Updated 10 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

5,857 results · page 25 of 118

Oct 22, 2025Contact Form by Supsystic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52753 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Reflected XSS.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.36.
Product
Contact Form by Supsystic
Affected
up to 1.7.36
What to do
Affects up to 1.7.36. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Slide Puzzle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52751 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in colome Slide Puzzle slide-puzzle allows Reflected XSS.This issue affects Slide Puzzle: from n/a through <= 1.0.0.
Product
Slide Puzzle
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Slide Puzzle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Emu2: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52750 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juergen Schulze Emu2 emu2-email-users-2 allows Reflected XSS.This issue affects Emu2: from n/a through <= 0.83b.
Product
Emu2
Affected
up to 0.83b
What to do
Affects up to 0.83b. Update Emu2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Uji Countdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52749 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Activity Track Uji Countdown uji-countdown allows Reflected XSS.This issue affects Uji Countdown: from n/a through <= 2.3.3.
Product
Uji Countdown
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update Uji Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Directory Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52748 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Directory Pro directory-pro allows Reflected XSS.This issue affects Directory Pro: from n/a through <= 2.5.5.
Product
Directory Pro
Affected
up to 2.5.5
What to do
Affects up to 2.5.5. Update Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025oik-privacy-policy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52743 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bobbingwide oik-privacy-policy oik-privacy-policy allows Reflected XSS.This issue affects oik-privacy-policy: from n/a through <= 1.4.10.
Product
oik-privacy-policy
Affected
up to 1.4.10
What to do
Affects up to 1.4.10. Update oik-privacy-policy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Pets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52742 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Benic Pets pets allows Reflected XSS.This issue affects Pets: from n/a through <= 1.4.1.
Product
Pets
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Pets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Post Connector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52741 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barry Kooij Post Connector post-connector allows Reflected XSS.This issue affects Post Connector: from n/a through <= 1.0.11.
Product
Post Connector
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update Post Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Finale Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52736 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daman Jeet Finale Lite finale-woocommerce-sales-countdown-timer-discount allows Reflected XSS.This issue affects Finale Lite: from n/a through <= 2.20.0.
Product
Finale Lite
Affected
up to 2.20.0
What to do
Affects up to 2.20.0. Update Finale Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025NextMove Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52735 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Reflected XSS.This issue affects NextMove Lite: from n/a through <= 2.24.0.
Product
NextMove Lite
Affected
up to 2.24.0
What to do
Affects up to 2.24.0. Update NextMove Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025CropRefine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52734 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 CropRefine croprefine allows Reflected XSS.This issue affects CropRefine: from n/a through <= 1.2.1.
Product
CropRefine
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update CropRefine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025LearnPress Export Import: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49992 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress Export Import learnpress-import-export allows Reflected XSS.This issue affects LearnPress Export Import: from n/a through <= 4.0.9.
Product
LearnPress Export Import
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update LearnPress Export Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Simple Stripe Checkout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49963 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in growniche Simple Stripe Checkout simple-stripe-checkout allows Reflected XSS.This issue affects Simple Stripe Checkout: from n/a through <= 1.1.28.
Product
Simple Stripe Checkout
Affected
up to 1.1.28
What to do
Affects up to 1.1.28. Update Simple Stripe Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025bbPress Notify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49962 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in useStrict bbPress Notify bbpress-notify-nospam allows Reflected XSS.This issue affects bbPress Notify: from n/a through <= 2.19.5.
Product
bbPress Notify
Affected
up to 2.19.5
What to do
Affects up to 2.19.5. Update bbPress Notify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025LeadBI Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49960 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leadbi LeadBI Plugin for WordPress leadbi allows Stored XSS.This issue affects LeadBI Plugin for WordPress: from n/a through <= 1.7.
Product
LeadBI Plugin for
Affected
up to 1.7
What to do
Affects up to 1.7. Update LeadBI Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025bbPress Move Topics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49959 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pascal Casier bbPress Move Topics bbp-move-topics allows Reflected XSS.This issue affects bbPress Move Topics: from n/a through <= 1.1.6.
Product
bbPress Move Topics
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update bbPress Move Topics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Robokassa payment gateway for Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49958 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robokassa Robokassa payment gateway for Woocommerce robokassa allows Reflected XSS.This issue affects Robokassa payment gateway for Woocommerce: from n/a through <= 1.8.6.
Product
Robokassa payment gateway for Woocommerce
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update Robokassa payment gateway for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Email Attachment by Order Status & Products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49957 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weboccult Technologies Pvt Ltd Email Attachment by Order Status & Products email-attachment-by-order-status-products allows Reflected XSS.This issue affects Email Attachment by Order Status & Products: from n/a through <= 1.0.1.
Product
Email Attachment by Order Status & Products
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Email Attachment by Order Status & Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Fade Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49956 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anandaraj Balu Fade Slider fade-slider allows Reflected XSS.This issue affects Fade Slider: from n/a through <= 2.5.
Product
Fade Slider
Affected
up to 2.5
What to do
Affects up to 2.5. Update Fade Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WP Smart Flexslider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49955 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rajan Vijayan WP Smart Flexslider wp-smart-flexslider allows Reflected XSS.This issue affects WP Smart Flexslider: from n/a through <= 2.5.
Product
WP Smart Flexslider
Affected
up to 2.5
What to do
Affects up to 2.5. Update WP Smart Flexslider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WP-Click-Tracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49954 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mithra62 WP-Click-Tracker wp-click-track allows Reflected XSS.This issue affects WP-Click-Tracker: from n/a through <= 0.7.3.
Product
WP-Click-Tracker
Affected
up to 0.7.3
What to do
Affects up to 0.7.3. Update WP-Click-Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025ShareBang, Ultimate Social Share Buttons for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49953 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeinity ShareBang, Ultimate Social Share Buttons for WordPress sharebang allows Reflected XSS.This issue affects ShareBang, Ultimate Social Share Buttons for WordPress: from n/a through <= 1.4.
Product
ShareBang, Ultimate Social Share Buttons for
Affected
up to 1.4
What to do
Affects up to 1.4. Update ShareBang, Ultimate Social Share Buttons for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025gAppointments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49951 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpcrunch gAppointments gAppointments allows Reflected XSS.This issue affects gAppointments: from n/a through <= 1.14.1.
Product
gAppointments
Affected
up to 1.14.1
What to do
Affects up to 1.14.1. Update gAppointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WP Super Edit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49948 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad Awais WP Super Edit wp-super-edit allows Reflected XSS.This issue affects WP Super Edit: from n/a through <= 2.5.4.
Product
WP Super Edit
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update WP Super Edit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WooCommerce Registration Fields Plugin - Custom Signup Fields: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49947 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendons WooCommerce Registration Fields Plugin - Custom Signup Fields extendons-registration-fields allows Reflected XSS.This issue affects WooCommerce Registration Fields Plugin - Custom Signup Fields: from n/a through <= 3.2.3.
Product
WooCommerce Registration Fields Plugin - Custom Signup Fields
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update WooCommerce Registration Fields Plugin - Custom Signup Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Auto Login After Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49946 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cynob IT Consultancy Auto Login After Registration auto-login-after-registration allows Reflected XSS.This issue affects Auto Login After Registration: from n/a through <= 1.0.0.
Product
Auto Login After Registration
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Auto Login After Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Shortcode Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49945 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kylegetson Shortcode Generator shortcode-generator allows Reflected XSS.This issue affects Shortcode Generator: from n/a through <= 1.1.
Product
Shortcode Generator
Affected
up to 1.1
What to do
Affects up to 1.1. Update Shortcode Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WPCode Content Ratio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49944 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonatan Jumbert WPCode Content Ratio wpcode-content-ratio allows Reflected XSS.This issue affects WPCode Content Ratio: from n/a through <= 2.0.
Product
WPCode Content Ratio
Affected
up to 2.0
What to do
Affects up to 2.0. Update WPCode Content Ratio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Fusion Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49940 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows DOM-Based XSS.This issue affects Fusion Builder: from n/a through <= 3.13.2.
Product
Fusion Builder
Affected
up to 3.13.2
What to do
Affects up to 3.13.2. Update Fusion Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49939 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.8.
Product
JetElements For Elementor
Affected
up to 2.7.8
What to do
Affects up to 2.7.8. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49938 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.3.
Product
JetEngine
Affected
up to 3.7.3
What to do
Affects up to 3.7.3. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WoodMart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49936 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart woodmart allows DOM-Based XSS.This issue affects WoodMart: from n/a through < 8.3.2.
Product
WoodMart
What to do
Update WoodMart to the newest version.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025JetBlocks For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49934 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.18.
Product
JetBlocks For Elementor
Affected
up to 1.3.18
What to do
Affects up to 1.3.18. Update JetBlocks For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025JetBlog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49933 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through <= 2.4.4.
Product
JetBlog
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update JetBlog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025JetBlog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49932 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Stored XSS.This issue affects JetBlog: from n/a through <= 2.4.4.1.
Product
JetBlog
Affected
up to 2.4.4.1
What to do
Affects up to 2.4.4.1. Update JetBlog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025JetSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49930 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows Reflected XSS.This issue affects JetSearch: from n/a through <= 3.5.10.
Product
JetSearch
Affected
up to 3.5.10
What to do
Affects up to 3.5.10. Update JetSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Ultimate Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49929 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows Stored XSS.This issue affects Ultimate Blocks: from n/a through <= 3.3.6.
Product
Ultimate Blocks
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update Ultimate Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025JetWooBuilder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49928 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows DOM-Based XSS.This issue affects JetWooBuilder: from n/a through <= 2.1.20.
Product
JetWooBuilder
Affected
up to 2.1.20
What to do
Affects up to 2.1.20. Update JetWooBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025JetWooBuilder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49927 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Stored XSS.This issue affects JetWooBuilder: from n/a through <= 2.1.20.1.
Product
JetWooBuilder
Affected
up to 2.1.20.1
What to do
Affects up to 2.1.20.1. Update JetWooBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Seriously Simple Podcasting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49923 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows DOM-Based XSS.This issue affects Seriously Simple Podcasting: from n/a through <= 3.11.1.
Product
Seriously Simple Podcasting
Affected
up to 3.11.1
What to do
Affects up to 3.11.1. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Email Subscription Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49912 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nks Email Subscription Popup email-subscribe allows Stored XSS.This issue affects Email Subscription Popup: from n/a through <= 1.2.26.
Product
Email Subscription Popup
Affected
up to 1.2.26
What to do
Affects up to 1.2.26. Update Email Subscription Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WooCommerce Vehicle Parts Finder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49911 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Reflected XSS.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7.
Product
WooCommerce Vehicle Parts Finder
Affected
up to 3.7
What to do
Affects up to 3.7. Update WooCommerce Vehicle Parts Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WPC Countdown Timer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49908 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Countdown Timer for WooCommerce wpc-countdown-timer allows Stored XSS.This issue affects WPC Countdown Timer for WooCommerce: from n/a through <= 3.1.4.
Product
WPC Countdown Timer for WooCommerce
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update WPC Countdown Timer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Survey Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48098 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.8.8.
Product
Survey Maker
Affected
up to 5.1.8.8
What to do
Affects up to 5.1.8.8. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WSAnalytics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48097 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiva WSAnalytics wsanalytics-google-analytics-and-dashboards allows Reflected XSS.This issue affects WSAnalytics: from n/a through <= 1.1.2.
Product
WSAnalytics
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WSAnalytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Survey Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48095 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.8.8.
Product
Survey Maker
Affected
up to 5.1.8.8
What to do
Affects up to 5.1.8.8. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Password only login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48093 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Calvaweb Password only login password-only-login allows Reflected XSS.This issue affects Password only login: from n/a through <= 0.2.
Product
Password only login
Affected
up to 0.2
What to do
Affects up to 0.2. Update Password only login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Fix Multiple Redirects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48092 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jurajpuchky Fix Multiple Redirects fix-multiple-redirects allows Reflected XSS.This issue affects Fix Multiple Redirects: from n/a through <= 1.2.3.
Product
Fix Multiple Redirects
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Fix Multiple Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Terms Dictionary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39534 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Somonator Terms Dictionary terms-dictionary allows Reflected XSS.This issue affects Terms Dictionary: from n/a through <= 1.5.1.
Product
Terms Dictionary
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Terms Dictionary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2025Memberlite Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48087 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason C. Memberlite Shortcodes memberlite-shortcodes allows Stored XSS.This issue affects Memberlite Shortcodes: from n/a through 1.4.1.
Product
Memberlite Shortcodes
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Memberlite Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.