Vulnerability database

15,923 results · page 157 of 319

• Feb 3, 2025Eventer: Stored Cross-Site ScriptingCVE-2024-11132 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Eventer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.9.9.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Eventer

  Affected

  up to 3.9.9.4

  What to do

  Affects up to 3.9.9.4. Update Eventer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodecanyon.networdfence.com

• Feb 3, 2025WPJobBoard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24781 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WPJobBoard allows Reflected XSS. This issue affects WPJobBoard: from n/a through 5.10.1.

  Product

  WPJobBoard

  Affected

  up to 5.10.1

  What to do

  Affects up to 5.10.1. Update WPJobBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24707 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Reflected XSS.This issue affects Photo Gallery: from n/a through <= 2.7.7.24.

  Product

  Photo Gallery

  Affected

  up to 2.7.7.24

  What to do

  Affects up to 2.7.7.24. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Media Downloader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24684 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ederson Peka Media Downloader media-downloader allows Reflected XSS.This issue affects Media Downloader: from n/a through <= 0.4.7.5.

  Product

  Media Downloader

  Affected

  up to 0.4.7.5

  What to do

  Affects up to 0.4.7.5. Update Media Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Custom WP Store Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24676 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in umangmetatagg Custom WP Store Locator custom-store-locator allows Reflected XSS.This issue affects Custom WP Store Locator: from n/a through <= 1.4.7.

  Product

  Custom WP Store Locator

  Affected

  up to 1.4.7

  What to do

  Affects up to 1.4.7. Update Custom WP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Simple Membership Custom Messages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24660 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership Custom Messages simple-membership-custom-messages allows Reflected XSS.This issue affects Simple Membership Custom Messages: from n/a through <= 2.4.

  Product

  Simple Membership Custom Messages

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update Simple Membership Custom Messages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Realtyna Provisioning: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24656 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Realtyna Realtyna Provisioning realtyna-provisioning allows Reflected XSS.This issue affects Realtyna Provisioning: from n/a through <= 1.2.2.

  Product

  Realtyna Provisioning

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Realtyna Provisioning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025XML for Avito: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24646 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc XML for Avito xml-for-avito allows Reflected XSS.This issue affects XML for Avito: from n/a through <= 2.5.2.

  Product

  XML for Avito

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update XML for Avito to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025BP Email Assign Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24631 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Reflected XSS.This issue affects BP Email Assign Templates: from n/a through <= 1.5.

  Product

  BP Email Assign Templates

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update BP Email Assign Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Sikshya LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24630 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MantraBrain Sikshya LMS sikshya allows Reflected XSS.This issue affects Sikshya LMS: from n/a through <= 0.0.21.

  Product

  Sikshya LMS

  Affected

  up to 0.0.21

  What to do

  Affects up to 0.0.21. Update Sikshya LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Import Excel to Gravity Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24629 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpgear Import Excel to Gravity Forms gf-excel-import allows Reflected XSS.This issue affects Import Excel to Gravity Forms: from n/a through <= 1.18.

  Product

  Import Excel to Gravity Forms

  Affected

  up to 1.18

  What to do

  Affects up to 1.18. Update Import Excel to Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025AIO Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24620 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hkharpreetkumar1 AIO Shortcodes aio-shortcodes allows Stored XSS.This issue affects AIO Shortcodes: from n/a through <= 1.3.

  Product

  AIO Shortcodes

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update AIO Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Landing Page Cat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24576 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Landing Page Cat landing-page-cat allows Reflected XSS.This issue affects Landing Page Cat: from n/a through <= 1.7.7.

  Product

  Landing Page Cat

  Affected

  up to 1.7.7

  What to do

  Affects up to 1.7.7. Update Landing Page Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025PeproDev WooCommerce Receipt Uploader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24574 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev WooCommerce Receipt Uploader pepro-bacs-receipt-upload-for-woocommerce allows Reflected XSS.This issue affects PeproDev WooCommerce Receipt Uploader: from n/a through <= 2.6.9.

  Product

  PeproDev WooCommerce Receipt Uploader

  Affected

  up to 2.6.9

  What to do

  Affects up to 2.6.9. Update PeproDev WooCommerce Receipt Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025WP Mailster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24559 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.This issue affects WP Mailster: from n/a through <= 1.8.15.0.

  Product

  WP Mailster

  Affected

  up to 1.8.15.0

  What to do

  Affects up to 1.8.15.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025PlainInventory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24557 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware PlainInventory z-inventory-manager allows Reflected XSS.This issue affects PlainInventory: from n/a through <= 3.1.5.

  Product

  PlainInventory

  Affected

  up to 3.1.5

  What to do

  Affects up to 3.1.5. Update PlainInventory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025BSK Forms Validation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24545 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK Forms Validation bsk-gravity-forms-custom-validation allows Reflected XSS.This issue affects BSK Forms Validation: from n/a through <= 1.7.

  Product

  BSK Forms Validation

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update BSK Forms Validation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Bitcoin and Altcoin Wallets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24544 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashed-slug.net Bitcoin and Altcoin Wallets wallets allows Reflected XSS.This issue affects Bitcoin and Altcoin Wallets: from n/a through <= 6.3.1.

  Product

  Bitcoin and Altcoin Wallets

  Affected

  up to 6.3.1

  What to do

  Affects up to 6.3.1. Update Bitcoin and Altcoin Wallets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025DK White Label: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24541 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dinamiko DK White Label dk-white-label allows Reflected XSS.This issue affects DK White Label: from n/a through <= 1.0.

  Product

  DK White Label

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update DK White Label to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025ThriveDesk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24536 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThriveDesk ThriveDesk thrivedesk allows Reflected XSS.This issue affects ThriveDesk: from n/a through <= 2.0.6.

  Product

  ThriveDesk

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update ThriveDesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Dynamic URL SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23984 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainvireinfo Dynamic URL SEO dynamic-url-seo allows Reflected XSS.This issue affects Dynamic URL SEO: from n/a through <= 1.0.

  Product

  Dynamic URL SEO

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Dynamic URL SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Lockets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23923 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wackey Lockets lockets allows Reflected XSS.This issue affects Lockets: from n/a through <= 0.999.

  Product

  Lockets

  Affected

  up to 0.999

  What to do

  Affects up to 0.999. Update Lockets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025ApplicantPro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23920 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sourcing Team ApplicantPro applicantpro allows Reflected XSS.This issue affects ApplicantPro: from n/a through <= 1.3.9.

  Product

  ApplicantPro

  Affected

  up to 1.3.9

  What to do

  Affects up to 1.3.9. Update ApplicantPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025.TUBE Video Curator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23799 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tubegtld .TUBE Video Curator tube-video-curator allows Reflected XSS.This issue affects .TUBE Video Curator: from n/a through <= 1.1.9.

  Product

  .TUBE Video Curator

  Affected

  up to 1.1.9

  What to do

  Affects up to 1.1.9. Update .TUBE Video Curator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025PAFacile: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23755 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tosend.it PAFacile pafacile allows Reflected XSS.This issue affects PAFacile: from n/a through <= 2.6.1.

  Product

  PAFacile

  Affected

  up to 2.6.1

  What to do

  Affects up to 2.6.1. Update PAFacile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Awesome Timeline: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23747 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nitesh Awesome Timeline awesome-timeline allows Stored XSS.This issue affects Awesome Timeline: from n/a through <= 1.0.1.

  Product

  Awesome Timeline

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Awesome Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025RomanCart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23685 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebTechGlobal RomanCart romancart-on-wordpress allows Reflected XSS.This issue affects RomanCart: from n/a through <= 0.0.2.

  Product

  RomanCart

  Affected

  up to 0.0.2

  What to do

  Affects up to 0.0.2. Update RomanCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025WordPress Additional Logins: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23614 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in niksudan WordPress Additional Logins wp-additional-logins allows Reflected XSS.This issue affects WordPress Additional Logins: from n/a through <= 1.0.0.

  Product

  WordPress Additional Logins

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update WordPress Additional Logins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025eMarksheet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23599 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aarvansh Infotech eMarksheet emarksheet allows Reflected XSS.This issue affects eMarksheet: from n/a through <= 5.4.3.

  Product

  eMarksheet

  Affected

  up to 5.4.3

  What to do

  Affects up to 5.4.3. Update eMarksheet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Google Map With Fancybox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23594 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uzzal Mondal Google Map With Fancybox location-piker allows Reflected XSS.This issue affects Google Map With Fancybox: from n/a through <= 2.1.0.

  Product

  Google Map With Fancybox

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Google Map With Fancybox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025EmailPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23593 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kvvaradha EmailPress emailpress allows Reflected XSS.This issue affects EmailPress: from n/a through <= 1.0.

  Product

  EmailPress

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update EmailPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025blu Logistics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23591 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blulogistics1 blu Logistics blu-logistics allows Reflected XSS.This issue affects blu Logistics: from n/a through <= 1.0.0.

  Product

  blu Logistics

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update blu Logistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Dezdy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23590 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dezdy.com Dezdy dezdy-mcommerce allows Reflected XSS.This issue affects Dezdy: from n/a through <= 1.0.

  Product

  Dezdy

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Dezdy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025WOW Best CSS Compiler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23588 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in baonguyenyam WOW Best CSS Compiler best-css-compiler allows Reflected XSS.This issue affects WOW Best CSS Compiler: from n/a through <= 2.0.2.

  Product

  WOW Best CSS Compiler

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update WOW Best CSS Compiler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Bulk Categories Assign: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23582 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Haider Ali Bulk Categories Assign bulk-categories-assign allows Reflected XSS.This issue affects Bulk Categories Assign: from n/a through <= 1.0.

  Product

  Bulk Categories Assign

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Bulk Categories Assign to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Demo User DZS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23581 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalzoomstudio Demo User DZS demo-user-dzs-showcase-your-admin-safely allows Stored XSS.This issue affects Demo User DZS: from n/a through <= 1.1.0.

  Product

  Demo User DZS

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Demo User DZS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025MLL Audio Player MP3 Ajax: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23561 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robertkay MLL Audio Player MP3 Ajax music-let-loose-mp3-audio-player allows Stored XSS.This issue affects MLL Audio Player MP3 Ajax: from n/a through <= 0.7.

  Product

  MLL Audio Player MP3 Ajax

  Affected

  up to 0.7

  What to do

  Affects up to 0.7. Update MLL Audio Player MP3 Ajax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025VSTEMPLATE Creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23491 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikash Srivastava VSTEMPLATE Creator vstemplate-creator allows Reflected XSS.This issue affects VSTEMPLATE Creator: from n/a through <= 2.0.2.

  Product

  VSTEMPLATE Creator

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update VSTEMPLATE Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Catalog Importer, Scraper & Crawler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22775 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in idiatech Catalog Importer, Scraper & Crawler intelligent-importer allows Reflected XSS.This issue affects Catalog Importer, Scraper & Crawler: from n/a through <= 5.1.3.

  Product

  Catalog Importer, Scraper & Crawler

  Affected

  up to 5.1.3

  What to do

  Affects up to 5.1.3. Update Catalog Importer, Scraper & Crawler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025WordPress Signature: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22704 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abinav Thakuri WordPress Signature wordpress-signature allows Reflected XSS.This issue affects WordPress Signature: from n/a through <= 0.1.

  Product

  WordPress Signature

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update WordPress Signature to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Forge – Front-End Page Builder: Cross-Site Request Forgery (CSRF)CVE-2025-22703 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in manuelvicedo Forge – Front-End Page Builder forge allows Stored XSS.This issue affects Forge – Front-End Page Builder: from n/a through <= 1.4.6.

  Product

  Forge – Front-End Page Builder

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update Forge – Front-End Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025DigiTimber cPanel Integration: Cross-Site Request Forgery (CSRF)CVE-2025-22690 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in DigiTimber DigiTimber cPanel Integration digitimber-cpanel-integration allows Stored XSS.This issue affects DigiTimber cPanel Integration: from n/a through <= 1.4.6.

  Product

  DigiTimber cPanel Integration

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update DigiTimber cPanel Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Unlimited Page Sidebars: Cross-Site Request Forgery (CSRF)CVE-2025-22688 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Ederson Peka Unlimited Page Sidebars unlimited-page-sidebars allows Stored XSS.This issue affects Unlimited Page Sidebars: from n/a through <= 0.2.6.

  Product

  Unlimited Page Sidebars

  Affected

  up to 0.2.6

  What to do

  Affects up to 0.2.6. Update Unlimited Page Sidebars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Tags to Keywords: Cross-Site Request Forgery (CSRF)CVE-2025-22685 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in CheGevara29 Tags to Keywords tags-to-meta-keywords allows Stored XSS.This issue affects Tags to Keywords: from n/a through <= 1.0.1.

  Product

  Tags to Keywords

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Tags to Keywords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025WP BASE Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22684 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hakan Ozevin WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Stored XSS.This issue affects WP BASE Booking: from n/a through <= 5.0.0.

  Product

  WP BASE Booking

  Affected

  up to 5.0.0

  What to do

  Affects up to 5.0.0. Update WP BASE Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025NotificationX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22683 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper NotificationX notificationx allows Stored XSS.This issue affects NotificationX: from n/a through <= 2.9.5.

  Product

  NotificationX

  Affected

  up to 2.9.5

  What to do

  Affects up to 2.9.5. Update NotificationX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Hesabfa Accounting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22682 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Reflected XSS.This issue affects Hesabfa Accounting: from n/a through <= 2.1.2.

  Product

  Hesabfa Accounting

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Hesabfa Accounting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Job Board Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22679 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager job-board-manager allows Reflected XSS.This issue affects Job Board Manager: from n/a through <= 2.1.61.

  Product

  Job Board Manager

  Affected

  up to 2.1.61

  What to do

  Affects up to 2.1.61. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Powerful Auto Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22292 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Felipe Peixoto Powerful Auto Chat powers-triggers-of-woo-to-chat allows Stored XSS.This issue affects Powerful Auto Chat: from n/a through <= 1.9.8.

  Product

  Powerful Auto Chat

  Affected

  up to 1.9.8

  What to do

  Affects up to 1.9.8. Update Powerful Auto Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 1, 2025Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss: Stored Cross-Site ScriptingCVE-2024-13612 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'better_messages_live_chat_button' shortcode in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss

  Affected

  up to 2.6.9

  What to do

  Affects up to 2.6.9. Update Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.