Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

5,817 results · page 30 of 117

Sep 5, 2025WP Notification Bell: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58821 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdever WP Notification Bell wp-notification-bell allows Stored XSS.This issue affects WP Notification Bell: from n/a through <= 1.4.6.
Product
WP Notification Bell
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update WP Notification Bell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Carousel Ultimate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58820 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Carousel Ultimate carousel allows Stored XSS.This issue affects Carousel Ultimate: from n/a through <= 1.8.
Product
Carousel Ultimate
Affected
up to 1.8
What to do
Affects up to 1.8. Update Carousel Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Stagtools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58814 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ram Ratan Maurya Stagtools stagtools allows Stored XSS.This issue affects Stagtools: from n/a through <= 2.3.8.
Product
Stagtools
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update Stagtools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Best Restaurant Menu by PriceListo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58812 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PriceListo Best Restaurant Menu by PriceListo best-restaurant-menu-by-pricelisto allows Stored XSS.This issue affects Best Restaurant Menu by PriceListo: from n/a through <= 1.4.3.
Product
Best Restaurant Menu by PriceListo
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Best Restaurant Menu by PriceListo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Ultimate Client Dash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58811 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Ultimate Client Dash ulimate-client-dash allows Stored XSS.This issue affects Ultimate Client Dash: from n/a through <= 4.7.
Product
Ultimate Client Dash
Affected
up to 4.7
What to do
Affects up to 4.7. Update Ultimate Client Dash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Simple Link List Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58810 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jimmywb Simple Link List Widget simple-link-list-widget allows Stored XSS.This issue affects Simple Link List Widget: from n/a through <= 0.3.2.
Product
Simple Link List Widget
Affected
up to 0.3.2
What to do
Affects up to 0.3.2. Update Simple Link List Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025prettyPhoto: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58808 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Babar prettyPhoto prettyphoto allows Stored XSS.This issue affects prettyPhoto: from n/a through <= 1.2.5.
Product
prettyPhoto
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update prettyPhoto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Widgetize Pages Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58805 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Stored XSS.This issue affects Widgetize Pages Light: from n/a through <= 3.0.
Product
Widgetize Pages Light
Affected
up to 3.0
What to do
Affects up to 3.0. Update Widgetize Pages Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Elementor Element Condition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58796 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dudaster Elementor Element Condition ele-conditions allows Stored XSS.This issue affects Elementor Element Condition: from n/a through <= 1.0.5.
Product
Elementor Element Condition
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Elementor Element Condition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025WPB Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58793 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean WPB Elementor Addons wpb-elementor-addons allows Stored XSS.This issue affects WPB Elementor Addons: from n/a through <= 1.7.
Product
WPB Elementor Addons
Affected
up to 1.7
What to do
Affects up to 1.7. Update WPB Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025SEO Auto Linker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58791 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arjan Olsder SEO Auto Linker wpa-seo-auto-linker allows Stored XSS.This issue affects SEO Auto Linker: from n/a through <= 1.5.3.
Product
SEO Auto Linker
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update SEO Auto Linker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Kiwi: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58790 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Kiwi kiwi-social-share allows Stored XSS.This issue affects Kiwi: from n/a through <= 2.1.8.
Product
Kiwi
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update Kiwi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Themify Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58787 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Popup themify-popup allows Stored XSS.This issue affects Themify Popup: from n/a through <= 1.4.2.
Product
Themify Popup
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Themify Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Ibtana – Ecommerce Product Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58786 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VW THEMES Ibtana – Ecommerce Product Addons ibtana-ecommerce-product-addons allows DOM-Based XSS.This issue affects Ibtana – Ecommerce Product Addons: from n/a through <= 0.4.7.6.
Product
Ibtana – Ecommerce Product Addons
Affected
up to 0.4.7.6
What to do
Affects up to 0.4.7.6. Update Ibtana – Ecommerce Product Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025ARI Fancy Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58784 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arisoft ARI Fancy Lightbox ari-fancy-lightbox allows Stored XSS.This issue affects ARI Fancy Lightbox: from n/a through <= 1.4.0.
Product
ARI Fancy Lightbox
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update ARI Fancy Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025Document Engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58640 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MatrixAddons Document Engine document-engine allows Stored XSS.This issue affects Document Engine: from n/a through <= 1.2.
Product
Document Engine
Affected
up to 1.2
What to do
Affects up to 1.2. Update Document Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025Booking Ultra Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58633 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Stored XSS.This issue affects Booking Ultra Pro: from n/a through <= 1.1.21.
Product
Booking Ultra Pro
Affected
up to 1.1.21
What to do
Affects up to 1.1.21. Update Booking Ultra Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025Dadevarzan WordPress Common: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58632 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dadevarzan Dadevarzan WordPress Common dadevarzan-common allows Stored XSS.This issue affects Dadevarzan WordPress Common: from n/a through <= 2.2.2.
Product
Dadevarzan WordPress Common
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Dadevarzan WordPress Common to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025IssueM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58631 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZEEN101 IssueM issuem allows DOM-Based XSS.This issue affects IssueM: from n/a through <= 2.9.0.
Product
IssueM
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update IssueM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025Simple Matomo Tracking Code: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58630 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rbaer Simple Matomo Tracking Code simple-matomo-tracking-code allows Stored XSS.This issue affects Simple Matomo Tracking Code: from n/a through <= 1.1.0.
Product
Simple Matomo Tracking Code
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Simple Matomo Tracking Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025RumbleTalk Live Group Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58626 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Stored XSS.This issue affects RumbleTalk Live Group Chat: from n/a through <= 6.3.5.
Product
RumbleTalk Live Group Chat
Affected
up to 6.3.5
What to do
Affects up to 6.3.5. Update RumbleTalk Live Group Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025WP Flow Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58625 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through <= 5.2.5.
Product
WP Flow Plus
Affected
up to 5.2.5
What to do
Affects up to 5.2.5. Update WP Flow Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025Exchange Rates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58624 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in falselight Exchange Rates exchange-rates allows Stored XSS.This issue affects Exchange Rates: from n/a through <= 1.2.5.
Product
Exchange Rates
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Exchange Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025Event Feed for Eventbrite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58623 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bohemia Plugins Event Feed for Eventbrite event-feed-for-eventbrite allows DOM-Based XSS.This issue affects Event Feed for Eventbrite: from n/a through <= 1.3.2.
Product
Event Feed for Eventbrite
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Event Feed for Eventbrite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025PuzzleMe for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58621 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amuse Labs PuzzleMe for WordPress puzzleme allows Stored XSS.This issue affects PuzzleMe for WordPress: from n/a through <= 1.2.0.
Product
PuzzleMe for
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update PuzzleMe for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025PDF for WPForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58620 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Stored XSS.This issue affects PDF for WPForms: from n/a through <= 6.2.1.
Product
PDF for WPForms
Affected
up to 6.2.1
What to do
Affects up to 6.2.1. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025Pie Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58618 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Jernigan Pie Calendar pie-calendar allows DOM-Based XSS.This issue affects Pie Calendar: from n/a through <= 1.2.8.
Product
Pie Calendar
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update Pie Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025Tooltipy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58614 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows Stored XSS.This issue affects Tooltipy: from n/a through <= 5.5.6.
Product
Tooltipy
Affected
up to 5.5.6
What to do
Affects up to 5.5.6. Update Tooltipy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025PropertyHive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58612 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Stored XSS.This issue affects PropertyHive: from n/a through <= 2.1.5.
Product
PropertyHive
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025Gallery PhotoBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through <= 1.3.1.
Product
Gallery PhotoBlocks
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Gallery PhotoBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025Latest Post Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58609 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Stored XSS.This issue affects Latest Post Shortcode: from n/a through <= 14.0.3.
Product
Latest Post Shortcode
Affected
up to 14.0.3
What to do
Affects up to 14.0.3. Update Latest Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025Cookie Notice & Consent Banner for GDPR & CCPA Compliance: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58607 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA Compliance cookie-notice-and-consent-banner allows Stored XSS.This issue affects Cookie Notice & Consent Banner for GDPR & CCPA Compliance: from n/a through <= 1.7.11.
Product
Cookie Notice & Consent Banner for GDPR & CCPA Compliance
Affected
up to 1.7.11
What to do
Affects up to 1.7.11. Update Cookie Notice & Consent Banner for GDPR & CCPA Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025WP Delicious: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58605 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows Stored XSS.This issue affects WP Delicious: from n/a through <= 1.8.7.
Product
WP Delicious
Affected
up to 1.8.7
What to do
Affects up to 1.8.7. Update WP Delicious to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025If-So Dynamic Content Personalization: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58602 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Stored XSS.This issue affects If-So Dynamic Content Personalization: from n/a through <= 1.9.4.
Product
If-So Dynamic Content Personalization
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update If-So Dynamic Content Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025MailOptin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58596 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in properfraction MailOptin mailoptin allows Stored XSS.This issue affects MailOptin: from n/a through <= 1.2.75.0.
Product
MailOptin
Affected
up to 1.2.75.0
What to do
Affects up to 1.2.75.0. Update MailOptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025Orbit Fox by ThemeIsle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58593 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allows Stored XSS.This issue affects Orbit Fox by ThemeIsle: from n/a through <= 3.0.0.
Product
Orbit Fox by ThemeIsle
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Orbit Fox by ThemeIsle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Golo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54724 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Golo golo allows Reflected XSS.This issue affects Golo: from n/a through <= 1.7.1.
Product
Golo
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Golo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Captcha.eu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53579 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captcha.eu Captcha.eu captcha-eu allows Reflected XSS.This issue affects Captcha.eu: from n/a through < 1.0.61.
Product
Captcha.eu
What to do
Update Captcha.eu to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Theme Blvd Widget Areas: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53289 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Theme Blvd Widget Areas theme-blvd-widget-areas allows Reflected XSS.This issue affects Theme Blvd Widget Areas: from n/a through <= 1.3.0.
Product
Theme Blvd Widget Areas
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Theme Blvd Widget Areas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025e-Boekhouden.nl: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53225 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eboekhouden e-Boekhouden.nl e-boekhoudennl-connector allows Reflected XSS.This issue affects e-Boekhouden.nl: from n/a through <= 1.9.3.
Product
e-Boekhouden.nl
Affected
up to 1.9.3
What to do
Affects up to 1.9.3. Update e-Boekhouden.nl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025NextGEN Gallery Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53224 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Koen Schuit NextGEN Gallery Search nextgen-gallery-search-galleries allows Reflected XSS.This issue affects NextGEN Gallery Search: from n/a through <= 2.12.
Product
NextGEN Gallery Search
Affected
up to 2.12
What to do
Affects up to 2.12. Update NextGEN Gallery Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Theme Switcher Reloaded: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53223 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undoIT Theme Switcher Reloaded theme-switcher-reloaded allows Reflected XSS.This issue affects Theme Switcher Reloaded: from n/a through <= 1.1.
Product
Theme Switcher Reloaded
Affected
up to 1.1
What to do
Affects up to 1.1. Update Theme Switcher Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025XmasB Quotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53220 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XmasB XmasB Quotes xmasb-quotes allows Reflected XSS.This issue affects XmasB Quotes: from n/a through <= 1.6.1.
Product
XmasB Quotes
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update XmasB Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Yahoo! WebPlayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53215 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8bitkid Yahoo! WebPlayer yahoo-media-player allows Reflected XSS.This issue affects Yahoo! WebPlayer: from n/a through <= 2.0.6.
Product
Yahoo! WebPlayer
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Yahoo! WebPlayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Houzez: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49407 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.1.1.
Product
Houzez
Affected
up to 4.1.1
What to do
Affects up to 4.1.1. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Custom Comment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48365 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imaprogrammer Custom Comment customcomment allows Stored XSS.This issue affects Custom Comment: from n/a through <= 2.1.6.
Product
Custom Comment
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update Custom Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Varnish/Nginx Proxy Caching: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48360 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows Stored XSS.This issue affects Varnish/Nginx Proxy Caching: from n/a through <= 1.8.3.
Product
Varnish/Nginx Proxy Caching
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update Varnish/Nginx Proxy Caching to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Risk Free Cash On Delivery (COD) – WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48358 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in everythingwp Risk Free Cash On Delivery (COD) – WooCommerce risk-free-cash-on-delivery-cod-woocommerce allows Stored XSS.This issue affects Risk Free Cash On Delivery (COD) – WooCommerce: from n/a through <= 1.0.4.
Product
Risk Free Cash On Delivery (COD) – WooCommerce
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Risk Free Cash On Delivery (COD) – WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Kanpress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48356 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Isra Kanpress kanpress allows Stored XSS.This issue affects Kanpress: from n/a through <= 1.1.
Product
Kanpress
Affected
up to 1.1
What to do
Affects up to 1.1. Update Kanpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Better Post & Filter Widgets for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48354 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Stored XSS.This issue affects Better Post & Filter Widgets for Elementor: from n/a through <= 1.6.1.
Product
Better Post & Filter Widgets for Elementor
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Better Post & Filter Widgets for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.