Vulnerability database

40,834 results · page 284 of 817

• Sep 22, 2025Magento 2 WordPress Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58669 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modern Minds Magento 2 WordPress Integration m2wp allows Stored XSS.This issue affects Magento 2 WordPress Integration: from n/a through <= 1.4.2.1.

  Product

  Magento 2 WordPress Integration

  Affected

  up to 1.4.2.1

  What to do

  Affects up to 1.4.2.1. Update Magento 2 WordPress Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WPLMS: Missing AuthorizationCVE-2025-58668 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in VibeThemes WPLMS wplms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLMS : from n/a through <= 4.970.

  Product

  WPLMS

  Affected

  up to 4.970

  What to do

  Affects up to 4.970. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025ListingPro Reviews: Missing AuthorizationCVE-2025-58667 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro Reviews: from n/a through < 2.9.11.

  Product

  ListingPro Reviews

  What to do

  Update ListingPro Reviews to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Website Chat Button: Kommo integration: Missing AuthorizationCVE-2025-58666 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Kommo Website Chat Button: Kommo integration website-chat-button-kommo-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Website Chat Button: Kommo integration: from n/a through <= 1.3.1.

  Product

  Website Chat Button: Kommo integration

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Website Chat Button: Kommo integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Form Generator for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58665 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tmontg1 Form Generator for WordPress form-generator-powered-by-jotform allows Stored XSS.This issue affects Form Generator for WordPress: from n/a through <= 1.52.

  Product

  Form Generator for

  Affected

  up to 1.52

  What to do

  Affects up to 1.52. Update Form Generator for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Text To Speech TTS Accessibility: Missing AuthorizationCVE-2025-58664 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Azizul Hasan Text To Speech TTS Accessibility text-to-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Text To Speech TTS Accessibility: from n/a through <= 1.9.30.

  Product

  Text To Speech TTS Accessibility

  Affected

  up to 1.9.30

  What to do

  Affects up to 1.9.30. Update Text To Speech TTS Accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Qubely: Missing AuthorizationCVE-2025-58663 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Themeum Qubely qubely allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Qubely: from n/a through <= 1.8.14.

  Product

  Qubely

  Affected

  up to 1.8.14

  What to do

  Affects up to 1.8.14. Update Qubely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Awesome Support: Deserialization of Untrusted DataCVE-2025-58662 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Deserialization of Untrusted Data vulnerability in awesomesupport Awesome Support awesome-support allows Object Injection.This issue affects Awesome Support: from n/a through <= 6.3.5.

  Product

  Awesome Support

  Affected

  up to 6.3.5

  What to do

  Affects up to 6.3.5. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025eZee Online Hotel Booking Engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58661 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eZee Technosys eZee Online Hotel Booking Engine online-booking-engine allows Stored XSS.This issue affects eZee Online Hotel Booking Engine: from n/a through <= 1.0.0.

  Product

  eZee Online Hotel Booking Engine

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update eZee Online Hotel Booking Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Oshine Core: Missing AuthorizationCVE-2025-58660 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in brandexponents Oshine Core oshine-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oshine Core: from n/a through <= 1.5.5.

  Product

  Oshine Core

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update Oshine Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Helpie FAQ: Use of Hard-coded CredentialsCVE-2025-58659 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Use of Hard-coded Credentials vulnerability in Essekia Helpie FAQ helpie-faq allows Retrieve Embedded Sensitive Data.This issue affects Helpie FAQ: from n/a through <= 1.45.

  Product

  Helpie FAQ

  Affected

  up to 1.45

  What to do

  Affects up to 1.45. Update Helpie FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Proof Factor – Social Proof Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58658 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Proof Factor LLC Proof Factor – Social Proof Notifications proof-factor-social-proof-notifications allows Stored XSS.This issue affects Proof Factor – Social Proof Notifications: from n/a through <= 1.0.5.

  Product

  Proof Factor – Social Proof Notifications

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Proof Factor – Social Proof Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Grid: Cross-Site Request Forgery (CSRF)CVE-2025-58657 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in EdwardBock Grid grid allows Stored XSS.This issue affects Grid: from n/a through <= 2.3.1.

  Product

  Grid

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Estonian Shipping Methods for WooCommerce: Use of Hard-coded CredentialsCVE-2025-58656 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Use of Hard-coded Credentials vulnerability in Risto Niinemets Estonian Shipping Methods for WooCommerce estonian-shipping-methods-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Estonian Shipping Methods for WooCommerce: from n/a through <= 1.7.2.

  Product

  Estonian Shipping Methods for WooCommerce

  Affected

  up to 1.7.2

  What to do

  Affects up to 1.7.2. Update Estonian Shipping Methods for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Category Featured Images: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58655 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mat Category Featured Images category-featured-images allows Stored XSS.This issue affects Category Featured Images: from n/a through <= 1.1.8.

  Product

  Category Featured Images

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update Category Featured Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025xili-language: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58654 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-language xili-language allows DOM-Based XSS.This issue affects xili-language: from n/a through <= 2.21.3.

  Product

  xili-language

  Affected

  up to 2.21.3

  What to do

  Affects up to 2.21.3. Update xili-language to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025JSM file_get_contents() Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58653 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JS Morisset JSM file_get_contents() Shortcode wp-file-get-contents allows Stored XSS.This issue affects JSM file_get_contents() Shortcode: from n/a through <= 2.7.1.

  Product

  JSM file_get_contents() Shortcode

  Affected

  up to 2.7.1

  What to do

  Affects up to 2.7.1. Update JSM file_get_contents() Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Carousel Ultimate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58652 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Carousel Ultimate carousel allows Stored XSS.This issue affects Carousel Ultimate: from n/a through <= 1.8.

  Product

  Carousel Ultimate

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update Carousel Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025PlayerJS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58651 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PlayerJS PlayerJS playerjs allows DOM-Based XSS.This issue affects PlayerJS: from n/a through <= 2.24.

  Product

  PlayerJS

  Affected

  up to 2.24

  What to do

  Affects up to 2.24. Update PlayerJS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025All In One SEO Pack: Missing AuthorizationCVE-2025-58650 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All In One SEO Pack: from n/a through <= 4.8.7.1.

  Product

  All In One SEO Pack

  Affected

  up to 4.8.7.1

  What to do

  Affects up to 4.8.7.1. Update All In One SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025All In One SEO Pack: Insertion of Sensitive Information Into Sent DataCVE-2025-58649 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n/a through <= 4.8.7.1.

  Product

  All In One SEO Pack

  Affected

  up to 4.8.7.1

  What to do

  Affects up to 4.8.7.1. Update All In One SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Simple JWT Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58648 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Stored XSS.This issue affects Simple JWT Login: from n/a through <= 3.6.4.

  Product

  Simple JWT Login

  Affected

  up to 3.6.4

  What to do

  Affects up to 3.6.4. Update Simple JWT Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Simple Restaurant Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58647 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Will.I.am Simple Restaurant Menu simple-restaurant-menu allows Stored XSS.This issue affects Simple Restaurant Menu: from n/a through <= 1.2.

  Product

  Simple Restaurant Menu

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Simple Restaurant Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Mobi2Go: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58646 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chtombleson Mobi2Go mobi2go allows Stored XSS.This issue affects Mobi2Go: from n/a through <= 1.0.0.

  Product

  Mobi2Go

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Mobi2Go to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Gravitate Automated Tester: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58645 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gravitate Gravitate Automated Tester gravitate-automated-tester allows Stored XSS.This issue affects Gravitate Automated Tester: from n/a through <= 1.4.5.

  Product

  Gravitate Automated Tester

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update Gravitate Automated Tester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025AnyClip Luminous Studio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58271 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AnyClip Video Platform AnyClip Luminous Studio anyclip-media allows Stored XSS.This issue affects AnyClip Luminous Studio: from n/a through <= 1.3.3.

  Product

  AnyClip Luminous Studio

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update AnyClip Luminous Studio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025NIX Anti-Spam Light: Cross-Site Request Forgery (CSRF)CVE-2025-58270 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in NIX Solutions Ltd NIX Anti-Spam Light nix-anti-spam-light allows Cross Site Request Forgery.This issue affects NIX Anti-Spam Light: from n/a through <= 0.0.4.

  Product

  NIX Anti-Spam Light

  Affected

  up to 0.0.4

  What to do

  Affects up to 0.0.4. Update NIX Anti-Spam Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Project Manager: Use of Hard-coded CredentialsCVE-2025-58269 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Use of Hard-coded Credentials vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 2.6.25.

  Product

  WP Project Manager

  Affected

  up to 2.6.25

  What to do

  Affects up to 2.6.25. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WPMK PDF Generator: Cross-Site Request Forgery (CSRF)CVE-2025-58268 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in WPMK WPMK PDF Generator wpmk-pdf-generator allows Stored XSS.This issue affects WPMK PDF Generator: from n/a through <= 1.0.1.

  Product

  WPMK PDF Generator

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update WPMK PDF Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Stock Message: Cross-Site Request Forgery (CSRF)CVE-2025-58267 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Aftabul Islam Stock Message stock-message allows Stored XSS.This issue affects Stock Message: from n/a through <= 1.1.0.

  Product

  Stock Message

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Stock Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Gianism: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58266 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fumiki Takahashi Gianism gianism allows Stored XSS.This issue affects Gianism: from n/a through <= 6.0.0.

  Product

  Gianism

  Affected

  up to 6.0.0

  What to do

  Affects up to 6.0.0. Update Gianism to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Events Manager – OpenStreetMaps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58265 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stonehenge Creations Events Manager – OpenStreetMaps stonehenge-em-osm allows Stored XSS.This issue affects Events Manager – OpenStreetMaps: from n/a through <= 4.2.1.

  Product

  Events Manager – OpenStreetMaps

  Affected

  up to 4.2.1

  What to do

  Affects up to 4.2.1. Update Events Manager – OpenStreetMaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025JupiterX Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58264 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artbees JupiterX Core jupiterx-core allows Stored XSS.This issue affects JupiterX Core: from n/a through <= 4.11.0.

  Product

  JupiterX Core

  Affected

  up to 4.11.0

  What to do

  Affects up to 4.11.0. Update JupiterX Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025BuddyPress Notification Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58263 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev BuddyPress Notification Widget buddypress-notifications-widget allows Stored XSS.This issue affects BuddyPress Notification Widget: from n/a through <= 1.3.3.

  Product

  BuddyPress Notification Widget

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update BuddyPress Notification Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Sweet Energy Efficiency: Cross-Site Request Forgery (CSRF)CVE-2025-58262 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in WPDirectoryKit Sweet Energy Efficiency sweet-energy-efficiency allows Stored XSS.This issue affects Sweet Energy Efficiency: from n/a through <= 1.0.8.

  Product

  Sweet Energy Efficiency

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Sweet Energy Efficiency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Mavis HTTPS to HTTP Redirection: Cross-Site Request Forgery (CSRF)CVE-2025-58261 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in PressPage Entertainment Inc Mavis HTTPS to HTTP Redirection mavis-https-to-http-redirect allows Stored XSS.This issue affects Mavis HTTPS to HTTP Redirection: from n/a through <= 1.4.3.

  Product

  Mavis HTTPS to HTTP Redirection

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update Mavis HTTPS to HTTP Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Highlight and Share: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58260 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Stored XSS.This issue affects Highlight and Share: from n/a through <= 5.1.1.

  Product

  Highlight and Share

  Affected

  up to 5.1.1

  What to do

  Affects up to 5.1.1. Update Highlight and Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Nokri: Cross-Site Request Forgery (CSRF)CVE-2025-58259 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in scriptsbundle Nokri nokri allows Cross Site Request Forgery.This issue affects Nokri: from n/a through <= 1.6.4.

  Product

  Nokri

  Affected

  up to 1.6.4

  What to do

  Affects up to 1.6.4. Update Nokri to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Lazy Blocks: Missing AuthorizationCVE-2025-58258 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in nK Lazy Blocks lazy-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lazy Blocks: from n/a through <= 4.1.0.

  Product

  Lazy Blocks

  Affected

  up to 4.1.0

  What to do

  Affects up to 4.1.0. Update Lazy Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Verowa Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58257 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Stored XSS.This issue affects Verowa Connect: from n/a through <= 3.2.3.

  Product

  Verowa Connect

  Affected

  up to 3.2.3

  What to do

  Affects up to 3.2.3. Update Verowa Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025DOAJ Export: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58256 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Brinley DOAJ Export doaj-export allows Stored XSS.This issue affects DOAJ Export: from n/a through <= 1.0.4.

  Product

  DOAJ Export

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update DOAJ Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Custom Post Type Images: Cross-Site Request Forgery (CSRF)CVE-2025-58255 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in yonisink Custom Post Type Images custom-post-types-image allows Code Injection.This issue affects Custom Post Type Images: from n/a through <= 0.5.

  Product

  Custom Post Type Images

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update Custom Post Type Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025StylePress for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58254 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dtbaker StylePress for Elementor full-site-builder-for-elementor allows Stored XSS.This issue affects StylePress for Elementor: from n/a through <= 1.2.1.

  Product

  StylePress for Elementor

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update StylePress for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Real Estate Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58253 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows DOM-Based XSS.This issue affects Real Estate Manager: from n/a through <= 7.3.

  Product

  Real Estate Manager

  Affected

  up to 7.3

  What to do

  Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Getwid: Insertion of Sensitive Information Into Sent DataCVE-2025-58252 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Insertion of Sensitive Information Into Sent Data vulnerability in jetmonsters Getwid getwid allows Retrieve Embedded Sensitive Data.This issue affects Getwid: from n/a through <= 2.1.2.

  Product

  Getwid

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Getwid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Sticky Header Effects for Elementor: Missing AuthorizationCVE-2025-58251 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in POSIMYTH Sticky Header Effects for Elementor sticky-header-effects-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Header Effects for Elementor: from n/a through <= 2.1.2.

  Product

  Sticky Header Effects for Elementor

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Sticky Header Effects for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Findgo: Cross-Site Request Forgery (CSRF)CVE-2025-58250 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in ApusTheme Findgo fingo allows Authentication Bypass.This issue affects Findgo: from n/a through <= 1.3.55.

  Product

  Findgo

  Affected

  up to 1.3.55

  What to do

  Affects up to 1.3.55. Update Findgo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Qubely: Insertion of Sensitive Information Into Sent DataCVE-2025-58249 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Insertion of Sensitive Information Into Sent Data vulnerability in Themeum Qubely qubely allows Retrieve Embedded Sensitive Data.This issue affects Qubely: from n/a through <= 1.8.14.

  Product

  Qubely

  Affected

  up to 1.8.14

  What to do

  Affects up to 1.8.14. Update Qubely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Pinterest Pinboard Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58248 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codefish Pinterest Pinboard Widget pinterest-pinboard-widget allows Stored XSS.This issue affects Pinterest Pinboard Widget: from n/a through <= 1.0.7.

  Product

  Pinterest Pinboard Widget

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Pinterest Pinboard Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025TI WooCommerce Wishlist: Missing AuthorizationCVE-2025-58247 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.

  Product

  TI WooCommerce Wishlist

  Affected

  up to 2.10.0

  What to do

  Affects up to 2.10.0. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.