Vulnerability database

6,570 results · page 28 of 132

• Oct 26, 2025WP Mapbox GL JS Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62942 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tempranova WP Mapbox GL JS Maps wp-mapbox-gl-js allows Stored XSS.This issue affects WP Mapbox GL JS Maps: from n/a through <= 3.0.1.

  Product

  WP Mapbox GL JS Maps

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update WP Mapbox GL JS Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025Events Maker by dFactory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62941 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Events Maker by dFactory events-maker allows Stored XSS.This issue affects Events Maker by dFactory: from n/a through <= 1.6.14.

  Product

  Events Maker by dFactory

  Affected

  up to 1.6.14

  What to do

  Affects up to 1.6.14. Update Events Maker by dFactory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025Blox Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62940 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Diego Blox Lite blox-lite allows Stored XSS.This issue affects Blox Lite: from n/a through <= 1.2.8.

  Product

  Blox Lite

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update Blox Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025Open Currency Converter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62939 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Open Currency Converter artiss-currency-converter allows Stored XSS.This issue affects Open Currency Converter: from n/a through <= 1.5.0.

  Product

  Open Currency Converter

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update Open Currency Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025Post List Featured Image: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62937 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johnny Post List Featured Image post-list-featured-image allows Stored XSS.This issue affects Post List Featured Image: from n/a through <= 0.5.9.

  Product

  Post List Featured Image

  Affected

  up to 0.5.9

  What to do

  Affects up to 0.5.9. Update Post List Featured Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025xSmart: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-62936 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Jthemes xSmart xsmart allows Code Injection.This issue affects xSmart: from n/a through <= 1.2.9.4.

  Product

  xSmart

  Affected

  up to 1.2.9.4

  What to do

  Affects up to 1.2.9.4. Update xSmart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025MapSVG: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62930 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows DOM-Based XSS.This issue affects MapSVG: from n/a through <= 8.7.22.

  Product

  MapSVG

  Affected

  up to 8.7.22

  What to do

  Affects up to 8.7.22. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025Marquee Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62923 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debuggers Studio Marquee Addons for Elementor marquee-addons-for-elementor allows DOM-Based XSS.This issue affects Marquee Addons for Elementor: from n/a through <= 3.8.2.

  Product

  Marquee Addons for Elementor

  Affected

  up to 3.8.2

  What to do

  Affects up to 3.8.2. Update Marquee Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025Bulk Auto Image Title Attribute: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62921 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup Bulk Auto Image Title Attribute bulk-image-title-attribute allows DOM-Based XSS.This issue affects Bulk Auto Image Title Attribute: from n/a through <= 2.0.1.

  Product

  Bulk Auto Image Title Attribute

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Bulk Auto Image Title Attribute to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025USERCENTRICS CMP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62920 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webnique USERCENTRICS CMP usercentrics-consent-management-platform allows Stored XSS.This issue affects USERCENTRICS CMP: from n/a through <= 1.0.9.

  Product

  USERCENTRICS CMP

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update USERCENTRICS CMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025Tooltipy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62917 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows Stored XSS.This issue affects Tooltipy: from n/a through <= 5.5.9.

  Product

  Tooltipy

  Affected

  up to 5.5.9

  What to do

  Affects up to 5.5.9. Update Tooltipy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025Opal Service: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62913 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpopal Opal Service opal-service allows Stored XSS.This issue affects Opal Service: from n/a through <= 1.9.1.

  Product

  Opal Service

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update Opal Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025SiteGround Email Marketing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62912 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SiteGround SiteGround Email Marketing siteground-email-marketing allows Stored XSS.This issue affects SiteGround Email Marketing: from n/a through <= 1.7.1.

  Product

  SiteGround Email Marketing

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update SiteGround Email Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025Rock Convert: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62911 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rock Content Rock Convert rock-convert allows Stored XSS.This issue affects Rock Convert: from n/a through <= 3.0.1.

  Product

  Rock Convert

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update Rock Convert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025Video Gallery by Huzzaz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62910 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deshine Video Gallery by Huzzaz huzzaz-video-gallery allows Stored XSS.This issue affects Video Gallery by Huzzaz: from n/a through <= 10.5.

  Product

  Video Gallery by Huzzaz

  Affected

  up to 10.5

  What to do

  Affects up to 10.5. Update Video Gallery by Huzzaz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025Custom Post Type Attachment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62907 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Custom Post Type Attachment custom-post-type-pdf-attachment allows Stored XSS.This issue affects Custom Post Type Attachment: from n/a through <= 3.4.6.

  Product

  Custom Post Type Attachment

  Affected

  up to 3.4.6

  What to do

  Affects up to 3.4.6. Update Custom Post Type Attachment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025Query Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62905 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Tadlock Query Posts query-posts allows Stored XSS.This issue affects Query Posts: from n/a through <= 0.3.2.

  Product

  Query Posts

  Affected

  up to 0.3.2

  What to do

  Affects up to 0.3.2. Update Query Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025WP Geo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62904 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ben Huson WP Geo wp-geo allows Stored XSS.This issue affects WP Geo: from n/a through <= 3.5.1.

  Product

  WP Geo

  Affected

  up to 3.5.1

  What to do

  Affects up to 3.5.1. Update WP Geo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025WPC Smart Messages for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62903 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Smart Messages for WooCommerce wpc-smart-messages allows Stored XSS.This issue affects WPC Smart Messages for WooCommerce: from n/a through <= 4.2.8.

  Product

  WPC Smart Messages for WooCommerce

  Affected

  up to 4.2.8

  What to do

  Affects up to 4.2.8. Update WPC Smart Messages for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025Popular Posts by Webline: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62900 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WeblineIndia Popular Posts by Webline popular-posts-by-webline allows Stored XSS.This issue affects Popular Posts by Webline: from n/a through <= 1.1.1.

  Product

  Popular Posts by Webline

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Popular Posts by Webline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025Photospace Responsive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62899 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in THRIVE - Web Design Gold Coast Photospace Responsive photospace-responsive allows Stored XSS.This issue affects Photospace Responsive: from n/a through <= 2.2.0.

  Product

  Photospace Responsive

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update Photospace Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025Links shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62898 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maarten Links shortcode links-shortcode allows Stored XSS.This issue affects Links shortcode: from n/a through <= 1.8.3.

  Product

  Links shortcode

  Affected

  up to 1.8.3

  What to do

  Affects up to 1.8.3. Update Links shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025WP Recipe Maker: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-62897 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Code Injection.This issue affects WP Recipe Maker: from n/a through < 10.1.0.

  Product

  WP Recipe Maker

  What to do

  Update WP Recipe Maker to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025ACF Recent Posts Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62894 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magicoders ACF Recent Posts Widget acf-recent-posts-widget allows Stored XSS.This issue affects ACF Recent Posts Widget: from n/a through <= 5.9.3.

  Product

  ACF Recent Posts Widget

  Affected

  up to 5.9.3

  What to do

  Affects up to 5.9.3. Update ACF Recent Posts Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025King Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62887 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KingAddons.com King Addons for Elementor king-addons allows DOM-Based XSS.This issue affects King Addons for Elementor: from n/a through <= 51.1.61.

  Product

  King Addons for Elementor

  Affected

  up to 51.1.61

  What to do

  Affects up to 51.1.61. Update King Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2025WP VR: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62885 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affects WP VR: from n/a through <= 8.5.48.

  Product

  WP VR

  Affected

  up to 8.5.48

  What to do

  Affects up to 8.5.48. Update WP VR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 25, 2025The7 — Website and eCommerce Builder for: Stored Cross-Site ScriptingCVE-2025-11897 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ the7_fancy_title_css’ parameter in all versions up to, and including, 12.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  The7 — Website and eCommerce Builder for

  Affected

  up to 12.9.1

  What to do

  Affects up to 12.9.1. Update The7 — Website and eCommerce Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordthemeforest.networdfence.com

• Oct 24, 2025eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams: Exposure of sensitive informationCVE-2025-11760 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin for WordPress is vulnerable to exposure of sensitive information in all versions up to, and including, 1.5.6. This is due to the plugin exposing Zoom SDK secret keys in client-side JavaScript within the meeting view template. This makes it possible for unauthenticated attackers to extract the sdk_secret value, which should remain server-side, compromising the security of the Zoom integration and allowing attackers to generate valid JWT signatures for unauthorized meeting access.

  Product

  eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams

  Affected

  up to 1.5.6

  What to do

  Affects up to 1.5.6. Update eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 22, 2025MDTF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62069 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter.This issue affects MDTF: from n/a through <= 1.3.3.8.

  Product

  MDTF

  Affected

  up to 1.3.3.8

  What to do

  Affects up to 1.3.3.8. Update MDTF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025e2pdf: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62068 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.28.09.

  Product

  e2pdf

  Affected

  up to 1.28.09

  What to do

  Affects up to 1.28.09. Update e2pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WP Travel Gutenberg Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62063 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel Gutenberg Blocks wp-travel-blocks.This issue affects WP Travel Gutenberg Blocks: from n/a through <= 3.9.2.

  Product

  WP Travel Gutenberg Blocks

  Affected

  up to 3.9.2

  What to do

  Affects up to 3.9.2. Update WP Travel Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Tab Ultimate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62060 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Tab Ultimate tabs-pro.This issue affects Tab Ultimate: from n/a through <= 1.8.

  Product

  Tab Ultimate

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update Tab Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Houzez Theme - Functionality: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62058 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through < 4.2.0.

  Product

  Houzez Theme - Functionality

  What to do

  Update Houzez Theme - Functionality to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62042 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post.This issue affects Event post: from n/a through <= 5.10.3.

  Product

  Event post

  Affected

  up to 5.10.3

  What to do

  Affects up to 5.10.3. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Pie Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62024 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Jernigan Pie Calendar pie-calendar.This issue affects Pie Calendar: from n/a through <= 1.2.9.

  Product

  Pie Calendar

  Affected

  up to 1.2.9

  What to do

  Affects up to 1.2.9. Update Pie Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025VOD Infomaniak: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62020 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak.This issue affects VOD Infomaniak: from n/a through <= 1.5.11.

  Product

  VOD Infomaniak

  Affected

  up to 1.5.11

  What to do

  Affects up to 1.5.11. Update VOD Infomaniak to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Simple Finance Calculator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60246 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weissmike Simple Finance Calculator simple-finance-calculator allows Reflected XSS.This issue affects Simple Finance Calculator: from n/a through <= 1.0.

  Product

  Simple Finance Calculator

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Simple Finance Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WP Tesseract: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60176 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tattersoftware WP Tesseract wp-tesseract allows Stored XSS.This issue affects WP Tesseract: from n/a through <= 1.0.2.

  Product

  WP Tesseract

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update WP Tesseract to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WeShare Buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60135 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NIKITAS GEORGOPOULOS WeShare Buttons e-mailit allows Stored XSS.This issue affects WeShare Buttons: from n/a through <= 13.0.0.

  Product

  WeShare Buttons

  Affected

  up to 13.0.0

  What to do

  Affects up to 13.0.0. Update WeShare Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Werk aan de Muur: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60131 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoefff Werk aan de Muur werk-aan-de-muur allows Stored XSS.This issue affects Werk aan de Muur: from n/a through <= 1.5.

  Product

  Werk aan de Muur

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Werk aan de Muur to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Colibri Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59593 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through < 1.0.334.

  Product

  Colibri Page Builder

  Fixed in

  1.0.334

  What to do

  Update Colibri Page Builder to 1.0.334 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WorkScout-Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59571 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affects WorkScout-Core: from n/a through < 1.7.06.

  Product

  WorkScout-Core

  What to do

  Update WorkScout-Core to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Easy Woocommerce Customizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59006 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Easy Woocommerce Customizer easy-woocommerce-customizer allows Reflected XSS.This issue affects Easy Woocommerce Customizer: from n/a through <= 1.0.2.

  Product

  Easy Woocommerce Customizer

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Easy Woocommerce Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WC Return products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59004 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pco_58 WC Return products wc-return-product allows Reflected XSS.This issue affects WC Return products: from n/a through <= 1.5.

  Product

  WC Return products

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update WC Return products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Doctreat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58971 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AmentoTech Doctreat doctreat allows Reflected XSS.This issue affects Doctreat: from n/a through <= 1.6.7.

  Product

  Doctreat

  Affected

  up to 1.6.7

  What to do

  Affects up to 1.6.7. Update Doctreat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Doctreat: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-58970 · WordPress plugins & themes · reported by PatchstackMedium 6.3

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AmentoTech Doctreat doctreat allows Code Injection.This issue affects Doctreat: from n/a through <= 1.6.7.

  Product

  Doctreat

  Affected

  up to 1.6.7

  What to do

  Affects up to 1.6.7. Update Doctreat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025NEX-Forms LITE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58966 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms LITE nex-forms-lite allows Reflected XSS.This issue affects NEX-Forms LITE: from n/a through < 8.2.

  Product

  NEX-Forms LITE

  What to do

  Update NEX-Forms LITE to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025CF7 Auto Responder Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58961 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kamleshyadav CF7 Auto Responder Addon CF7-autoresponder-addon allows DOM-Based XSS.This issue affects CF7 Auto Responder Addon: from n/a through <= 2.4.

  Product

  CF7 Auto Responder Addon

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update CF7 Auto Responder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WP Tactical Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58921 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arevico WP Tactical Popup wp-tactical-popup allows Reflected XSS.This issue affects WP Tactical Popup: from n/a through <= 1.1.

  Product

  WP Tactical Popup

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update WP Tactical Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Author: Munzir: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58916 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Munzir Author: Munzir myshouts-shoutbox allows Reflected XSS.This issue affects Author: Munzir: from n/a through <= 0.9.

  Product

  Author: Munzir

  Affected

  up to 0.9

  What to do

  Affects up to 0.9. Update Author: Munzir to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.