Vulnerability database

40,919 results · page 307 of 819

• Aug 14, 2025JobSearch: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52806 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in eyecix JobSearch wp-jobsearch allows PHP Local File Inclusion.This issue affects JobSearch: from n/a through < 3.0.8.

  Product

  JobSearch

  What to do

  Update JobSearch to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025TheBooking: Missing AuthorizationCVE-2025-52801 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Missing Authorization vulnerability in VonStroheim TheBooking thebooking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects TheBooking: from n/a through <= 1.4.4.

  Product

  TheBooking

  Affected

  up to 1.4.4

  What to do

  Affects up to 1.4.4. Update TheBooking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025The E-Commerce ERP: Missing AuthorizationCVE-2025-52800 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Missing Authorization vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP profitori allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects The E-Commerce ERP: from n/a through <= 2.1.1.3.

  Product

  The E-Commerce ERP

  Affected

  up to 2.1.1.3

  What to do

  Affects up to 2.1.1.3. Update The E-Commerce ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025CaptionPix: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52788 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson CaptionPix captionpix allows Reflected XSS.This issue affects CaptionPix: from n/a through <= 1.8.

  Product

  CaptionPix

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update CaptionPix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025SMM API: Missing AuthorizationCVE-2025-52785 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Missing Authorization vulnerability in softnwords SMM API smm-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMM API: from n/a through <= 6.0.31.

  Product

  SMM API

  Affected

  up to 6.0.31

  What to do

  Affects up to 6.0.31. Update SMM API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Project Cost Calculator: Missing AuthorizationCVE-2025-52775 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Missing Authorization vulnerability in Ronik@UnlimitedWP Project Cost Calculator project-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Project Cost Calculator: from n/a through <= 1.0.0.

  Product

  Project Cost Calculator

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Project Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025GMap Targeting: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52732 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 GMap Targeting gmap-targeting allows PHP Local File Inclusion.This issue affects GMap Targeting: from n/a through <= 1.1.6.

  Product

  GMap Targeting

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update GMap Targeting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025WordPress Event Manager, Event Calendar and Booking: Missing AuthorizationCVE-2025-52731 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in themefunction WordPress Event Manager, Event Calendar and Booking Plugin eventin-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Event Manager, Event Calendar and Booking Plugin: from n/a through <= 4.0.24.

  Product

  WordPress Event Manager, Event Calendar and Booking

  Affected

  up to 4.0.24

  What to do

  Affects up to 4.0.24. Update WordPress Event Manager, Event Calendar and Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025WordPress Event Manager, Event Calendar and Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52730 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themefunction WordPress Event Manager, Event Calendar and Booking Plugin eventin-pro allows Stored XSS.This issue affects WordPress Event Manager, Event Calendar and Booking Plugin: from n/a through <= 4.0.24.

  Product

  WordPress Event Manager, Event Calendar and Booking

  Affected

  up to 4.0.24

  What to do

  Affects up to 4.0.24. Update WordPress Event Manager, Event Calendar and Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Responsive Posts Carousel Pro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52728 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows PHP Local File Inclusion.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.0.

  Product

  Responsive Posts Carousel Pro

  Affected

  up to 15.0

  What to do

  Affects up to 15.0. Update Responsive Posts Carousel Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Global Gallery: Missing AuthorizationCVE-2025-52721 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in LCweb Global Gallery allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Global Gallery: from n/a through 9.2.3.

  Product

  Global Gallery

  Affected

  up to 9.2.3

  What to do

  Affects up to 9.2.3. Update Global Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Super Store Finder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52720 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through <= 7.5.

  Product

  Super Store Finder

  Affected

  up to 7.5

  What to do

  Affects up to 7.5. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025WP REST Cache: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52716 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Acato WP REST Cache wp-rest-cache allows PHP Local File Inclusion.This issue affects WP REST Cache: from n/a through <= 2025.1.0.

  Product

  WP REST Cache

  Affected

  up to 2025.1.0

  What to do

  Affects up to 2025.1.0. Update WP REST Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Post and Page Builder by BoldGrid: Path Traversal: '.../...//'CVE-2025-52712 · WordPress plugins & themes · reported by PatchstackMedium 4.2

  Path Traversal: '.../...//' vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Path Traversal.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.8.

  Product

  Post and Page Builder by BoldGrid

  Affected

  up to 1.27.8

  What to do

  Affects up to 1.27.8. Update Post and Page Builder by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025CF7 Spreadsheets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50040 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Stored XSS.This issue affects CF7 Spreadsheets: from n/a through <= 2.3.2.

  Product

  CF7 Spreadsheets

  Affected

  up to 2.3.2

  What to do

  Affects up to 2.3.2. Update CF7 Spreadsheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025DB Backup: Missing AuthorizationCVE-2025-50031 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in syedamirhussain91 DB Backup db-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DB Backup: from n/a through <= 6.0.

  Product

  DB Backup

  Affected

  up to 6.0

  What to do

  Affects up to 6.0. Update DB Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025AI Tools: Missing AuthorizationCVE-2025-50029 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Ashish AI Tools artificial-intelligence-auto-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Tools: from n/a through <= 4.0.7.

  Product

  AI Tools

  Affected

  up to 4.0.7

  What to do

  Affects up to 4.0.7. Update AI Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Product XML Feed Manager for WooCommerce: Improper Control of Generation of Code ('Code Injection')CVE-2025-49887 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Improper Control of Generation of Code ('Code Injection') vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Remote Code Inclusion.This issue affects Product XML Feed Manager for WooCommerce: from n/a through <= 2.9.3.

  Product

  Product XML Feed Manager for WooCommerce

  Affected

  up to 2.9.3

  What to do

  Affects up to 2.9.3. Update Product XML Feed Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Eventin: Deserialization of Untrusted DataCVE-2025-49869 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.0.31.

  Product

  Eventin

  Affected

  up to 4.0.31

  What to do

  Affects up to 4.0.31. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025WP LOL Rotation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49437 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in worstguy WP LOL Rotation league-of-legends-rotation allows Stored XSS.This issue affects WP LOL Rotation: from n/a through <= 1.0.

  Product

  WP LOL Rotation

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP LOL Rotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Supermalink: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49433 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThanhD Supermalink supermalink allows DOM-Based XSS.This issue affects Supermalink: from n/a through <= 1.1.

  Product

  Supermalink

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Supermalink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025GravityWP - Merge Tags: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49271 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GravityWP GravityWP - Merge Tags gravitywp-merge-tags allows PHP Local File Inclusion.This issue affects GravityWP - Merge Tags: from n/a through <= 1.4.4.

  Product

  GravityWP - Merge Tags

  Affected

  up to 1.4.4

  What to do

  Affects up to 1.4.4. Update GravityWP - Merge Tags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Frontend Admin by DynamiApps: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49267 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Blind SQL Injection.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.28.3.

  Product

  Frontend Admin by DynamiApps

  Affected

  up to 3.28.3

  What to do

  Affects up to 3.28.3. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Cloud SAML SSO - Single Sign On Login: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49264 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cloud Infrastructure Services Cloud SAML SSO - Single Sign On Login cloud-sso-single-sign-on allows PHP Local File Inclusion.This issue affects Cloud SAML SSO - Single Sign On Login: from n/a through <= 1.0.18.

  Product

  Cloud SAML SSO - Single Sign On Login

  Affected

  up to 1.0.18

  What to do

  Affects up to 1.0.18. Update Cloud SAML SSO - Single Sign On Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Visit Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49065 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BestiaDurmiente Visit Counter visit-counter allows Stored XSS.This issue affects Visit Counter: from n/a through <= 1.0.

  Product

  Visit Counter

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Visit Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025User Language Switch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49064 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webilop User Language Switch user-language-switch allows Reflected XSS.This issue affects User Language Switch: from n/a through <= 1.6.10.

  Product

  User Language Switch

  Affected

  up to 1.6.10

  What to do

  Affects up to 1.6.10. Update User Language Switch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025BaiduXZH Submit(百度熊掌号): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49063 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in i3geek BaiduXZH Submit(百度熊掌号) i3geek-baiduxzh allows Reflected XSS.This issue affects BaiduXZH Submit(百度熊掌号): from n/a through <= 1.4.6.

  Product

  BaiduXZH Submit(百度熊掌号)

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update BaiduXZH Submit(百度熊掌号) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025WP-jScrollPane: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49062 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cornfeed WP-jScrollPane wp-jscrollpane allows Reflected XSS.This issue affects WP-jScrollPane: from n/a through <= 2.0.3.

  Product

  WP-jScrollPane

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update WP-jScrollPane to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Porn Videos Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49061 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in perteus Porn Videos Embed porn-videos-embed allows Stored XSS.This issue affects Porn Videos Embed: from n/a through <= 0.9.1.

  Product

  Porn Videos Embed

  Affected

  up to 0.9.1

  What to do

  Affects up to 0.9.1. Update Porn Videos Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025CleverReach® WP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49059 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® CleverReach® WP cleverreach-wp allows SQL Injection.This issue affects CleverReach® WP: from n/a through <= 1.5.20.

  Product

  CleverReach® WP

  Affected

  up to 1.5.20

  What to do

  Affects up to 1.5.20. Update CleverReach® WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025SoundSt SEO Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49058 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sound Strategies SoundSt SEO Search soundst-seo-search allows Reflected XSS.This issue affects SoundSt SEO Search: from n/a through <= 1.2.3.

  Product

  SoundSt SEO Search

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update SoundSt SEO Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025WP Voting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49057 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ko Min WP Voting wp-voting allows Reflected XSS.This issue affects WP Voting: from n/a through <= 1.8.

  Product

  WP Voting

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update WP Voting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025多说社会化评论框: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49056 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shen2 多说社会化评论框 duoshuo allows Reflected XSS.This issue affects 多说社会化评论框: from n/a through <= 1.2.

  Product

  多说社会化评论框

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update 多说社会化评论框 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Time Sheets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49054 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mrdenny Time Sheets time-sheets allows Reflected XSS.This issue affects Time Sheets: from n/a through <= 2.1.3.

  Product

  Time Sheets

  Affected

  up to 2.1.3

  What to do

  Affects up to 2.1.3. Update Time Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025WP Airdrop Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49053 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kadesthemes WP Airdrop Manager airdrop allows Stored XSS.This issue affects WP Airdrop Manager: from n/a through <= 1.0.5.

  Product

  WP Airdrop Manager

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update WP Airdrop Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Netease Music: Missing AuthorizationCVE-2025-49052 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Dariolee Netease Music netease-music allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netease Music: from n/a through <= 3.2.1.

  Product

  Netease Music

  Affected

  up to 3.2.1

  What to do

  Affects up to 3.2.1. Update Netease Music to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Hide Text Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49051 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in biscia7 Hide Text Shortcode hide-text-shortcode allows Stored XSS.This issue affects Hide Text Shortcode: from n/a through <= 1.1.

  Product

  Hide Text Shortcode

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Hide Text Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Inspectlet – User Session Recording and Heatmaps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49048 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in inspectlet Inspectlet – User Session Recording and Heatmaps inspectlet-heatmaps-and-user-session-recording allows Stored XSS.This issue affects Inspectlet – User Session Recording and Heatmaps: from n/a through <= 2.0.

  Product

  Inspectlet – User Session Recording and Heatmaps

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Inspectlet – User Session Recording and Heatmaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025DigitalOcean Spaces Sync: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49047 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in keeross DigitalOcean Spaces Sync do-spaces-sync allows Stored XSS.This issue affects DigitalOcean Spaces Sync: from n/a through <= 2.2.1.

  Product

  DigitalOcean Spaces Sync

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update DigitalOcean Spaces Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Simple Poll: Cross-Site Request Forgery (CSRF)CVE-2025-49044 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in tosend.it Simple Poll simple-poll allows Stored XSS.This issue affects Simple Poll: from n/a through <= 1.1.1.

  Product

  Simple Poll

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Simple Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025WP Dynamic Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49038 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Dynamic Links wp-dynamic-links allows Reflected XSS.This issue affects WP Dynamic Links: from n/a through <= 1.0.1.

  Product

  WP Dynamic Links

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update WP Dynamic Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Authentication and xmlrpc log writer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49037 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Federico Rota Authentication and xmlrpc log writer authentication-and-xmlrpc-log-writer allows Reflected XSS.This issue affects Authentication and xmlrpc log writer: from n/a through <= 1.2.2.

  Product

  Authentication and xmlrpc log writer

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Authentication and xmlrpc log writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Premium Addons for KingComposer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49036 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in octagonwebstudio Premium Addons for KingComposer premium-addons-for-kingcomposer allows PHP Local File Inclusion.This issue affects Premium Addons for KingComposer: from n/a through <= 1.1.1.

  Product

  Premium Addons for KingComposer

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Premium Addons for KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025ProfileGrid: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49033 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid : from n/a through <= 5.9.5.3.

  Product

  ProfileGrid

  Affected

  up to 5.9.5.3

  What to do

  Affects up to 5.9.5.3. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Gutenberg Blocks: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-48332 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows PHP Local File Inclusion.This issue affects Gutenberg Blocks: from n/a through <= 3.3.1.

  Product

  Gutenberg Blocks

  Affected

  up to 3.3.1

  What to do

  Affects up to 3.3.1. Update Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Geo Mashup: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-48293 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows PHP Local File Inclusion.This issue affects Geo Mashup: from n/a through <= 1.13.16.

  Product

  Geo Mashup

  Affected

  up to 1.13.16

  What to do

  Affects up to 1.13.16. Update Geo Mashup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Video Blogster Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47689 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in johnh10 Video Blogster Lite video-blogster-lite allows Reflected XSS.This issue affects Video Blogster Lite: from n/a through <= 1.2.

  Product

  Video Blogster Lite

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Video Blogster Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025WooCommerce Fortnox Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47610 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wetail WooCommerce Fortnox Integration woocommerce-fortnox-integration allows Stored XSS.This issue affects WooCommerce Fortnox Integration: from n/a through <= 4.5.6.

  Product

  WooCommerce Fortnox Integration

  Affected

  up to 4.5.6

  What to do

  Affects up to 4.5.6. Update WooCommerce Fortnox Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025Content Egg: Deserialization of Untrusted DataCVE-2025-47536 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Deserialization of Untrusted Data vulnerability in keywordrush Content Egg content-egg allows Object Injection.This issue affects Content Egg: from n/a through <= 7.0.0.

  Product

  Content Egg

  Affected

  up to 7.0.0

  What to do

  Affects up to 7.0.0. Update Content Egg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 14, 2025CSS & JavaScript Toolbox: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-3703 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wipeoutmedia CSS & JavaScript Toolbox css-javascript-toolbox allows PHP Local File Inclusion.This issue affects CSS & JavaScript Toolbox: from n/a through < 12.0.3.

  Product

  CSS & JavaScript Toolbox

  What to do

  Update CSS & JavaScript Toolbox to the newest version.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.