Vulnerability database

5,812 results · page 17 of 117

• Jan 8, 2026Listeo Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67932 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes Listeo Core listeo-core allows Reflected XSS.This issue affects Listeo Core: from n/a through < 2.0.19.

  Product

  Listeo Core

  What to do

  Update Listeo Core to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026eHive Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67930 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vernon Systems Limited eHive Search ehive-search allows Reflected XSS.This issue affects eHive Search: from n/a through <= 2.5.0.

  Product

  eHive Search

  Affected

  up to 2.5.0

  What to do

  Affects up to 2.5.0. Update eHive Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Link Whisper Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67927 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through <= 0.8.8.

  Product

  Link Whisper Free

  Affected

  up to 0.8.8

  What to do

  Affects up to 0.8.8. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Grand Restaurant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67922 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a through < 7.0.9.

  Product

  Grand Restaurant

  Fixed in

  7.0.9

  What to do

  Update Grand Restaurant to 7.0.9 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Woffice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67918 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WofficeIO Woffice woffice allows Reflected XSS.This issue affects Woffice: from n/a through <= 5.4.30.

  Product

  Woffice

  Affected

  up to 5.4.30

  What to do

  Affects up to 5.4.30. Update Woffice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Jobify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67916 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Jobify jobify allows Reflected XSS.This issue affects Jobify: from n/a through <= 4.3.0.

  Product

  Jobify

  Affected

  up to 4.3.0

  What to do

  Affects up to 4.3.0. Update Jobify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Famous - Responsive Image And Video Grid Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27004 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Famous - Responsive Image And Video Grid Gallery WordPress Plugin famous_grid_image_and_video_gallery allows Reflected XSS.This issue affects Famous - Responsive Image And Video Grid Gallery WordPress Plugin: from n/a through <= 1.4.

  Product

  Famous - Responsive Image And Video Grid Gallery

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Famous - Responsive Image And Video Grid Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026CountDown With Image or Video Background: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27002 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup CountDown With Image or Video Background countdown-with-background allows Reflected XSS.This issue affects CountDown With Image or Video Background: from n/a through <= 1.5.

  Product

  CountDown With Image or Video Background

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update CountDown With Image or Video Background to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026WP Virtual Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22725 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in loopus WP Virtual Assistant VirtualAssistant allows Stored XSS.This issue affects WP Virtual Assistant: from n/a through <= 3.1.

  Product

  WP Virtual Assistant

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update WP Virtual Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Real Estate Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-13504 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Real Estate Pro real-estate-pro allows Reflected XSS.This issue affects Real Estate Pro: from n/a through <= 2.1.4.

  Product

  Real Estate Pro

  Affected

  up to 2.1.4

  What to do

  Affects up to 2.1.4. Update Real Estate Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026ListingHub: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-12551 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins ListingHub listinghub allows Reflected XSS.This issue affects ListingHub: from n/a through 1.2.6.

  Product

  ListingHub

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update ListingHub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2026WidgetKit Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46494 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit Pro allows Reflected XSS.This issue affects WidgetKit Pro: from n/a through 1.13.1.

  Product

  WidgetKit Pro

  Affected

  up to 1.13.1

  What to do

  Affects up to 1.13.1. Update WidgetKit Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2026Arlo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69082 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frenify Arlo arlo allows Reflected XSS.This issue affects Arlo: from n/a through <= 6.0.3.

  Product

  Arlo

  Affected

  up to 6.0.3

  What to do

  Affects up to 6.0.3. Update Arlo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2026DZS Video Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32300 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital zoom studio DZS Video Gallery allows Reflected XSS.This issue affects DZS Video Gallery: from n/a through 12.25.

  Product

  DZS Video Gallery

  Affected

  up to 12.25

  What to do

  Affects up to 12.25. Update DZS Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026WPCHURCH: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31642 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dasinfomedia WPCHURCH allows Reflected XSS.This issue affects WPCHURCH: from n/a through 2.7.0.

  Product

  WPCHURCH

  Affected

  up to 2.7.0

  What to do

  Affects up to 2.7.0. Update WPCHURCH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026Woocommerce Sales Funnel Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30631 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Sales Funnel Builder, AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows Reflected XSS.This issue affects Woocommerce Sales Funnel Builder: from n/a through 1.1; Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from n/a through 1.2.

  Product

  Woocommerce Sales Funnel Builder

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Woocommerce Sales Funnel Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Jan 6, 2026UiChemy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69362 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH UiChemy uichemy allows Stored XSS.This issue affects UiChemy: from n/a through <= 4.4.2.

  Product

  UiChemy

  Affected

  up to 4.4.2

  What to do

  Affects up to 4.4.2. Update UiChemy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026TheGem Theme Elements (for WPBakery): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69360 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements allows DOM-Based XSS.This issue affects TheGem Theme Elements (for WPBakery): from n/a through <= 5.11.0.

  Product

  TheGem Theme Elements (for WPBakery)

  Affected

  up to 5.11.0

  What to do

  Affects up to 5.11.0. Update TheGem Theme Elements (for WPBakery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026TheGem Theme Elements (for Elementor): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69357 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor allows Stored XSS.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.11.0.

  Product

  TheGem Theme Elements (for Elementor)

  Affected

  up to 5.11.0

  What to do

  Affects up to 5.11.0. Update TheGem Theme Elements (for Elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026Accordion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69350 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion accordions-wp allows Stored XSS.This issue affects Accordion: from n/a through <= 3.0.3.

  Product

  Accordion

  Affected

  up to 3.0.3

  What to do

  Affects up to 3.0.3. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026Team Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69335 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Team Showcase team-showcase allows Stored XSS.This issue affects Team Showcase: from n/a through <= 2.9.

  Product

  Team Showcase

  Affected

  up to 2.9

  What to do

  Affects up to 2.9. Update Team Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026Wishlist for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69334 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Stored XSS.This issue affects Wishlist for WooCommerce: from n/a through <= 3.3.0.

  Product

  Wishlist for WooCommerce

  Affected

  up to 3.3.0

  What to do

  Affects up to 3.3.0. Update Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026JobBank: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69085 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins JobBank jobbank allows Reflected XSS.This issue affects JobBank: from n/a through <= 1.2.2.

  Product

  JobBank

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update JobBank to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69084 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Reflected XSS.This issue affects Photo Gallery: from n/a through <= 2.7.7.26.

  Product

  Photo Gallery

  Affected

  up to 2.7.7.26

  What to do

  Affects up to 2.7.7.26. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026AdsPlace'r – Ad Manager, Inserter, AdSense Ads: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-31088 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPShop.Ru AdsPlace'r – Ad Manager, Inserter, AdSense Ads allows DOM-Based XSS.This issue affects AdsPlace'r – Ad Manager, Inserter, AdSense Ads: from n/a through 1.1.5.

  Product

  AdsPlace'r – Ad Manager, Inserter, AdSense Ads

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update AdsPlace'r – Ad Manager, Inserter, AdSense Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026Header Image Slider: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-30547 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Shazdeh Header Image Slider header-image-slider allows DOM-Based XSS.This issue affects Header Image Slider: from n/a through 0.3.

  Product

  Header Image Slider

  Affected

  up to 0.3

  What to do

  Affects up to 0.3. Update Header Image Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026Dokan Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39497 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan Dokan Pro allows Stored XSS.This issue affects Dokan Pro: from n/a through 3.14.5.

  Product

  Dokan Pro

  Affected

  up to 3.14.5

  What to do

  Affects up to 3.14.5. Update Dokan Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026iPhone Webclip Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53735 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in corourke iPhone Webclip Manager iphone-webclip-manager allows Stored XSS.This issue affects iPhone Webclip Manager: from n/a through <= 0.5.

  Product

  iPhone Webclip Manager

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update iPhone Webclip Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026Booking Package: Improper Validation of Specified Quantity in InputCVE-2024-30516 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Validation of Specified Quantity in Input vulnerability in SaasProject Booking Package allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booking Package: from n/a through 1.6.27.

  Product

  Booking Package

  Affected

  up to 1.6.27

  What to do

  Affects up to 1.6.27. Update Booking Package to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026Tumult Hype Animations: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-30461 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tumult Inc Tumult Hype Animations allows DOM-Based XSS.This issue affects Tumult Hype Animations: from n/a through 1.9.11.

  Product

  Tumult Hype Animations

  Affected

  up to 1.9.11

  What to do

  Affects up to 1.9.11. Update Tumult Hype Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026The Plus Addons for Elementor Page Builder Lite: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-23511 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite allows DOM-Based XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 5.3.3.

  Product

  The Plus Addons for Elementor Page Builder Lite

  Affected

  up to 5.3.3

  What to do

  Affects up to 5.3.3. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026Geo Controller: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2023-51513 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in INTINITUM FORM Geo Controller allows DOM-Based XSS.This issue affects Geo Controller: from n/a through 8.5.2.

  Product

  Geo Controller

  Affected

  up to 8.5.2

  What to do

  Affects up to 8.5.2. Update Geo Controller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordvdp.patchstack.com

• Jan 5, 2026Machic Core: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2023-49186 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KlbTheme Machic Core allows DOM-Based XSS.This issue affects Machic Core: from n/a through 1.2.6.

  Product

  Machic Core

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update Machic Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordvdp.patchstack.com

• Dec 31, 2025Easy Social: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53235 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osuthorpe Easy Social easy-social-media allows Reflected XSS.This issue affects Easy Social: from n/a through <= 1.3.

  Product

  Easy Social

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Easy Social to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Sala: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52739 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Sala allows Reflected XSS.This issue affects Sala: from n/a through 1.1.3.

  Product

  Sala

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Sala to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50053 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nebelhorn Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App yournewsapp allows Reflected XSS.This issue affects Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App: from n/a through <= 0.8.8.8.

  Product

  Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App

  Affected

  up to 0.8.8.8

  What to do

  Affects up to 0.8.8.8. Update Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025ZoomSounds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47566 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomSounds allows Reflected XSS.This issue affects ZoomSounds: from n/a through 6.91.

  Product

  ZoomSounds

  Affected

  up to 6.91

  What to do

  Affects up to 6.91. Update ZoomSounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025ZD Scribd iPaper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23757 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Proloy Chakroborty ZD Scribd iPaper zd-scribd-ipaper allows Reflected XSS.This issue affects ZD Scribd iPaper: from n/a through <= 1.0.

  Product

  ZD Scribd iPaper

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update ZD Scribd iPaper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025ZhinaTwitterWidget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23719 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zckevin ZhinaTwitterWidget zhina-twitter-widget allows Reflected XSS.This issue affects ZhinaTwitterWidget: from n/a through <= 1.0.

  Product

  ZhinaTwitterWidget

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update ZhinaTwitterWidget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025En Masse: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23707 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matamko En Masse en-masse-wp allows Reflected XSS.This issue affects En Masse: from n/a through <= 1.0.

  Product

  En Masse

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update En Masse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Zielke Design Project Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23705 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry Zielke Zielke Design Project Gallery zielke-design-project-gallery allows Reflected XSS.This issue affects Zielke Design Project Gallery: from n/a through <= 2.5.0.

  Product

  Zielke Design Project Gallery

  Affected

  up to 2.5.0

  What to do

  Affects up to 2.5.0. Update Zielke Design Project Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025custom-post-edit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23667 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christopher Churchill custom-post-edit front-end-post-edit allows Reflected XSS.This issue affects custom-post-edit: from n/a through <= 1.0.4.

  Product

  custom-post-edit

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update custom-post-edit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Cooked: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62989 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gora Tech Cooked cooked allows Stored XSS.This issue affects Cooked: from n/a through <= 1.11.3.

  Product

  Cooked

  Affected

  up to 1.11.3

  What to do

  Affects up to 1.11.3. Update Cooked to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Behance Portfolio Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59135 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.

  Product

  Behance Portfolio Manager

  Affected

  up to 1.7.5

  What to do

  Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Accessibility Press: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49355 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ikaes Accessibility Press ilogic-accessibility allows Stored XSS.This issue affects Accessibility Press: from n/a through <= 1.0.2.

  Product

  Accessibility Press

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Accessibility Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Dashboard Beacon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49337 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in janhenckens Dashboard Beacon wp-dashboard-beacon allows Stored XSS.This issue affects Dashboard Beacon: from n/a through <= 1.2.0.

  Product

  Dashboard Beacon

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Dashboard Beacon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025LIVE TV: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23608 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Omar Mohamed Mohamoud LIVE TV live-tv allows Reflected XSS.This issue affects LIVE TV: from n/a through <= 1.2.

  Product

  LIVE TV

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update LIVE TV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Valenti Engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63021 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetipi Valenti Engine valenti-engine allows DOM-Based XSS.This issue affects Valenti Engine: from n/a through <= 1.0.3.

  Product

  Valenti Engine

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Valenti Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Postie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63020 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wayne Allen Postie postie allows Stored XSS.This issue affects Postie: from n/a through <= 1.9.73.

  Product

  Postie

  Affected

  up to 1.9.73

  What to do

  Affects up to 1.9.73. Update Postie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025WooCommerce Parcelas: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62750 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Filipe Seabra WooCommerce Parcelas woocommerce-parcelas allows DOM-Based XSS.This issue affects WooCommerce Parcelas: from n/a through <= 1.3.5.

  Product

  WooCommerce Parcelas

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update WooCommerce Parcelas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.