Vulnerability database

40,937 results · page 314 of 819

• Jul 16, 2025Multi-language Responsive Contact Form: Missing AuthorizationCVE-2025-29000 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in August Infotech Multi-language Responsive Contact Form responsive-contact-form allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Multi-language Responsive Contact Form: from n/a through <= 2.8.

  Product

  Multi-language Responsive Contact Form

  Affected

  up to 2.8

  What to do

  Affects up to 2.8. Update Multi-language Responsive Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025WP Pipes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28982 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress WP Pipes allows SQL Injection. This issue affects WP Pipes: from n/a through 1.4.3.

  Product

  WP Pipes

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update WP Pipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025URL Shortener: Missing AuthorizationCVE-2025-28965 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Missing Authorization vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects URL Shortener: from n/a through <= 3.0.7.

  Product

  URL Shortener

  Affected

  up to 3.0.7

  What to do

  Affects up to 3.0.7. Update URL Shortener to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025URL Shortener: Deserialization of Untrusted DataCVE-2025-28961 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Deserialization of Untrusted Data vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Object Injection.This issue affects URL Shortener: from n/a through <= 3.0.7.

  Product

  URL Shortener

  Affected

  up to 3.0.7

  What to do

  Affects up to 3.0.7. Update URL Shortener to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025URL Shortener: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28959 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows SQL Injection.This issue affects URL Shortener: from n/a through <= 3.0.7.

  Product

  URL Shortener

  Affected

  up to 3.0.7

  What to do

  Affects up to 3.0.7. Update URL Shortener to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Easy Video Player Wordpress & WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-28955 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in FWDesign Easy Video Player Wordpress & WooCommerce fwdevp allows Path Traversal.This issue affects Easy Video Player Wordpress & WooCommerce: from n/a through <= 10.0.

  Product

  Easy Video Player Wordpress & WooCommerce

  Affected

  up to 10.0

  What to do

  Affects up to 10.0. Update Easy Video Player Wordpress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Yogi: Deserialization of Untrusted DataCVE-2025-24779 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Deserialization of Untrusted Data vulnerability in NooTheme Yogi yogi allows Object Injection.This issue affects Yogi: from n/a through < 2.9.3.

  Product

  Yogi

  What to do

  Update Yogi to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Hillter: Deserialization of Untrusted DataCVE-2025-24777 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Deserialization of Untrusted Data vulnerability in awethemes Hillter allows Object Injection. This issue affects Hillter: from n/a through 3.0.7.

  Product

  Hillter

  Affected

  up to 3.0.7

  What to do

  Affects up to 3.0.7. Update Hillter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025WP-BusinessDirectory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24759 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Blind SQL Injection.This issue affects WP-BusinessDirectory: from n/a through <= 3.1.4.

  Product

  WP-BusinessDirectory

  Affected

  up to 3.1.4

  What to do

  Affects up to 3.1.4. Update WP-BusinessDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025LightBox Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54051 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through <= 1.1.30.

  Product

  LightBox Block

  Affected

  up to 1.1.30

  What to do

  Affects up to 1.1.30. Update LightBox Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Responsive Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54050 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Stored XSS.This issue affects Responsive Addons for Elementor: from n/a through <= 1.7.3.

  Product

  Responsive Addons for Elementor

  Affected

  up to 1.7.3

  What to do

  Affects up to 1.7.3. Update Responsive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Cost Calculator: Missing AuthorizationCVE-2025-54047 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost Calculator: from n/a through <= 7.4.

  Product

  Cost Calculator

  Affected

  up to 7.4

  What to do

  Affects up to 7.4. Update Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025SMTP for Amazon SES: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-54043 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce SMTP for Amazon SES smtp-amazon-ses allows SQL Injection.This issue affects SMTP for Amazon SES: from n/a through <= 1.9.

  Product

  SMTP for Amazon SES

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update SMTP for Amazon SES to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025WP Post Hide: Cross-Site Request Forgery (CSRF)CVE-2025-54042 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Xfinitysoft WP Post Hide wp-post-hide allows Cross Site Request Forgery.This issue affects WP Post Hide: from n/a through <= 1.0.9.

  Product

  WP Post Hide

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update WP Post Hide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Wallet System for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-54041 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Cross Site Request Forgery.This issue affects Wallet System for WooCommerce: from n/a through <= 2.6.7.

  Product

  Wallet System for WooCommerce

  Affected

  up to 2.6.7

  What to do

  Affects up to 2.6.7. Update Wallet System for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Animator: Cross-Site Request Forgery (CSRF)CVE-2025-54039 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Animator scroll-triggered-animations allows Cross Site Request Forgery.This issue affects Animator: from n/a through <= 3.0.16.

  Product

  Animator

  Affected

  up to 3.0.16

  What to do

  Affects up to 3.0.16. Update Animator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Restaurant Menu by MotoPress: Cross-Site Request Forgery (CSRF)CVE-2025-54038 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows Cross Site Request Forgery.This issue affects Restaurant Menu by MotoPress: from n/a through <= 2.4.6.

  Product

  Restaurant Menu by MotoPress

  Affected

  up to 2.4.6

  What to do

  Affects up to 2.4.6. Update Restaurant Menu by MotoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025News Kit Elementor Addons: Missing AuthorizationCVE-2025-54037 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Kit Elementor Addons: from n/a through <= 1.3.4.

  Product

  News Kit Elementor Addons

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update News Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Webba Booking: Cross-Site Request Forgery (CSRF)CVE-2025-54036 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Cross Site Request Forgery.This issue affects Webba Booking: from n/a through <= 5.1.20.

  Product

  Webba Booking

  Affected

  up to 5.1.20

  What to do

  Affects up to 5.1.20. Update Webba Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Newsletters: Cross-Site Request Forgery (CSRF)CVE-2025-54035 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through <= 4.10.

  Product

  Newsletters

  Affected

  up to 4.10

  What to do

  Affects up to 4.10. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Theme Builder For Elementor: Cross-Site Request Forgery (CSRF)CVE-2025-54033 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in BlocksWP Theme Builder For Elementor theme-builder-for-elementor allows Cross Site Request Forgery.This issue affects Theme Builder For Elementor: from n/a through <= 1.2.3.

  Product

  Theme Builder For Elementor

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Theme Builder For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025WooCommerce Google Sheet Connector: Cross-Site Request Forgery (CSRF)CVE-2025-54030 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WesternDeal WooCommerce Google Sheet Connector wc-gsheetconnector allows Cross Site Request Forgery.This issue affects WooCommerce Google Sheet Connector: from n/a through <= 1.3.20.

  Product

  WooCommerce Google Sheet Connector

  Affected

  up to 1.3.20

  What to do

  Affects up to 1.3.20. Update WooCommerce Google Sheet Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025GymBase Theme Classes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-54026 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuanticaLabs GymBase Theme Classes gymbase_classes allows SQL Injection.This issue affects GymBase Theme Classes: from n/a through <= 1.4.

  Product

  GymBase Theme Classes

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update GymBase Theme Classes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025WPAdverts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54024 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.This issue affects WPAdverts: from n/a through <= 2.2.5.

  Product

  WPAdverts

  Affected

  up to 2.2.5

  What to do

  Affects up to 2.2.5. Update WPAdverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025WP Delicious: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54023 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows DOM-Based XSS.This issue affects WP Delicious: from n/a through <= 1.8.4.

  Product

  WP Delicious

  Affected

  up to 1.8.4

  What to do

  Affects up to 1.8.4. Update WP Delicious to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Coupon Affiliates: Cross-Site Request Forgery (CSRF)CVE-2025-54022 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Cross Site Request Forgery.This issue affects Coupon Affiliates: from n/a through <= 6.4.0.

  Product

  Coupon Affiliates

  Affected

  up to 6.4.0

  What to do

  Affects up to 6.4.0. Update Coupon Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025AntiSpam for Contact Form 7: Cross-Site Request Forgery (CSRF)CVE-2025-54020 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Erik AntiSpam for Contact Form 7 cf7-antispam allows Cross Site Request Forgery.This issue affects AntiSpam for Contact Form 7: from n/a through <= 0.6.3.

  Product

  AntiSpam for Contact Form 7

  Affected

  up to 0.6.3

  What to do

  Affects up to 0.6.3. Update AntiSpam for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025CM Pop-Up banners: Missing AuthorizationCVE-2025-54018 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in CreativeMindsSolutions CM Pop-Up banners cm-pop-up-banners allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Pop-Up banners: from n/a through <= 1.8.4.

  Product

  CM Pop-Up banners

  Affected

  up to 1.8.4

  What to do

  Affects up to 1.8.4. Update CM Pop-Up banners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Videopack: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54016 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Gilman Videopack video-embed-thumbnail-generator allows DOM-Based XSS.This issue affects Videopack: from n/a through <= 4.10.3.

  Product

  Videopack

  Affected

  up to 4.10.3

  What to do

  Affects up to 4.10.3. Update Videopack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025HT Contact Form 7: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-54015 · WordPress plugins & themes · reported by PatchstackMedium 6.6

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows PHP Local File Inclusion.This issue affects HT Contact Form 7: from n/a through <= 2.0.0.

  Product

  HT Contact Form 7

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update HT Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54013 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through <= 2.11.16.

  Product

  Welcart e-Commerce

  Affected

  up to 2.11.16

  What to do

  Affects up to 2.11.16. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025SMTP2GO: Missing AuthorizationCVE-2025-54011 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in SMTP2GO SMTP2GO smtp2go allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMTP2GO: from n/a through <= 1.12.1.

  Product

  SMTP2GO

  Affected

  up to 1.12.1

  What to do

  Affects up to 1.12.1. Update SMTP2GO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025FluentSnippets: Cross-Site Request Forgery (CSRF)CVE-2025-54010 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel FluentSnippets easy-code-manager allows Cross Site Request Forgery.This issue affects FluentSnippets: from n/a through <= 10.50.

  Product

  FluentSnippets

  Affected

  up to 10.50

  What to do

  Affects up to 10.50. Update FluentSnippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025JetSmartFilters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54009 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through <= 3.6.8.

  Product

  JetSmartFilters

  Affected

  up to 3.6.8

  What to do

  Affects up to 3.6.8. Update JetSmartFilters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54006 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.4.1.

  Product

  Bold Page Builder

  Affected

  up to 5.4.1

  What to do

  Affects up to 5.4.1. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Houzez: Missing AuthorizationCVE-2025-53997 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.0.4.

  Product

  Houzez

  Affected

  up to 4.0.4

  What to do

  Affects up to 4.0.4. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025JetSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53996 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows Stored XSS.This issue affects JetSearch: from n/a through <= 3.5.10.1.

  Product

  JetSearch

  Affected

  up to 3.5.10.1

  What to do

  Affects up to 3.5.10.1. Update JetSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025JetPopup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53995 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetPopup jet-popup allows Stored XSS.This issue affects JetPopup: from n/a through <= 2.0.15.1.

  Product

  JetPopup

  Affected

  up to 2.0.15.1

  What to do

  Affects up to 2.0.15.1. Update JetPopup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025JetPopup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53994 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetPopup jet-popup allows DOM-Based XSS.This issue affects JetPopup: from n/a through <= 2.0.15.

  Product

  JetPopup

  Affected

  up to 2.0.15

  What to do

  Affects up to 2.0.15. Update JetPopup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025JetTricks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53991 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTricks jet-tricks allows Stored XSS.This issue affects JetTricks: from n/a through <= 1.5.4.1.

  Product

  JetTricks

  Affected

  up to 1.5.4.1

  What to do

  Affects up to 1.5.4.1. Update JetTricks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025JetFormBuilder: Deserialization of Untrusted DataCVE-2025-53990 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Deserialization of Untrusted Data vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Object Injection.This issue affects JetFormBuilder: from n/a through <= 3.5.1.2.

  Product

  JetFormBuilder

  Affected

  up to 3.5.1.2

  What to do

  Affects up to 3.5.1.2. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025JetBlocks For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53989 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.19.

  Product

  JetBlocks For Elementor

  Affected

  up to 1.3.19

  What to do

  Affects up to 1.3.19. Update JetBlocks For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Hestia: Missing AuthorizationCVE-2025-53986 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in themeisle Hestia hestia allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hestia: from n/a through <= 3.2.10.

  Product

  Hestia

  Affected

  up to 3.2.10

  What to do

  Affects up to 3.2.10. Update Hestia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025JetTabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53984 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through <= 2.2.9.

  Product

  JetTabs

  Affected

  up to 2.2.9

  What to do

  Affects up to 2.2.9. Update JetTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53982 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.7.

  Product

  JetElements For Elementor

  Affected

  up to 2.7.7

  What to do

  Affects up to 2.7.7. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025SMTP for SendGrid – YaySMTP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48301 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce SMTP for SendGrid – YaySMTP smtp-sendgrid allows SQL Injection.This issue affects SMTP for SendGrid – YaySMTP: from n/a through <= 1.5.

  Product

  SMTP for SendGrid – YaySMTP

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update SMTP for SendGrid – YaySMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025YayExtra: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48299 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayExtra yayextra allows SQL Injection.This issue affects YayExtra: from n/a through <= 1.5.5.

  Product

  YayExtra

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update YayExtra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Easy Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48295 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Stored XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.2.5.

  Product

  Easy Elementor Addons

  Affected

  up to 2.2.5

  What to do

  Affects up to 2.2.5. Update Easy Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025FG Drupal to: Server-Side Request Forgery (SSRF)CVE-2025-48294 · WordPress plugins & themes · reported by PatchstackMedium 4.4

  Server-Side Request Forgery (SSRF) vulnerability in Kerfred FG Drupal to WordPress fg-drupal-to-wp allows Server Side Request Forgery.This issue affects FG Drupal to WordPress: from n/a through <= 3.90.0.

  Product

  FG Drupal to

  Affected

  up to 3.90.0

  What to do

  Affects up to 3.90.0. Update FG Drupal to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Chatbox Manager: Missing AuthorizationCVE-2025-48167 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chatbox Manager: from n/a through <= 1.2.5.

  Product

  Chatbox Manager

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Chatbox Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.