Vulnerability database

15,923 results · page 168 of 319

• Jan 16, 2025QuoteMedia Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23644 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in justin.kuepper QuoteMedia Tools quotemedia-tools allows DOM-Based XSS.This issue affects QuoteMedia Tools: from n/a through <= 1.0.

  Product

  QuoteMedia Tools

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update QuoteMedia Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Sidebar-Content from Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23642 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pflonk Sidebar-Content from Shortcode sidebar-content-from-shortcode allows DOM-Based XSS.This issue affects Sidebar-Content from Shortcode: from n/a through <= 2.0.

  Product

  Sidebar-Content from Shortcode

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Sidebar-Content from Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Powie's pLinks PagePeeker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23641 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PowieT Powie's pLinks PagePeeker plinks allows DOM-Based XSS.This issue affects Powie's pLinks PagePeeker: from n/a through <= 1.0.2.

  Product

  Powie's pLinks PagePeeker

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Powie's pLinks PagePeeker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Rename Author Slug: Cross-Site Request Forgery (CSRF)CVE-2025-23640 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Nazmul Ahsan Rename Author Slug rename-author-slug allows Stored XSS.This issue affects Rename Author Slug: from n/a through <= 1.2.0.

  Product

  Rename Author Slug

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Rename Author Slug to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025MDC YouTube Downloader: Cross-Site Request Forgery (CSRF)CVE-2025-23639 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Nazmul Ahsan MDC YouTube Downloader mdc-youtube-downloader allows Stored XSS.This issue affects MDC YouTube Downloader: from n/a through <= 3.0.0.

  Product

  MDC YouTube Downloader

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update MDC YouTube Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Comment-Emailer: Cross-Site Request Forgery (CSRF)CVE-2025-23627 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in frenchsquared Comment-Emailer comment-emailer allows Stored XSS.This issue affects Comment-Emailer: from n/a through <= 1.0.5.

  Product

  Comment-Emailer

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Comment-Emailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Contact Form 7 – CCAvenue Add-on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23623 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Bisen Contact Form 7 – CCAvenue Add-on cf7-cc-avenue-add-on allows Reflected XSS.This issue affects Contact Form 7 – CCAvenue Add-on: from n/a through <= 1.0.

  Product

  Contact Form 7 – CCAvenue Add-on

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Contact Form 7 – CCAvenue Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Captchelfie – Captcha by Selfie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23620 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trof Captchelfie – Captcha by Selfie captchelfie-captcha-by-selfie allows Reflected XSS.This issue affects Captchelfie – Captcha by Selfie: from n/a through <= 1.0.7.

  Product

  Captchelfie – Captcha by Selfie

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Captchelfie – Captcha by Selfie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Twitter Shortcode: Cross-Site Request Forgery (CSRF)CVE-2025-23618 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in starise Twitter Shortcode twitter-shortcode allows Stored XSS.This issue affects Twitter Shortcode: from n/a through <= 0.9.

  Product

  Twitter Shortcode

  Affected

  up to 0.9

  What to do

  Affects up to 0.9. Update Twitter Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Floatbox Plus: Cross-Site Request Forgery (CSRF)CVE-2025-23617 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in cybio Floatbox Plus floatbox-plus allows Stored XSS.This issue affects Floatbox Plus: from n/a through <= 1.4.4.

  Product

  Floatbox Plus

  Affected

  up to 1.4.4

  What to do

  Affects up to 1.4.4. Update Floatbox Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Word Freshener: Cross-Site Request Forgery (CSRF)CVE-2025-23577 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Sourov Amin Word Freshener word-freshener allows Stored XSS.This issue affects Word Freshener: from n/a through <= 1.3.

  Product

  Word Freshener

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Word Freshener to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP Background Tile: Cross-Site Request Forgery (CSRF)CVE-2025-23573 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in sammyb WP Background Tile wp-background-tile allows Stored XSS.This issue affects WP Background Tile: from n/a through <= 1.0.

  Product

  WP Background Tile

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP Background Tile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025UpDownUpDown: Cross-Site Request Forgery (CSRF)CVE-2025-23572 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Dave Konopka UpDownUpDown updownupdown-postcomment-voting allows Stored XSS.This issue affects UpDownUpDown: from n/a through <= 1.1.

  Product

  UpDownUpDown

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update UpDownUpDown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Shortcode in Comment: Cross-Site Request Forgery (CSRF)CVE-2025-23569 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Kelvin Ng Shortcode in Comment shortcode-in-comment allows Stored XSS.This issue affects Shortcode in Comment: from n/a through <= 1.1.1.

  Product

  Shortcode in Comment

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Shortcode in Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025GDReseller: Cross-Site Request Forgery (CSRF)CVE-2025-23567 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Tamer Ziady GDReseller gdreseller allows Stored XSS.This issue affects GDReseller: from n/a through <= 1.6.

  Product

  GDReseller

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update GDReseller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Custom Post: Cross-Site Request Forgery (CSRF)CVE-2025-23566 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in syedamirhussain91 Custom Post custom-post-type-gui allows Stored XSS.This issue affects Custom Post: from n/a through <= 1.0.

  Product

  Custom Post

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Custom Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Web Testimonials: Cross-Site Request Forgery (CSRF)CVE-2025-23560 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in plumwd Web Testimonials web-testimonials allows Stored XSS.This issue affects Web Testimonials: from n/a through <= 1.2.

  Product

  Web Testimonials

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Web Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025MemeOne: Cross-Site Request Forgery (CSRF)CVE-2025-23559 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Stepan Stepasyuk MemeOne allows Stored XSS.This issue affects MemeOne: from n/a through 2.0.5.

  Product

  MemeOne

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update MemeOne to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Geotagged Media: Cross-Site Request Forgery (CSRF)CVE-2025-23558 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in digitalfisherman Geotagged Media geotagged-media allows Stored XSS.This issue affects Geotagged Media: from n/a through <= 0.3.0.

  Product

  Geotagged Media

  Affected

  up to 0.3.0

  What to do

  Affects up to 0.3.0. Update Geotagged Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Find Your Reps: Cross-Site Request Forgery (CSRF)CVE-2025-23557 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Kathleen Malone Find Your Reps find-your-reps allows Stored XSS.This issue affects Find Your Reps: from n/a through <= 1.2.

  Product

  Find Your Reps

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Find Your Reps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025LH Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23547 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH Login Page lh-login-page allows Reflected XSS.This issue affects LH Login Page: from n/a through <= 2.14.

  Product

  LH Login Page

  Affected

  up to 2.14

  What to do

  Affects up to 2.14. Update LH Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025add custom google tag manager: Cross-Site Request Forgery (CSRF)CVE-2025-23537 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in קידום ובניית אתרים add custom google tag manager add-custom-google-tag-manager allows Stored XSS.This issue affects add custom google tag manager: from n/a through <= 1.0.3.

  Product

  add custom google tag manager

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update add custom google tag manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP Lyrics: Cross-Site Request Forgery (CSRF)CVE-2025-23533 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in zetxek WP Lyrics wplyrics allows Stored XSS.This issue affects WP Lyrics: from n/a through <= 0.4.1.

  Product

  WP Lyrics

  Affected

  up to 0.4.1

  What to do

  Affects up to 0.4.1. Update WP Lyrics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025MyAnime Widget: Cross-Site Request Forgery (CSRF)CVE-2025-23532 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in Regios MyAnime Widget myanime-widget allows Privilege Escalation.This issue affects MyAnime Widget: from n/a through <= 1.0.

  Product

  MyAnime Widget

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update MyAnime Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Custom Post Type Lockdown: Cross-Site Request Forgery (CSRF)CVE-2025-23530 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in yonisink Custom Post Type Lockdown custom-post-type-lockdown allows Privilege Escalation.This issue affects Custom Post Type Lockdown: from n/a through <= 1.11.

  Product

  Custom Post Type Lockdown

  Affected

  up to 1.11

  What to do

  Affects up to 1.11. Update Custom Post Type Lockdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Bible Embed: Cross-Site Request Forgery (CSRF)CVE-2025-23513 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in jd7777 Bible Embed bible-embed allows Stored XSS.This issue affects Bible Embed: from n/a through <= 0.0.4.

  Product

  Bible Embed

  Affected

  up to 0.0.4

  What to do

  Affects up to 0.0.4. Update Bible Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP-BlackCheck: Cross-Site Request Forgery (CSRF)CVE-2025-23511 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Stargazer WP-BlackCheck wp-blackcheck allows Stored XSS.This issue affects WP-BlackCheck: from n/a through <= 2.7.2.

  Product

  WP-BlackCheck

  Affected

  up to 2.7.2

  What to do

  Affects up to 2.7.2. Update WP-BlackCheck to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WordPress Logging Service: Cross-Site Request Forgery (CSRF)CVE-2025-23510 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Jan Štětina WordPress Logging Service wordpress-logging-service allows Stored XSS.This issue affects WordPress Logging Service: from n/a through <= 1.5.4.

  Product

  WordPress Logging Service

  Affected

  up to 1.5.4

  What to do

  Affects up to 1.5.4. Update WordPress Logging Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Extra Options – Favicons: Cross-Site Request Forgery (CSRF)CVE-2025-23508 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in OrigoThemes Extra Options – Favicons extra-options-favicons allows Stored XSS.This issue affects Extra Options – Favicons: from n/a through <= 1.1.0.

  Product

  Extra Options – Favicons

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Extra Options – Favicons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Cookie Consent & Autoblock for GDPR/CCPA: Cross-Site Request Forgery (CSRF)CVE-2025-23501 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in SpruceJoy Cookie Consent & Autoblock for GDPR/CCPA cookie-consent-autoblock allows Stored XSS.This issue affects Cookie Consent & Autoblock for GDPR/CCPA: from n/a through <= 1.0.1.

  Product

  Cookie Consent & Autoblock for GDPR/CCPA

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Cookie Consent & Autoblock for GDPR/CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Board Election: Cross-Site Request Forgery (CSRF)CVE-2025-23499 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier Board Election board-election allows Stored XSS.This issue affects Board Election: from n/a through <= 1.0.1.

  Product

  Board Election

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Board Election to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Simple Project Manager: Cross-Site Request Forgery (CSRF)CVE-2025-23497 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in albdesign Simple Project Manager simple-project-managment allows Stored XSS.This issue affects Simple Project Manager: from n/a through <= 1.2.2.

  Product

  Simple Project Manager

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Simple Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Universal Analytics Injector: Cross-Site Request Forgery (CSRF)CVE-2025-23483 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in hoyce Universal Analytics Injector universal-analytics-injector allows Stored XSS.This issue affects Universal Analytics Injector: from n/a through <= 1.0.3.

  Product

  Universal Analytics Injector

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Universal Analytics Injector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025my-related-posts: Cross-Site Request Forgery (CSRF)CVE-2025-23476 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in isnowfy my-related-posts my-related-posts allows Stored XSS.This issue affects my-related-posts: from n/a through <= 1.1.

  Product

  my-related-posts

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update my-related-posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025ECT Add to Cart Button: Cross-Site Request Forgery (CSRF)CVE-2025-23471 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in etemplates ECT Add to Cart Button ect-add-to-cart-button allows Stored XSS.This issue affects ECT Add to Cart Button: from n/a through <= 1.4.

  Product

  ECT Add to Cart Button

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update ECT Add to Cart Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Visit Site Link enhanced: Cross-Site Request Forgery (CSRF)CVE-2025-23470 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in xavsio4 Visit Site Link enhanced visit-site-link-enhanced allows Stored XSS.This issue affects Visit Site Link enhanced: from n/a through <= 1.0.

  Product

  Visit Site Link enhanced

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Visit Site Link enhanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025RSS News Scroller: Cross-Site Request Forgery (CSRF)CVE-2025-23467 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in vimal.ghorecha RSS News Scroller rss-news-scroller allows Stored XSS.This issue affects RSS News Scroller: from n/a through <= 2.0.0.

  Product

  RSS News Scroller

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update RSS News Scroller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025MD Custom content after or before of post: Cross-Site Request Forgery (CSRF)CVE-2025-23463 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Mukesh Dak MD Custom content after or before of post md-custom-content allows Stored XSS.This issue affects MD Custom content after or before of post: from n/a through <= 1.0.

  Product

  MD Custom content after or before of post

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update MD Custom content after or before of post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025EmailShroud: Cross-Site Request Forgery (CSRF)CVE-2025-23456 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Oddthinking EmailShroud emailshroud allows Reflected XSS.This issue affects EmailShroud: from n/a through <= 2.2.1.

  Product

  EmailShroud

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update EmailShroud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP VTiger Synchronization: Cross-Site Request Forgery (CSRF)CVE-2025-23455 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Master Software Solutions WP VTiger Synchronization msstiger allows Stored XSS.This issue affects WP VTiger Synchronization: from n/a through <= 1.1.1.

  Product

  WP VTiger Synchronization

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update WP VTiger Synchronization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Stars SMTP Mailer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23453 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Myriad Solutionz Stars SMTP Mailer stars-smtp-mailer allows Reflected XSS.This issue affects Stars SMTP Mailer: from n/a through <= 1.7.

  Product

  Stars SMTP Mailer

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Stars SMTP Mailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025EditionGuard for WooCommerce – eBook Sales with DRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23452 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EditionGuard EditionGuard for WooCommerce – eBook Sales with DRM editionguard-for-woocommerce-ebook-sales-with-drm allows Reflected XSS.This issue affects EditionGuard for WooCommerce – eBook Sales with DRM: from n/a through <= 3.4.2.

  Product

  EditionGuard for WooCommerce – eBook Sales with DRM

  Affected

  up to 3.4.2

  What to do

  Affects up to 3.4.2. Update EditionGuard for WooCommerce – eBook Sales with DRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Easy Tynt: Cross-Site Request Forgery (CSRF)CVE-2025-23445 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in scottswezey Easy Tynt easy-tynt allows Cross Site Request Forgery.This issue affects Easy Tynt: from n/a through <= 0.2.5.1.

  Product

  Easy Tynt

  Affected

  up to 0.2.5.1

  What to do

  Affects up to 0.2.5.1. Update Easy Tynt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Scroll Top Advanced: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23444 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nasir179125 Scroll Top Advanced scroll-top-advanced allows Stored XSS.This issue affects Scroll Top Advanced: from n/a through <= 2.5.

  Product

  Scroll Top Advanced

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update Scroll Top Advanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Shockingly Big IE6 Warning: Cross-Site Request Forgery (CSRF)CVE-2025-23442 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mschertel Shockingly Big IE6 Warning shockingly-big-ie6-warning allows Stored XSS.This issue affects Shockingly Big IE6 Warning: from n/a through <= 1.6.3.

  Product

  Shockingly Big IE6 Warning

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update Shockingly Big IE6 Warning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP PT-Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23438 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Mimoun-Prat WP PT-Viewer wp-ptviewer allows Reflected XSS.This issue affects WP PT-Viewer: from n/a through <= 2.0.2.

  Product

  WP PT-Viewer

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update WP PT-Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Wp-Scribd-List: Cross-Site Request Forgery (CSRF)CVE-2025-23436 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in capa Wp-Scribd-List wp-scribd-list allows Stored XSS.This issue affects Wp-Scribd-List: from n/a through <= 1.2.

  Product

  Wp-Scribd-List

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Wp-Scribd-List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Password Protect Plugin for: Cross-Site Request Forgery (CSRF)CVE-2025-23435 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in marcucci Password Protect Plugin for WordPress password-protect-plugin-for-wordpress allows Stored XSS.This issue affects Password Protect Plugin for WordPress: from n/a through <= 0.8.1.0.

  Product

  Password Protect Plugin for

  Affected

  up to 0.8.1.0

  What to do

  Affects up to 0.8.1.0. Update Password Protect Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Easy EU Cookie law: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23434 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in viher3 Easy EU Cookie law easy-eu-cookie-law allows Stored XSS.This issue affects Easy EU Cookie law: from n/a through <= 1.3.3.1.

  Product

  Easy EU Cookie law

  Affected

  up to 1.3.3.1

  What to do

  Affects up to 1.3.3.1. Update Easy EU Cookie law to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025AlT Report: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23432 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AlTi5 AlT Report alt-report allows Reflected XSS.This issue affects AlT Report: from n/a through <= 1.12.0.

  Product

  AlT Report

  Affected

  up to 1.12.0

  What to do

  Affects up to 1.12.0. Update AlT Report to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.