Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

5,857 results · page 28 of 118

Sep 22, 2025Sitekit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58229 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue affects Sitekit: from n/a through <= 2.0.
Product
Sitekit
Affected
up to 2.0
What to do
Affects up to 2.0. Update Sitekit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Quick View for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58228 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC Quick View for WooCommerce woo-quickview allows Stored XSS.This issue affects Quick View for WooCommerce: from n/a through <= 2.2.16.
Product
Quick View for WooCommerce
Affected
up to 2.2.16
What to do
Affects up to 2.2.16. Update Quick View for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Podlove Subscribe button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58227 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alexander Lueken Podlove Subscribe button podlove-subscribe-button allows Stored XSS.This issue affects Podlove Subscribe button: from n/a through <= 1.3.11.
Product
Podlove Subscribe button
Affected
up to 1.3.11
What to do
Affects up to 1.3.11. Update Podlove Subscribe button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025VoucherPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58223 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Taylor VoucherPress voucherpress allows Stored XSS.This issue affects VoucherPress: from n/a through <= 1.5.7.
Product
VoucherPress
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update VoucherPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Card Elements for WPBakery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58220 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Techeshta Card Elements for WPBakery card-elements-for-wpbakery allows DOM-Based XSS.This issue affects Card Elements for WPBakery: from n/a through <= 1.0.8.
Product
Card Elements for WPBakery
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Card Elements for WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Draft: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58033 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leeshadle Draft website-builder allows Stored XSS.This issue affects Draft: from n/a through <= 3.0.9.
Product
Draft
Affected
up to 3.0.9
What to do
Affects up to 3.0.9. Update Draft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Nextend Facebook Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58031 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nextendweb Nextend Facebook Connect nextend-facebook-connect allows Stored XSS.This issue affects Nextend Facebook Connect : from n/a through <= 3.1.19.
Product
Nextend Facebook Connect
Affected
up to 3.1.19
What to do
Affects up to 3.1.19. Update Nextend Facebook Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Page-list: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58030 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Page-list page-list allows Stored XSS.This issue affects Page-list: from n/a through <= 5.8.
Product
Page-list
Affected
up to 5.8
What to do
Affects up to 5.8. Update Page-list to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Designil PDPA Thailand: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58028 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aum Watcharapon Designil PDPA Thailand pdpa-thailand allows Stored XSS.This issue affects Designil PDPA Thailand: from n/a through <= 2.0.1.
Product
Designil PDPA Thailand
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Designil PDPA Thailand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025NGG Smart Image Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58027 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows Stored XSS.This issue affects NGG Smart Image Search: from n/a through <= 3.4.3.
Product
NGG Smart Image Search
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update NGG Smart Image Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Termageddon: Cookie Consent & Privacy Compliance: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58026 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in termageddon Termageddon: Cookie Consent & Privacy Compliance termageddon-usercentrics allows Stored XSS.This issue affects Termageddon: Cookie Consent & Privacy Compliance: from n/a through <= 1.8.1.
Product
Termageddon: Cookie Consent & Privacy Compliance
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Termageddon: Cookie Consent & Privacy Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Master Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58025 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Master Slider master-slider allows Stored XSS.This issue affects Master Slider: from n/a through <= 3.11.0.
Product
Master Slider
Affected
up to 3.11.0
What to do
Affects up to 3.11.0. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Genealogical Tree: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58023 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in akdevs Genealogical Tree genealogical-tree allows Stored XSS.This issue affects Genealogical Tree: from n/a through <= 2.2.7.
Product
Genealogical Tree
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update Genealogical Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025ShortCode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58022 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxpagels ShortCode shortcode allows Stored XSS.This issue affects ShortCode: from n/a through <= 0.8.1.
Product
ShortCode
Affected
up to 0.8.1
What to do
Affects up to 0.8.1. Update ShortCode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025List Child Pages Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58021 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in douglaskarr List Child Pages Shortcode list-child-pages-shortcode allows Stored XSS.This issue affects List Child Pages Shortcode: from n/a through <= 1.3.1.
Product
List Child Pages Shortcode
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update List Child Pages Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Theater for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58020 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress theatre allows Stored XSS.This issue affects Theater for WordPress: from n/a through <= 0.18.8.
Product
Theater for
Affected
up to 0.18.8
What to do
Affects up to 0.18.8. Update Theater for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Search Atlas SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58019 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Search Atlas Group Search Atlas SEO metasync allows Stored XSS.This issue affects Search Atlas SEO: from n/a through <= 2.5.4.
Product
Search Atlas SEO
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update Search Atlas SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Mail Subscribe List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58018 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Leishman Mail Subscribe List mail-subscribe-list allows Stored XSS.This issue affects Mail Subscribe List: from n/a through <= 2.1.10.
Product
Mail Subscribe List
Affected
up to 2.1.10
What to do
Affects up to 2.1.10. Update Mail Subscribe List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Ultimate Store Kit Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58017 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.8.6.
Product
Ultimate Store Kit Elementor Addons
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Participants Database: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58008 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xnau webdesign Participants Database participants-database allows Stored XSS.This issue affects Participants Database: from n/a through <= 2.7.6.3.
Product
Participants Database
Affected
up to 2.7.6.3
What to do
Affects up to 2.7.6.3. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025GD bbPress Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58002 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD bbPress Tools gd-bbpress-tools allows DOM-Based XSS.This issue affects GD bbPress Tools: from n/a through <= 3.5.3.
Product
GD bbPress Tools
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update GD bbPress Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Compact Archives: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58001 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Compact Archives compact-archives allows Stored XSS.This issue affects Compact Archives: from n/a through <= 4.1.0.
Product
Compact Archives
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Compact Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WPKoi Templates for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57999 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows DOM-Based XSS.This issue affects WPKoi Templates for Elementor: from n/a through <= 3.4.3.
Product
WPKoi Templates for Elementor
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update WPKoi Templates for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025E-namad & Shamed Logo Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57998 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hamid Reza Yazdani E-namad & Shamed Logo Manager e-namad-shamed-logo-manager allows Stored XSS.This issue affects E-namad & Shamed Logo Manager: from n/a through <= 2.2.
Product
E-namad & Shamed Logo Manager
Affected
up to 2.2
What to do
Affects up to 2.2. Update E-namad & Shamed Logo Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Buckets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57996 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthewordie Buckets buckets allows Stored XSS.This issue affects Buckets: from n/a through <= 0.3.9.
Product
Buckets
Affected
up to 0.3.9
What to do
Affects up to 0.3.9. Update Buckets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Geolocation IP Detection: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57993 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Pick Geolocation IP Detection geoip-detect allows Stored XSS.This issue affects Geolocation IP Detection: from n/a through <= 5.5.0.
Product
Geolocation IP Detection
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update Geolocation IP Detection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WordPress Widgets Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57989 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brajesh Singh WordPress Widgets Shortcode wp-widgets-shortcode allows Stored XSS.This issue affects WordPress Widgets Shortcode: from n/a through <= 1.0.3.
Product
WordPress Widgets Shortcode
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update WordPress Widgets Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Uncanny Toolkit for LearnDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57988 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.3.
Product
Uncanny Toolkit for LearnDash
Affected
up to 3.7.0.3
What to do
Affects up to 3.7.0.3. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WP Subtitle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57986 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in husani WP Subtitle wp-subtitle allows Stored XSS.This issue affects WP Subtitle: from n/a through <= 3.4.1.
Product
WP Subtitle
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update WP Subtitle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Advance Portfolio Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57982 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean Advance Portfolio Grid advance-portfolio-grid allows Stored XSS.This issue affects Advance Portfolio Grid: from n/a through <= 1.07.6.
Product
Advance Portfolio Grid
Affected
up to 1.07.6
What to do
Affects up to 1.07.6. Update Advance Portfolio Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WP Social Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57981 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through <= 2.3.1.
Product
WP Social Widget
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update WP Social Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Safety Exit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57980 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomas Cordero Safety Exit safety-exit allows Stored XSS.This issue affects Safety Exit: from n/a through <= 1.8.0.
Product
Safety Exit
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update Safety Exit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025AuthorSure: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57979 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson AuthorSure authorsure allows Stored XSS.This issue affects AuthorSure: from n/a through <= 2.3.
Product
AuthorSure
Affected
up to 2.3
What to do
Affects up to 2.3. Update AuthorSure to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025TZ PlusGallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57974 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tuyennv TZ PlusGallery tz-plus-gallery allows Stored XSS.This issue affects TZ PlusGallery: from n/a through <= 1.5.5.
Product
TZ PlusGallery
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update TZ PlusGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WP-Members: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57973 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chad Butler WP-Members wp-members allows Stored XSS.This issue affects WP-Members: from n/a through <= 3.5.4.2.
Product
WP-Members
Affected
up to 3.5.4.2
What to do
Affects up to 3.5.4.2. Update WP-Members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025VikRestaurants: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57968 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Reflected XSS.This issue affects VikRestaurants: from n/a through <= 1.5.
Product
VikRestaurants
Affected
up to 1.5
What to do
Affects up to 1.5. Update VikRestaurants to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WPB Quick View for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57967 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean WPB Quick View for WooCommerce woocommerce-lightbox allows Stored XSS.This issue affects WPB Quick View for WooCommerce: from n/a through <= 2.1.8.
Product
WPB Quick View for WooCommerce
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update WPB Quick View for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Gallery Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57966 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery Lightbox gallery-lightbox-slider allows Stored XSS.This issue affects Gallery Lightbox: from n/a through <= 1.0.0.41.
Product
Gallery Lightbox
Affected
up to 1.0.0.41
What to do
Affects up to 1.0.0.41. Update Gallery Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WP Proposals: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57965 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs WP Proposals allows Stored XSS. This issue affects WP Proposals: from n/a through 2.3.
Product
WP Proposals
Affected
up to 2.3
What to do
Affects up to 2.3. Update WP Proposals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Library Bookshelves: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57964 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in photonicgnostic Library Bookshelves library-bookshelves allows Stored XSS.This issue affects Library Bookshelves: from n/a through <= 5.11.
Product
Library Bookshelves
Affected
up to 5.11
What to do
Affects up to 5.11. Update Library Bookshelves to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Zoho Billing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57963 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Subscriptions Zoho Billing zoho-subscriptions allows DOM-Based XSS.This issue affects Zoho Billing: from n/a through <= 4.1.
Product
Zoho Billing
Affected
up to 4.1
What to do
Affects up to 4.1. Update Zoho Billing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025VikRestaurants: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57962 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Stored XSS.This issue affects VikRestaurants: from n/a through <= 1.5.1.
Product
VikRestaurants
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update VikRestaurants to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Slightly troublesome permalink: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57959 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tmatsuur Slightly troublesome permalink slightly-troublesome-permalink allows Stored XSS.This issue affects Slightly troublesome permalink: from n/a through <= 1.2.0.
Product
Slightly troublesome permalink
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Slightly troublesome permalink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WooMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57956 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpcraft WooMS wooms allows Stored XSS.This issue affects WooMS: from n/a through <= 9.12.
Product
WooMS
Affected
up to 9.12
What to do
Affects up to 9.12. Update WooMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Poll Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57954 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Poll Maker poll-maker allows DOM-Based XSS.This issue affects Poll Maker: from n/a through <= 6.0.2.
Product
Poll Maker
Affected
up to 6.0.2
What to do
Affects up to 6.0.2. Update Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Open User Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57953 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 100plugins Open User Map open-user-map allows DOM-Based XSS.This issue affects Open User Map: from n/a through <= 1.4.14.
Product
Open User Map
Affected
up to 1.4.14
What to do
Affects up to 1.4.14. Update Open User Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Maps for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57952 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc Maps for WP maps-for-wp allows Stored XSS.This issue affects Maps for WP: from n/a through <= 1.2.5.
Product
Maps for WP
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Maps for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025SiteNarrator Text-to-Speech Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57951 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ken107 SiteNarrator Text-to-Speech Widget sitespeaker-widget allows Stored XSS.This issue affects SiteNarrator Text-to-Speech Widget: from n/a through <= 1.9.
Product
SiteNarrator Text-to-Speech Widget
Affected
up to 1.9
What to do
Affects up to 1.9. Update SiteNarrator Text-to-Speech Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Plugin Security Scanner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57950 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Glen Scott Plugin Security Scanner plugin-security-scanner allows Stored XSS.This issue affects Plugin Security Scanner: from n/a through <= 2.0.2.
Product
Plugin Security Scanner
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Plugin Security Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Directory Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57948 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Directory Pro directory-pro allows DOM-Based XSS.This issue affects Directory Pro: from n/a through <= 2.5.5.
Product
Directory Pro
Affected
up to 2.5.5
What to do
Affects up to 2.5.5. Update Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.