Vulnerability database

40,834 results · page 286 of 817

• Sep 22, 2025CP Multi View Event Calendar: Missing AuthorizationCVE-2025-58009 · WordPress plugins & themes · reported by PatchstackLow 3.8

  Missing Authorization vulnerability in codepeople CP Multi View Event Calendar cp-multi-view-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CP Multi View Event Calendar : from n/a through <= 1.4.35.

  Product

  CP Multi View Event Calendar

  Affected

  up to 1.4.35

  What to do

  Affects up to 1.4.35. Update CP Multi View Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Participants Database: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58008 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xnau webdesign Participants Database participants-database allows Stored XSS.This issue affects Participants Database: from n/a through <= 2.7.6.3.

  Product

  Participants Database

  Affected

  up to 2.7.6.3

  What to do

  Affects up to 2.7.6.3. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Hubbub Lite: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-58007 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.This issue affects Hubbub Lite: from n/a through <= 1.35.2.

  Product

  Hubbub Lite

  Affected

  up to 1.35.2

  What to do

  Affects up to 1.35.2. Update Hubbub Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Gravity Forms Keap/Infusionsoft: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-58006 · WordPress plugins & themes · reported by PatchstackMedium 4.7

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Phishing.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.6.

  Product

  WP Gravity Forms Keap/Infusionsoft

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update WP Gravity Forms Keap/Infusionsoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025DriCub: Server-Side Request Forgery (SSRF)CVE-2025-58005 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft DriCub dricub-driving-school allows Server Side Request Forgery.This issue affects DriCub: from n/a through <= 2.9.

  Product

  DriCub

  Affected

  up to 2.9

  What to do

  Affects up to 2.9. Update DriCub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025DriCub: Missing AuthorizationCVE-2025-58004 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in SmartDataSoft DriCub dricub-driving-school allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DriCub: from n/a through <= 2.9.

  Product

  DriCub

  Affected

  up to 2.9

  What to do

  Affects up to 2.9. Update DriCub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Javo Core: Missing AuthorizationCVE-2025-58003 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in javothemes Javo Core javo-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Javo Core: from n/a through <= 3.0.0.266.

  Product

  Javo Core

  Affected

  up to 3.0.0.266

  What to do

  Affects up to 3.0.0.266. Update Javo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025GD bbPress Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58002 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD bbPress Tools gd-bbpress-tools allows DOM-Based XSS.This issue affects GD bbPress Tools: from n/a through <= 3.5.3.

  Product

  GD bbPress Tools

  Affected

  up to 3.5.3

  What to do

  Affects up to 3.5.3. Update GD bbPress Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Compact Archives: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58001 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Compact Archives compact-archives allows Stored XSS.This issue affects Compact Archives: from n/a through <= 4.1.0.

  Product

  Compact Archives

  Affected

  up to 4.1.0

  What to do

  Affects up to 4.1.0. Update Compact Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Memberful - Membership: Missing AuthorizationCVE-2025-58000 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in memberful Memberful - Membership Plugin memberful-wp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberful - Membership Plugin: from n/a through <= 1.75.0.

  Product

  Memberful - Membership

  Affected

  up to 1.75.0

  What to do

  Affects up to 1.75.0. Update Memberful - Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WPKoi Templates for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57999 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows DOM-Based XSS.This issue affects WPKoi Templates for Elementor: from n/a through <= 3.4.3.

  Product

  WPKoi Templates for Elementor

  Affected

  up to 3.4.3

  What to do

  Affects up to 3.4.3. Update WPKoi Templates for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025E-namad & Shamed Logo Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57998 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hamid Reza Yazdani E-namad & Shamed Logo Manager e-namad-shamed-logo-manager allows Stored XSS.This issue affects E-namad & Shamed Logo Manager: from n/a through <= 2.2.

  Product

  E-namad & Shamed Logo Manager

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update E-namad & Shamed Logo Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Trustpilot Reviews: Missing AuthorizationCVE-2025-57997 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Trustpilot Trustpilot Reviews trustpilot-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trustpilot Reviews: from n/a through <= 2.5.925.

  Product

  Trustpilot Reviews

  Affected

  up to 2.5.925

  What to do

  Affects up to 2.5.925. Update Trustpilot Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Buckets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57996 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthewordie Buckets buckets allows Stored XSS.This issue affects Buckets: from n/a through <= 0.3.9.

  Product

  Buckets

  Affected

  up to 0.3.9

  What to do

  Affects up to 0.3.9. Update Buckets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025DethemeKit For Elementor: Missing AuthorizationCVE-2025-57995 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DethemeKit For Elementor: from n/a through <= 2.1.10.

  Product

  DethemeKit For Elementor

  Affected

  up to 2.1.10

  What to do

  Affects up to 2.1.10. Update DethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Upcoming Events Lists: Authorization Bypass Through User-Controlled KeyCVE-2025-57994 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authorization Bypass Through User-Controlled Key vulnerability in Sayful Islam Upcoming Events Lists upcoming-events-lists allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upcoming Events Lists: from n/a through <= 1.4.0.

  Product

  Upcoming Events Lists

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Upcoming Events Lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Geolocation IP Detection: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57993 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Pick Geolocation IP Detection geoip-detect allows Stored XSS.This issue affects Geolocation IP Detection: from n/a through <= 5.5.0.

  Product

  Geolocation IP Detection

  Affected

  up to 5.5.0

  What to do

  Affects up to 5.5.0. Update Geolocation IP Detection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Mail Baby SMTP: Cross-Site Request Forgery (CSRF)CVE-2025-57992 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in InterServer Mail Baby SMTP mail-baby-smtp allows Cross Site Request Forgery.This issue affects Mail Baby SMTP: from n/a through <= 2.8.

  Product

  Mail Baby SMTP

  Affected

  up to 2.8

  What to do

  Affects up to 2.8. Update Mail Baby SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Clariti: Missing AuthorizationCVE-2025-57991 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Clariti Clariti clariti allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clariti: from n/a through <= 1.2.1.

  Product

  Clariti

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Clariti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Blog Designer: Missing AuthorizationCVE-2025-57990 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in solwininfotech Blog Designer blog-designer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blog Designer: from n/a through <= 3.1.8.

  Product

  Blog Designer

  Affected

  up to 3.1.8

  What to do

  Affects up to 3.1.8. Update Blog Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WordPress Widgets Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57989 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brajesh Singh WordPress Widgets Shortcode wp-widgets-shortcode allows Stored XSS.This issue affects WordPress Widgets Shortcode: from n/a through <= 1.0.3.

  Product

  WordPress Widgets Shortcode

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update WordPress Widgets Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Uncanny Toolkit for LearnDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57988 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.3.

  Product

  Uncanny Toolkit for LearnDash

  Affected

  up to 3.7.0.3

  What to do

  Affects up to 3.7.0.3. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Events Manager: Missing AuthorizationCVE-2025-57987 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in ThimPress WP Events Manager wp-events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Events Manager: from n/a through <= 2.2.1.

  Product

  WP Events Manager

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update WP Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Subtitle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57986 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in husani WP Subtitle wp-subtitle allows Stored XSS.This issue affects WP Subtitle: from n/a through <= 3.4.1.

  Product

  WP Subtitle

  Affected

  up to 3.4.1

  What to do

  Affects up to 3.4.1. Update WP Subtitle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Ultimate Watermark: Missing AuthorizationCVE-2025-57985 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in MantraBrain Ultimate Watermark ultimate-watermark allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Watermark: from n/a through <= 1.1.

  Product

  Ultimate Watermark

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Ultimate Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025MakeStories (for Google Web Stories): Server-Side Request Forgery (SSRF)CVE-2025-57984 · WordPress plugins & themes · reported by PatchstackMedium 4.4

  Server-Side Request Forgery (SSRF) vulnerability in Pratik Ghela MakeStories (for Google Web Stories) makestories-helper allows Server Side Request Forgery.This issue affects MakeStories (for Google Web Stories): from n/a through <= 3.0.4.

  Product

  MakeStories (for Google Web Stories)

  Affected

  up to 3.0.4

  What to do

  Affects up to 3.0.4. Update MakeStories (for Google Web Stories) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025BP Disable Activation Reloaded: Cross-Site Request Forgery (CSRF)CVE-2025-57983 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in Damian BP Disable Activation Reloaded bp-disable-activation-reloaded allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BP Disable Activation Reloaded: from n/a through <= 1.2.1.

  Product

  BP Disable Activation Reloaded

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update BP Disable Activation Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Advance Portfolio Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57982 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean Advance Portfolio Grid advance-portfolio-grid allows Stored XSS.This issue affects Advance Portfolio Grid: from n/a through <= 1.07.6.

  Product

  Advance Portfolio Grid

  Affected

  up to 1.07.6

  What to do

  Affects up to 1.07.6. Update Advance Portfolio Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Social Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57981 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through <= 2.3.1.

  Product

  WP Social Widget

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update WP Social Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Safety Exit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57980 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomas Cordero Safety Exit safety-exit allows Stored XSS.This issue affects Safety Exit: from n/a through <= 1.8.0.

  Product

  Safety Exit

  Affected

  up to 1.8.0

  What to do

  Affects up to 1.8.0. Update Safety Exit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025AuthorSure: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57979 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson AuthorSure authorsure allows Stored XSS.This issue affects AuthorSure: from n/a through <= 2.3.

  Product

  AuthorSure

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update AuthorSure to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Advanced Appointment Booking & Scheduling: Cross-Site Request Forgery (CSRF)CVE-2025-57978 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in themespride Advanced Appointment Booking & Scheduling advanced-appointment-booking-scheduling allows Cross Site Request Forgery.This issue affects Advanced Appointment Booking & Scheduling: from n/a through <= 2.1.

  Product

  Advanced Appointment Booking & Scheduling

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Advanced Appointment Booking & Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Flexible PDF Invoices for WooCommerce &: Cross-Site Request Forgery (CSRF)CVE-2025-57977 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible PDF Invoices for WooCommerce & WordPress flexible-invoices allows Cross Site Request Forgery.This issue affects Flexible PDF Invoices for WooCommerce & WordPress: from n/a through <= 6.0.13.

  Product

  Flexible PDF Invoices for WooCommerce &

  Affected

  up to 6.0.13

  What to do

  Affects up to 6.0.13. Update Flexible PDF Invoices for WooCommerce & to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025CardCom Payment Gateway: Missing AuthorizationCVE-2025-57976 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in CardCom CardCom Payment Gateway woo-cardcom-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CardCom Payment Gateway: from n/a through <= 3.5.0.7.

  Product

  CardCom Payment Gateway

  Affected

  up to 3.5.0.7

  What to do

  Affects up to 3.5.0.7. Update CardCom Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Team: Missing AuthorizationCVE-2025-57975 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.6.

  Product

  Team

  Affected

  up to 5.0.6

  What to do

  Affects up to 5.0.6. Update Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025TZ PlusGallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57974 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tuyennv TZ PlusGallery tz-plus-gallery allows Stored XSS.This issue affects TZ PlusGallery: from n/a through <= 1.5.5.

  Product

  TZ PlusGallery

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update TZ PlusGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP-Members: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57973 · WordPress plugins & themes · reported by PatchstackMedium 5.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chad Butler WP-Members wp-members allows Stored XSS.This issue affects WP-Members: from n/a through <= 3.5.4.2.

  Product

  WP-Members

  Affected

  up to 3.5.4.2

  What to do

  Affects up to 3.5.4.2. Update WP-Members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Helpdesk Support Ticket System for WooCommerce: Missing AuthorizationCVE-2025-57972 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in WPFactory Helpdesk Support Ticket System for WooCommerce support-ticket-system-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Helpdesk Support Ticket System for WooCommerce: from n/a through <= 2.1.1.

  Product

  Helpdesk Support Ticket System for WooCommerce

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update Helpdesk Support Ticket System for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025SALESmanago & Leadoo: Missing AuthorizationCVE-2025-57971 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALESmanago & Leadoo: from n/a through <= 3.8.1.

  Product

  SALESmanago & Leadoo

  Affected

  up to 3.8.1

  What to do

  Affects up to 3.8.1. Update SALESmanago & Leadoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025SALESmanago & Leadoo: Cross-Site Request Forgery (CSRF)CVE-2025-57970 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Cross Site Request Forgery.This issue affects SALESmanago & Leadoo: from n/a through <= 3.8.1.

  Product

  SALESmanago & Leadoo

  Affected

  up to 3.8.1

  What to do

  Affects up to 3.8.1. Update SALESmanago & Leadoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Hide WP Toolbar: Missing AuthorizationCVE-2025-57969 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Jeremy Saxey Hide WP Toolbar hide-wp-toolbar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hide WP Toolbar: from n/a through <= 2.7.

  Product

  Hide WP Toolbar

  Affected

  up to 2.7

  What to do

  Affects up to 2.7. Update Hide WP Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025VikRestaurants: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57968 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Reflected XSS.This issue affects VikRestaurants: from n/a through <= 1.5.

  Product

  VikRestaurants

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update VikRestaurants to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WPB Quick View for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57967 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean WPB Quick View for WooCommerce woocommerce-lightbox allows Stored XSS.This issue affects WPB Quick View for WooCommerce: from n/a through <= 2.1.8.

  Product

  WPB Quick View for WooCommerce

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update WPB Quick View for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Gallery Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57966 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery Lightbox gallery-lightbox-slider allows Stored XSS.This issue affects Gallery Lightbox: from n/a through <= 1.0.0.41.

  Product

  Gallery Lightbox

  Affected

  up to 1.0.0.41

  What to do

  Affects up to 1.0.0.41. Update Gallery Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Proposals: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57965 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs WP Proposals allows Stored XSS. This issue affects WP Proposals: from n/a through 2.3.

  Product

  WP Proposals

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update WP Proposals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Library Bookshelves: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57964 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in photonicgnostic Library Bookshelves library-bookshelves allows Stored XSS.This issue affects Library Bookshelves: from n/a through <= 5.11.

  Product

  Library Bookshelves

  Affected

  up to 5.11

  What to do

  Affects up to 5.11. Update Library Bookshelves to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Zoho Billing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57963 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Subscriptions Zoho Billing zoho-subscriptions allows DOM-Based XSS.This issue affects Zoho Billing: from n/a through <= 4.1.

  Product

  Zoho Billing

  Affected

  up to 4.1

  What to do

  Affects up to 4.1. Update Zoho Billing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025VikRestaurants: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57962 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Stored XSS.This issue affects VikRestaurants: from n/a through <= 1.5.1.

  Product

  VikRestaurants

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update VikRestaurants to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025CoDesigner: Missing AuthorizationCVE-2025-57961 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Codexpert, Inc CoDesigner woolementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoDesigner: from n/a through <= 4.29.

  Product

  CoDesigner

  Affected

  up to 4.29

  What to do

  Affects up to 4.29. Update CoDesigner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Travel Map: Cross-Site Request Forgery (CSRF)CVE-2025-57960 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in TravelMap Travel Map travelmap-blog allows Cross Site Request Forgery.This issue affects Travel Map: from n/a through <= 1.0.3.

  Product

  Travel Map

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Travel Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.