Bet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Email to Download: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23786 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Email to Download email-to-download allows Reflected XSS.This issue affects Email to Download: from n/a through <= 3.1.0.
Product
Email to Download
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Email to Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Data Dash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23751 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Data Dash data-dash allows Reflected XSS.This issue affects Data Dash: from n/a through <= 1.2.3.
Product
Data Dash
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Data Dash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Custom Widget Creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23750 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devbunchuk Custom Widget Creator custom-widget-creator allows Reflected XSS.This issue affects Custom Widget Creator: from n/a through <= 1.0.5.
Product
Custom Widget Creator
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Custom Widget Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Singsys -Awesome Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23748 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Singsys Singsys -Awesome Gallery awesome-gallery-singsys allows Reflected XSS.This issue affects Singsys -Awesome Gallery: from n/a through <= 1.0.
Product
Singsys -Awesome Gallery
Affected
up to 1.0
What to do
Affects up to 1.0. Update Singsys -Awesome Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Podamibe Twilio Private Call: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23742 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podamibe Nepal Podamibe Twilio Private Call podamibe-twilio-private-call allows Reflected XSS.This issue affects Podamibe Twilio Private Call: from n/a through <= 1.0.1.
Product
Podamibe Twilio Private Call
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Podamibe Twilio Private Call to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Advanced Angular Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23658 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tauhidul Alam Advanced Angular Contact Form advanced-angular-contact-form allows Reflected XSS.This issue affects Advanced Angular Contact Form: from n/a through <= 1.1.0.
Product
Advanced Angular Contact Form
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Advanced Angular Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025WordPress-to-candidate for Salesforce CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23657 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RusAlex WordPress-to-candidate for Salesforce CRM salesforce-wordpress-to-candidate allows Reflected XSS.This issue affects WordPress-to-candidate for Salesforce CRM: from n/a through <= 1.0.1.
Product
WordPress-to-candidate for Salesforce CRM
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WordPress-to-candidate for Salesforce CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Contact Form 7 – Paystack Add-on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23655 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crystalwebpro Contact Form 7 – Paystack Add-on cf7-paystack-add-on allows Reflected XSS.This issue affects Contact Form 7 – Paystack Add-on: from n/a through <= 1.2.3.
Product
Contact Form 7 – Paystack Add-on
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Contact Form 7 – Paystack Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Form To Online Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23653 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nabeel Tahir Form To Online Booking cf7-calendly-integration allows Reflected XSS.This issue affects Form To Online Booking: from n/a through <= 1.0.
Product
Form To Online Booking
Affected
up to 1.0
What to do
Affects up to 1.0. Update Form To Online Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Add custom content after post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23652 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fabio Zuanon Add custom content after post add-custom-content-after-post allows Reflected XSS.This issue affects Add custom content after post: from n/a through <= 1.0.
Product
Add custom content after post
Affected
up to 1.0
What to do
Affects up to 1.0. Update Add custom content after post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Scroll Top: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23651 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in adamskaat Scroll Top scroll-to-top-builder allows Reflected XSS.This issue affects Scroll Top: from n/a through <= 1.3.3.
Product
Scroll Top
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Scroll Top to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Tidy.ro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23650 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in razvypp Tidy.ro tidyro allows Reflected XSS.This issue affects Tidy.ro: from n/a through <= 1.3.
Product
Tidy.ro
Affected
up to 1.3
What to do
Affects up to 1.3. Update Tidy.ro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025AdsMiddle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23648 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wjharil AdsMiddle adsmiddle allows Reflected XSS.This issue affects AdsMiddle: from n/a through <= 1.0.
Product
AdsMiddle
Affected
up to 1.0
What to do
Affects up to 1.0. Update AdsMiddle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025WP-Clap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23647 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ariagle WP-Clap wp-clap allows Reflected XSS.This issue affects WP-Clap: from n/a through <= 1.5.
Product
WP-Clap
Affected
up to 1.5
What to do
Affects up to 1.5. Update WP-Clap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Library Instruction Recorder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23646 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Brooks Library Instruction Recorder library-instruction-recorder allows Reflected XSS.This issue affects Library Instruction Recorder: from n/a through <= 1.1.4.
Product
Library Instruction Recorder
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Library Instruction Recorder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Recip.ly: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23598 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in craig.edmunds@gmail.com Recip.ly reciply allows Reflected XSS.This issue affects Recip.ly: from n/a through <= 1.1.8.
Product
Recip.ly
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Recip.ly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Internal Links Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23571 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in makong Internal Links Generator internal-links-generator allows Reflected XSS.This issue affects Internal Links Generator: from n/a through <= 3.51.
Product
Internal Links Generator
Affected
up to 3.51
What to do
Affects up to 3.51. Update Internal Links Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025WP Login Attempt Log: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23568 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fredsted WP Login Attempt Log wp-login-attempt-log allows Reflected XSS.This issue affects WP Login Attempt Log: from n/a through <= 1.3.
Product
WP Login Attempt Log
Affected
up to 1.3
What to do
Affects up to 1.3. Update WP Login Attempt Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Kv Compose Email From Dashboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23525 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kvvaradha Kv Compose Email From Dashboard kv-send-email-from-admin allows Reflected XSS.This issue affects Kv Compose Email From Dashboard: from n/a through <= 1.1.
Product
Kv Compose Email From Dashboard
Affected
up to 1.1
What to do
Affects up to 1.1. Update Kv Compose Email From Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025HSS Embed Streaming Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23523 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoststreamsell HSS Embed Streaming Video hss-embed-streaming-video allows Reflected XSS.This issue affects HSS Embed Streaming Video: from n/a through <= 3.23.
Product
HSS Embed Streaming Video
Affected
up to 3.23
What to do
Affects up to 3.23. Update HSS Embed Streaming Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025WordPress 淘宝客插件: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23492 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CantonBolo WordPress 淘宝客插件 taobaoke allows Reflected XSS.This issue affects WordPress 淘宝客插件: from n/a through <= 1.1.2.
Product
WordPress 淘宝客插件
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WordPress 淘宝客插件 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Live Dashboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23474 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mike Martel Live Dashboard live-dashboard allows Reflected XSS.This issue affects Live Dashboard: from n/a through <= 0.3.3.
Product
Live Dashboard
Affected
up to 0.3.3
What to do
Affects up to 0.3.3. Update Live Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Envato Affiliater: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23431 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khaninejad Envato Affiliater envato-affiliater allows Reflected XSS.This issue affects Envato Affiliater: from n/a through <= 1.2.4.
Product
Envato Affiliater
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Envato Affiliater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025QMean – WordPress Did You Mean: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23428 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arash Safari QMean – WordPress Did You Mean qmean allows Reflected XSS.This issue affects QMean – WordPress Did You Mean: from n/a through <= 2.0.
Product
QMean – WordPress Did You Mean
Affected
up to 2.0
What to do
Affects up to 2.0. Update QMean – WordPress Did You Mean to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Disqus Popular Posts: Cross-Site Request Forgery (CSRF)CVE-2025-22705 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in godthor Disqus Popular Posts disqus-popular-posts allows Reflected XSS.This issue affects Disqus Popular Posts: from n/a through <= 2.1.1.
Product
Disqus Popular Posts
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Disqus Popular Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce: Stored Cross-Site ScriptingCVE-2024-13735 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.11.2 due to insufficient input sanitization and output escaping of a campaign name. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce
Affected
up to 2.11.2
What to do
Affects up to 2.11.2. Update HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.hurrytimer.com plugins.trac.wordpress.org
Feb 14, 2025Qubely – Advanced Gutenberg Blocks: Stored Cross-Site ScriptingCVE-2024-9601 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2025-26767 is a duplicate of this issue.
Product
Qubely – Advanced Gutenberg Blocks
Affected
up to 1.8.12
What to do
Affects up to 1.8.12. Update Qubely – Advanced Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 13, 2025TinyMCE Advanced qTranslate fix editor problems: Cross-Site Request Forgery (CSRF)CVE-2025-26582 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Blackbam TinyMCE Advanced qTranslate fix editor problems tinymce-advanced-qtranslate-fix-editor-problems allows Stored XSS.This issue affects TinyMCE Advanced qTranslate fix editor problems: from n/a through <= 1.0.0.
Product
TinyMCE Advanced qTranslate fix editor problems
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update TinyMCE Advanced qTranslate fix editor problems to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Page/Post Specific Social Share Buttons: Cross-Site Request Forgery (CSRF)CVE-2025-26580 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Complete SEO Page/Post Specific Social Share Buttons pagepost-specific-social-share-buttons allows Stored XSS.This issue affects Page/Post Specific Social Share Buttons: from n/a through <= 2.1.
Product
Page/Post Specific Social Share Buttons
Affected
up to 2.1
What to do
Affects up to 2.1. Update Page/Post Specific Social Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Simple Documentation: Cross-Site Request Forgery (CSRF)CVE-2025-26578 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mathieuhays Simple Documentation client-documentation allows Stored XSS.This issue affects Simple Documentation: from n/a through <= 1.2.8.
Product
Simple Documentation
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update Simple Documentation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025DX-auto-publish: Cross-Site Request Forgery (CSRF)CVE-2025-26577 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in daxiawp DX-auto-publish dx-auto-publish allows Stored XSS.This issue affects DX-auto-publish: from n/a through <= 1.2.
Product
DX-auto-publish
Affected
up to 1.2
What to do
Affects up to 1.2. Update DX-auto-publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Google Drive WP Media: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26574 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moch Amir Google Drive WP Media google-drive-wp-media allows Stored XSS.This issue affects Google Drive WP Media: from n/a through <= 2.4.4.
Product
Google Drive WP Media
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Google Drive WP Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025WP PHPList: Cross-Site Request Forgery (CSRF)CVE-2025-26572 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in jesseheap WP PHPList phplist-form-integration allows Cross Site Request Forgery.This issue affects WP PHPList: from n/a through <= 1.7.
Product
WP PHPList
Affected
up to 1.7
What to do
Affects up to 1.7. Update WP PHPList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Wibiya Toolbar: Cross-Site Request Forgery (CSRF)CVE-2025-26571 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in wibiya Wibiya Toolbar wibiya allows Cross Site Request Forgery.This issue affects Wibiya Toolbar: from n/a through <= 2.0.
Product
Wibiya Toolbar
Affected
up to 2.0
What to do
Affects up to 2.0. Update Wibiya Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Glance That: Cross-Site Request Forgery (CSRF)CVE-2025-26570 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in uamv Glance That allows Cross Site Request Forgery. This issue affects Glance That: from n/a through 4.9.
Product
Glance That
Affected
up to 4.9
What to do
Affects up to 4.9. Update Glance That to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Post Thumbs: Cross-Site Request Forgery (CSRF)CVE-2025-26569 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Callmeforsox Post Thumbs allows Stored XSS. This issue affects Post Thumbs: from n/a through 1.5.
Product
Post Thumbs
Affected
up to 1.5
What to do
Affects up to 1.5. Update Post Thumbs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Easy Amazon Product Information: Cross-Site Request Forgery (CSRF)CVE-2025-26568 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in jensmueller Easy Amazon Product Information easy-amazon-product-information allows Stored XSS.This issue affects Easy Amazon Product Information: from n/a through <= 4.0.1.
Product
Easy Amazon Product Information
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Easy Amazon Product Information to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Font Awesome WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26567 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in farjana55 Font Awesome WP font-awesome-wp allows DOM-Based XSS.This issue affects Font Awesome WP: from n/a through <= 1.0.
Product
Font Awesome WP
Affected
up to 1.0
What to do
Affects up to 1.0. Update Font Awesome WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025RSS Filter: Cross-Site Request Forgery (CSRF)CVE-2025-26562 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Shambhu Patnaik RSS Filter rss-filter allows Stored XSS.This issue affects RSS Filter: from n/a through <= 1.2.
Product
RSS Filter
Affected
up to 1.2
What to do
Affects up to 1.2. Update RSS Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Elfsight Yottie Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26561 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elfsight Elfsight Yottie Lite yottie-lite allows Stored XSS.This issue affects Elfsight Yottie Lite: from n/a through <= 1.3.3.
Product
Elfsight Yottie Lite
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Elfsight Yottie Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Aparat Responsive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26558 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mkkmail Aparat Responsive aparat-responsive allows DOM-Based XSS.This issue affects Aparat Responsive: from n/a through <= 1.3.
Product
Aparat Responsive
Affected
up to 1.3
What to do
Affects up to 1.3. Update Aparat Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Naver Syndication V2: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26552 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in badrHan Naver Syndication V2 badr-naver-syndication allows Stored XSS.This issue affects Naver Syndication V2: from n/a through <= 0.8.3.
Product
Naver Syndication V2
Affected
up to 0.8.3
What to do
Affects up to 0.8.3. Update Naver Syndication V2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Bootstrap collapse: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26551 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sureshdsk Bootstrap collapse bootstrap-collapse allows Stored XSS.This issue affects Bootstrap collapse: from n/a through <= 1.0.4.
Product
Bootstrap collapse
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Bootstrap collapse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Global Meta Keyword & Description: Cross-Site Request Forgery (CSRF)CVE-2025-26550 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Kunal Shivale Global Meta Keyword & Description global-meta-keyword-and-description allows Stored XSS.This issue affects Global Meta Keyword & Description: from n/a through <= 2.3.
Product
Global Meta Keyword & Description
Affected
up to 2.3
What to do
Affects up to 2.3. Update Global Meta Keyword & Description to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025WP Html Page Sitemap: Cross-Site Request Forgery (CSRF)CVE-2025-26549 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in pa1 WP Html Page Sitemap wp-html-page-sitemap allows Stored XSS.This issue affects WP Html Page Sitemap: from n/a through <= 2.2.
Product
WP Html Page Sitemap
Affected
up to 2.2
What to do
Affects up to 2.2. Update WP Html Page Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025My Login Logout: Cross-Site Request Forgery (CSRF)CVE-2025-26547 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in nagarjunsonti My Login Logout Plugin my-loginlogout allows Stored XSS.This issue affects My Login Logout Plugin: from n/a through <= 2.4.
Product
My Login Logout
Affected
up to 2.4
What to do
Affects up to 2.4. Update My Login Logout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Related Posts Line-up-Exactly by Milliard: Cross-Site Request Forgery (CSRF)CVE-2025-26545 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in shisuh Related Posts Line-up-Exactly by Milliard related-posts-line-up-exactry-by-milliard allows Stored XSS.This issue affects Related Posts Line-up-Exactly by Milliard: from n/a through <= 0.0.22.
Product
Related Posts Line-up-Exactly by Milliard
Affected
up to 0.0.22
What to do
Affects up to 0.0.22. Update Related Posts Line-up-Exactly by Milliard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.