Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,460entries in the database

15,923 results · page 164 of 319

Jan 22, 2025WooCommerce Order Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23495 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chetan Khandla WooCommerce Order Search woocommerce-order-searching allows Reflected XSS.This issue affects WooCommerce Order Search: from n/a through <= 1.1.0.
Product
WooCommerce Order Search
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update WooCommerce Order Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025History timeline: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23475 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fireantology History timeline history-timeline allows Reflected XSS.This issue affects History timeline: from n/a through <= 0.7.2.
Product
History timeline
Affected
up to 0.7.2
What to do
Affects up to 0.7.2. Update History timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025FWD Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23462 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anil Jailta FWD Slider fwd-slider allows Reflected XSS.This issue affects FWD Slider: from n/a through <= 1.0.
Product
FWD Slider
Affected
up to 1.0
What to do
Affects up to 1.0. Update FWD Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Simple shortcode buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23449 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davidpuc Simple shortcode buttons simple-shortcode-buttons allows Reflected XSS.This issue affects Simple shortcode buttons: from n/a through <= 1.3.2.
Product
Simple shortcode buttons
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Simple shortcode buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Mapbox for WP Advanced: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22772 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stephanemartinw Mapbox for WP Advanced mapbox-for-wp-advanced allows Reflected XSS.This issue affects Mapbox for WP Advanced: from n/a through <= 1.0.0.
Product
Mapbox for WP Advanced
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Mapbox for WP Advanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Themify Builder: Reflected Cross-Site ScriptingCVE-2024-13319 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.6.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Themify Builder
Affected
up to 7.6.5
What to do
Affects up to 7.6.5. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025XML for Google Merchant Center: Reflected Cross-Site ScriptingCVE-2024-13406 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The XML for Google Merchant Center plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'feed_id' parameter in all versions up to, and including, 3.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
XML for Google Merchant Center
Affected
up to 3.0.11
What to do
Affects up to 3.0.11. Update XML for Google Merchant Center to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025Stackable – Page Builder Gutenberg Blocks: Stored Cross-Site ScriptingCVE-2024-12117 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the Button block in all versions up to, and including, 3.13.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Stackable – Page Builder Gutenberg Blocks
Affected
up to 3.13.11
What to do
Affects up to 3.13.11. Update Stackable – Page Builder Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 21, 2025Ketchup Shortcodes: Stored Cross-Site ScriptingCVE-2024-13590 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ketchup Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spacer' shortcode in all versions up to, and including, 0.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ketchup Shortcodes
Affected
up to 0.1.2
What to do
Affects up to 0.1.2. Update Ketchup Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 21, 2025Picture Gallery – Frontend Image Uploads, AJAX Photo List: Stored Cross-Site ScriptingCVE-2024-13584 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_pictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Picture Gallery – Frontend Image Uploads, AJAX Photo List
Affected
up to 1.5.19
What to do
Affects up to 1.5.19. Update Picture Gallery – Frontend Image Uploads, AJAX Photo List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 21, 2025AnyRoad: Cross-Site Request Forgery (CSRF)CVE-2025-23996 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in AnyRoad AnyRoad anyguide allows Cross Site Request Forgery.This issue affects AnyRoad: from n/a through <= 1.3.2.
Product
AnyRoad
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update AnyRoad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Estatebud – Properties & Listings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23994 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatebud Estatebud – Properties & Listings estatebud-properties-listings allows Stored XSS.This issue affects Estatebud – Properties & Listings: from n/a through <= 5.5.0.
Product
Estatebud – Properties & Listings
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update Estatebud – Properties & Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025BizLibrary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23580 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthew BizLibrary bizlibrary allows Reflected XSS.This issue affects BizLibrary: from n/a through <= 1.1.
Product
BizLibrary
Affected
up to 1.1
What to do
Affects up to 1.1. Update BizLibrary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025SexBundle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23551 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in razvypp SexBundle sexbundle allows Reflected XSS.This issue affects SexBundle: from n/a through <= 1.4.
Product
SexBundle
Affected
up to 1.4
What to do
Affects up to 1.4. Update SexBundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025WP-Announcements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23489 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Messenlehner WP-Announcements wp-announcements allows Reflected XSS.This issue affects WP-Announcements: from n/a through <= 1.8.
Product
WP-Announcements
Affected
up to 1.8
What to do
Affects up to 1.8. Update WP-Announcements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Social2Blog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23461 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xkollsoftware Social2Blog social2blog allows Reflected XSS.This issue affects Social2Blog: from n/a through <= 0.2.990.
Product
Social2Blog
Affected
up to 0.2.990
What to do
Affects up to 0.2.990. Update Social2Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Nature FlipBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23454 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flashmaniac Nature FlipBook vertical-diamond-flipbook-flash allows Reflected XSS.This issue affects Nature FlipBook: from n/a through <= 1.7.
Product
Nature FlipBook
Affected
up to 1.7
What to do
Affects up to 1.7. Update Nature FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Online Payments – Get Paid with PayPal, Square & Stripe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22661 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Payments – Get Paid with PayPal, Square & Stripe paypal-payment-button-by-vcita allows Stored XSS.This issue affects Online Payments – Get Paid with PayPal, Square & Stripe: from n/a through <= 3.20.0.
Product
Online Payments – Get Paid with PayPal, Square & Stripe
Affected
up to 3.20.0
What to do
Affects up to 3.20.0. Update Online Payments – Get Paid with PayPal, Square & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Related Post Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22276 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enguerranws Related Post Shortcode related-post-shortcode allows Stored XSS.This issue affects Related Post Shortcode: from n/a through <= 1.2.
Product
Related Post Shortcode
Affected
up to 1.2
What to do
Affects up to 1.2. Update Related Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Weaver Themes Shortcode Compatibility: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22267 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Themes Shortcode Compatibility weaver-themes-shortcode-compatibility allows Stored XSS.This issue affects Weaver Themes Shortcode Compatibility: from n/a through <= 1.0.4.
Product
Weaver Themes Shortcode Compatibility
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Weaver Themes Shortcode Compatibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025PPO Call To Actions: Cross-Site Request Forgery (CSRF)CVE-2025-24001 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ngô Thắng IT PPO Call To Actions ppo-call-to-actions allows Cross Site Request Forgery.This issue affects PPO Call To Actions: from n/a through <= 0.1.3.
Product
PPO Call To Actions
Affected
up to 0.1.3
What to do
Affects up to 0.1.3. Update PPO Call To Actions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025UltraLight: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23998 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in raratheme UltraLight the-ultralight allows Reflected XSS.This issue affects UltraLight: from n/a through <= 1.2.
Product
UltraLight
Affected
up to 1.2
What to do
Affects up to 1.2. Update UltraLight to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Tamara Checkout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23997 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tamara Solution Tamara Checkout tamara-checkout allows Stored XSS.This issue affects Tamara Checkout: from n/a through < 1.9.9.1.
Product
Tamara Checkout
What to do
Update Tamara Checkout to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Flexible PDF Coupons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22825 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible PDF Coupons flexible-coupons allows Stored XSS.This issue affects Flexible PDF Coupons: from n/a through < 1.10.3.
Product
Flexible PDF Coupons
What to do
Update Flexible PDF Coupons to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Brizy Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22763 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Brizy Pro allows Reflected XSS. This issue affects Brizy Pro: from n/a through 2.6.1.
Product
Brizy Pro
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Brizy Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025WordPress Tag Cloud Plugin – Tag Groups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22735 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Burge WordPress Tag Cloud Plugin – Tag Groups tag-groups allows Reflected XSS.This issue affects WordPress Tag Cloud Plugin – Tag Groups: from n/a through <= 2.0.4.
Product
WordPress Tag Cloud Plugin – Tag Groups
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update WordPress Tag Cloud Plugin – Tag Groups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025My auctions allegro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22733 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Reflected XSS.This issue affects My auctions allegro: from n/a through <= 3.6.18.
Product
My auctions allegro
Affected
up to 3.6.18
What to do
Affects up to 3.6.18. Update My auctions allegro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Ad Blocking Detector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22732 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Admiral Ad Blocking Detector ad-blocking-detector allows Stored XSS.This issue affects Ad Blocking Detector: from n/a through <= 3.6.0.
Product
Ad Blocking Detector
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update Ad Blocking Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025MailChimp Subscribe Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22727 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps MailChimp Subscribe Forms mailchimp-subscribe-sm allows Stored XSS.This issue affects MailChimp Subscribe Forms : from n/a through <= 4.1.
Product
MailChimp Subscribe Forms
Affected
up to 4.1
What to do
Affects up to 4.1. Update MailChimp Subscribe Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025VikAppointments Services Booking Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22719 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikAppointments Services Booking Calendar vikappointments allows Stored XSS.This issue affects VikAppointments Services Booking Calendar: from n/a through <= 1.2.16.
Product
VikAppointments Services Booking Calendar
Affected
up to 1.2.16
What to do
Affects up to 1.2.16. Update VikAppointments Services Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025FAT Event Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22718 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in roninwp FAT Event Lite fat-event-lite allows Stored XSS.This issue affects FAT Event Lite: from n/a through <= 1.1.
Product
FAT Event Lite
Affected
up to 1.1
What to do
Affects up to 1.1. Update FAT Event Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Image Source Control: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22711 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Maier Image Source Control image-source-control-isc allows Reflected XSS.This issue affects Image Source Control: from n/a through <= 2.29.0.
Product
Image Source Control
Affected
up to 2.29.0
What to do
Affects up to 2.29.0. Update Image Source Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Verge3D: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22709 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D verge3d allows Reflected XSS.This issue affects Verge3D: from n/a through <= 4.8.0.
Product
Verge3D
Affected
up to 4.8.0
What to do
Affects up to 4.8.0. Update Verge3D to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Social Pug: Author Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22706 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai Social Pug: Author Box allows Reflected XSS. This issue affects Social Pug: Author Box: from n/a through 1.0.0.
Product
Social Pug: Author Box
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Social Pug: Author Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Private Messages for UserPro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22322 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeluxeThemes Private Messages for UserPro userpro-messaging allows Reflected XSS.This issue affects Private Messages for UserPro: from n/a through <= 4.10.0.
Product
Private Messages for UserPro
Affected
up to 4.10.0
What to do
Affects up to 4.10.0. Update Private Messages for UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Bonjour Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22262 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WittyFolk Bonjour Bar bonjour-bar allows Stored XSS.This issue affects Bonjour Bar: from n/a through <= 1.0.0.
Product
Bonjour Bar
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Bonjour Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025ARPrice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49700 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARPrice arprice allows Reflected XSS.This issue affects ARPrice: from n/a through <= 4.1.3.
Product
ARPrice
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Hero Mega Menu - Responsive WordPress Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49300 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugin allows Reflected XSS. This issue affects Hero Mega Menu - Responsive WordPress Menu Plugin: from n/a through 1.16.5.
Product
Hero Mega Menu - Responsive WordPress Menu
Affected
up to 1.16.5
What to do
Affects up to 1.16.5. Update Hero Mega Menu - Responsive WordPress Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Betheme: Stored Cross-Site ScriptingCVE-2025-0450 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Betheme
Affected
up to 27.6.1
What to do
Affects up to 27.6.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.muffingroup.com wordfence.com
Jan 21, 2025wp-greet: Cross-Site Request ForgeryCVE-2024-13444 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The wp-greet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
wp-greet
Affected
up to 6.2
What to do
Affects up to 6.2. Update wp-greet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 21, 2025FireCask Like & Share Button: Stored Cross-Site ScriptingCVE-2024-11226 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FireCask Like & Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FireCask Like & Share Button
Affected
up to 1.2
What to do
Affects up to 1.2. Update FireCask Like & Share Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 21, 2025Link Library: Reflected Cross-Site ScriptingCVE-2024-13404 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in all versions up to, and including, 7.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Link Library
Affected
up to 7.7.2
What to do
Affects up to 7.7.2. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 21, 2025WP-BibTeX: Cross-Site Request ForgeryCVE-2024-12005 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the wp_bibtex_option_page() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP-BibTeX
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update WP-BibTeX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 21, 2025JetElements: Stored Cross-Site ScriptingCVE-2025-0371 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.7.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
JetElements
Affected
up to 2.7.2.1
What to do
Affects up to 2.7.2.1. Update JetElements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record crocoblock.com wordfence.com
Jan 19, 2025Import any XML or CSV File to WordPress PRO: Stored Cross-Site ScriptingCVE-2024-8722 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Import any XML or CSV File to WordPress PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Import any XML or CSV File to WordPress PRO
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update Import any XML or CSV File to WordPress PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpallimport.com
Jan 18, 2025Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings: Stored Cross-Site ScriptingCVE-2024-13392 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_reviews' shortcode in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 18, 2025JetEngine: Stored Cross-Site ScriptingCVE-2025-0369 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘list_tag’ parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
JetEngine
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record crocoblock.com crocoblock.com
Jan 18, 2025MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution: Stored Cross-Site ScriptingCVE-2024-13519 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to, and including, 1.9.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
Affected
up to 1.9.80
What to do
Affects up to 1.9.80. Update MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 18, 2025Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: Stored Cross-Site ScriptingCVE-2024-13517 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Easy Digital Downloads – eCommerce Payments and Subscriptions made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 18, 2025Utilities for MTG: Stored Cross-Site ScriptingCVE-2024-13433 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Utilities for MTG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mtglink' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Utilities for MTG
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Utilities for MTG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.