Vulnerability database

40,937 results · page 317 of 819

• Jul 4, 2025Testimonials Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49245 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmoreira Testimonials Showcase testimonials-showcase allows Reflected XSS.This issue affects Testimonials Showcase: from n/a through <= 1.9.16.

  Product

  Testimonials Showcase

  Affected

  up to 1.9.16

  What to do

  Affects up to 1.9.16. Update Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Elessi: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49070 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Elessi elessi-theme allows PHP Local File Inclusion.This issue affects Elessi: from n/a through < 6.4.1.

  Product

  Elessi

  What to do

  Update Elessi to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Booking Calendar Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48231 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through <= 1.2.58.

  Product

  Booking Calendar Contact Form

  Affected

  up to 1.2.58

  What to do

  Affects up to 1.2.58. Update Booking Calendar Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025WC Pickup Store: Missing AuthorizationCVE-2025-47634 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Keylor Mendoza WC Pickup Store wc-pickup-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Pickup Store: from n/a through <= 1.8.9.

  Product

  WC Pickup Store

  Affected

  up to 1.8.9

  What to do

  Affects up to 1.8.9. Update WC Pickup Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025PrivateContent - Mail Actions: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47627 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LCweb PrivateContent - Mail Actions allows PHP Local File Inclusion. This issue affects PrivateContent - Mail Actions: from n/a through 2.3.2.

  Product

  PrivateContent - Mail Actions

  Affected

  up to 2.3.2

  What to do

  Affects up to 2.3.2. Update PrivateContent - Mail Actions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025EventON: Missing AuthorizationCVE-2025-47565 · WordPress plugins & themes · reported by PatchstackMedium 6.3

  Missing Authorization vulnerability in ashanjay EventON eventon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventON: from n/a through <= 4.9.9.

  Product

  EventON

  Affected

  up to 4.9.9

  What to do

  Affects up to 4.9.9. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025WP Compress: Weak AuthenticationCVE-2025-47479 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Weak Authentication vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Authentication Abuse.This issue affects WP Compress: from n/a through <= 6.30.30.

  Product

  WP Compress

  Affected

  up to 6.30.30

  What to do

  Affects up to 6.30.30. Update WP Compress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Rankie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39487 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Rankie valvepress-rankie allows Reflected XSS.This issue affects Rankie: from n/a through <= 1.8.2.

  Product

  Rankie

  Affected

  up to 1.8.2

  What to do

  Affects up to 1.8.2. Update Rankie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Pressroom: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32311 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Pressroom pressroom allows Reflected XSS.This issue affects Pressroom: from n/a through <= 7.0.

  Product

  Pressroom

  Affected

  up to 7.0

  What to do

  Affects up to 7.0. Update Pressroom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Simple Link Directory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32297 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows SQL Injection.This issue affects Simple Link Directory: from n/a through < 14.8.1.

  Product

  Simple Link Directory

  What to do

  Update Simple Link Directory to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Homey: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31037 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey homey allows Reflected XSS.This issue affects Homey: from n/a through <= 2.4.5.

  Product

  Homey

  Affected

  up to 2.4.5

  What to do

  Affects up to 2.4.5. Update Homey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025LogisticsHub: Unrestricted Upload of File with Dangerous TypeCVE-2025-30933 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes LogisticsHub logistics-hub allows Upload a Web Shell to a Web Server.This issue affects LogisticsHub: from n/a through <= 1.1.6.

  Product

  LogisticsHub

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update LogisticsHub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Click & Pledge Connect: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28983 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect allows Privilege Escalation. This issue affects Click & Pledge Connect: from 25.04010101 through WP6.8.

  Product

  Click & Pledge Connect

  What to do

  Update Click & Pledge Connect to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Aviation Weather from NOAA: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-28980 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in machouinard Aviation Weather from NOAA aviation-weather-from-noaa allows Path Traversal.This issue affects Aviation Weather from NOAA: from n/a through <= 0.7.2.

  Product

  Aviation Weather from NOAA

  Affected

  up to 0.7.2

  What to do

  Affects up to 0.7.2. Update Aviation Weather from NOAA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025SB Breadcrumbs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28978 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hung Trang Si SB Breadcrumbs sb-breadcrumbs allows Reflected XSS.This issue affects SB Breadcrumbs: from n/a through <= 1.0.

  Product

  SB Breadcrumbs

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update SB Breadcrumbs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Email Address Security by WebEmailProtector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28976 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dsrodzin Email Address Security by WebEmailProtector webemailprotector allows Stored XSS.This issue affects Email Address Security by WebEmailProtector: from n/a through <= 3.3.6.

  Product

  Email Address Security by WebEmailProtector

  Affected

  up to 3.3.6

  What to do

  Affects up to 3.3.6. Update Email Address Security by WebEmailProtector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025WP Wall: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28968 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Prelovac WP Wall wp-wall allows Reflected XSS.This issue affects WP Wall: from n/a through <= 1.7.3.

  Product

  WP Wall

  Affected

  up to 1.7.3

  What to do

  Affects up to 1.7.3. Update WP Wall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Printcart Web to Print Product Designer for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24780 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows SQL Injection.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through <= 2.4.0.

  Product

  Printcart Web to Print Product Designer for WooCommerce

  Affected

  up to 2.4.0

  What to do

  Affects up to 2.4.0. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Content Manager Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24771 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Content Manager Light content-manager-light allows Reflected XSS.This issue affects Content Manager Light: from n/a through <= 3.2.

  Product

  Content Manager Light

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update Content Manager Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Service Finder Booking: Incorrect Privilege AssignmentCVE-2025-23970 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Incorrect Privilege Assignment vulnerability in aonetheme Service Finder Booking sf-booking allows Privilege Escalation.This issue affects Service Finder Booking: from n/a through <= 6.1.

  Product

  Service Finder Booking

  Affected

  up to 6.1

  What to do

  Affects up to 6.1. Update Service Finder Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025The Sharable Password Protected Posts before version 1.1.1 allows access to password protected posts by providing a secret key in a GET parameter.CVE-2025-5920 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The Sharable Password Protected Posts before version 1.1.1 allows access to password protected posts by providing a secret key in a GET parameter. However, the key is exposed by the REST API.

  Fixed in

  1.1.1

  What to do

  Update the plugin to 1.1.1 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jul 4, 2025Trust Payments Gateway for WooCommerce (JavaScript Library): Cross-Site Request Forgery (CSRF)CVE-2025-53569 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Trust Payments Trust Payments Gateway for WooCommerce (JavaScript Library) trust-payments-gateway-3ds2 allows Cross Site Request Forgery.This issue affects Trust Payments Gateway for WooCommerce (JavaScript Library): from n/a through <= 1.3.6.

  Product

  Trust Payments Gateway for WooCommerce (JavaScript Library)

  Affected

  up to 1.3.6

  What to do

  Affects up to 1.3.6. Update Trust Payments Gateway for WooCommerce (JavaScript Library) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Radio Station: Cross-Site Request Forgery (CSRF)CVE-2025-53568 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Tony Zeoli Radio Station radio-station allows Cross Site Request Forgery.This issue affects Radio Station: from n/a through <= 2.5.12.

  Product

  Radio Station

  Affected

  up to 2.5.12

  What to do

  Affects up to 2.5.12. Update Radio Station to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53566 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Stored XSS.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 7.8.

  Product

  WP Visitor Statistics (Real Time Traffic)

  Affected

  up to 7.8

  What to do

  Affects up to 7.8. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Card flip image slideshow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30983 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Card flip image slideshow card-flip-image-slideshow allows DOM-Based XSS.This issue affects Card flip image slideshow: from n/a through <= 1.5.

  Product

  Card flip image slideshow

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Card flip image slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Pixelating image slideshow gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30979 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Pixelating image slideshow gallery pixelating-image-slideshow-gallery allows SQL Injection.This issue affects Pixelating image slideshow gallery: from n/a through <= 8.0.

  Product

  Pixelating image slideshow gallery

  Affected

  up to 8.0

  What to do

  Affects up to 8.0. Update Pixelating image slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025iFrame Images Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30969 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus iFrame Images Gallery wp-iframe-images-gallery allows SQL Injection.This issue affects iFrame Images Gallery: from n/a through <= 9.0.

  Product

  iFrame Images Gallery

  Affected

  up to 9.0

  What to do

  Affects up to 9.0. Update iFrame Images Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Cool fade popup: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30947 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Cool fade popup cool-fade-popup allows Blind SQL Injection.This issue affects Cool fade popup: from n/a through <= 10.1.

  Product

  Cool fade popup

  Affected

  up to 10.1

  What to do

  Affects up to 10.1. Update Cool fade popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Posts Slider Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30943 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aakif Kadiwala Posts Slider Shortcode posts-slider-shortcode allows DOM-Based XSS.This issue affects Posts Slider Shortcode: from n/a through <= 1.0.

  Product

  Posts Slider Shortcode

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Posts Slider Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025fluXtore: Missing AuthorizationCVE-2025-30929 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in amazewp fluXtore fluxtore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects fluXtore: from n/a through <= 1.6.0.

  Product

  fluXtore

  Affected

  up to 1.6.0

  What to do

  Affects up to 1.6.0. Update fluXtore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025CF7 7 Mailchimp Add-on: Missing AuthorizationCVE-2025-29012 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in kamleshyadav CF7 7 Mailchimp Add-on CF7-mailchimp-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 7 Mailchimp Add-on: from n/a through < 2.4.

  Product

  CF7 7 Mailchimp Add-on

  What to do

  Update CF7 7 Mailchimp Add-on to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025LMSACE Connect: Missing AuthorizationCVE-2025-29007 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in LMSACE LMSACE Connect lmsace-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LMSACE Connect: from n/a through <= 3.4.

  Product

  LMSACE Connect

  Affected

  up to 3.4

  What to do

  Affects up to 3.4. Update LMSACE Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025WooCommerce Shop Page Builder: Missing AuthorizationCVE-2025-29001 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in ZoomIt WooCommerce Shop Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce Shop Page Builder: from n/a through 2.27.7.

  Product

  WooCommerce Shop Page Builder

  Affected

  up to 2.27.7

  What to do

  Affects up to 2.27.7. Update WooCommerce Shop Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Easy Elements Hider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28971 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CWD Web Designer Easy Elements Hider easy-elements-hider allows Stored XSS.This issue affects Easy Elements Hider: from n/a through <= 2.0.

  Product

  Easy Elements Hider

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Easy Elements Hider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Gallery Widget: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28969 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cybio Gallery Widget gallery-widget allows SQL Injection.This issue affects Gallery Widget: from n/a through <= 1.2.1.

  Product

  Gallery Widget

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Gallery Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Contact Us page - Contact people LITE: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28967 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Steve Truman Contact Us page - Contact people LITE contact-us-page-contact-people allows SQL Injection.This issue affects Contact Us page - Contact people LITE: from n/a through <= 3.7.4.

  Product

  Contact Us page - Contact people LITE

  Affected

  up to 3.7.4

  What to do

  Affects up to 3.7.4. Update Contact Us page - Contact people LITE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025URL Shortener: Server-Side Request Forgery (SSRF)CVE-2025-28963 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Server-Side Request Forgery (SSRF) vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Server Side Request Forgery.This issue affects URL Shortener: from n/a through <= 3.0.7.

  Product

  URL Shortener

  Affected

  up to 3.0.7

  What to do

  Affects up to 3.0.7. Update URL Shortener to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025OwnerRez API: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28957 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OwnerRez OwnerRez API ownerrez allows Stored XSS.This issue affects OwnerRez API: from n/a through <= 1.2.1.

  Product

  OwnerRez API

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update OwnerRez API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Bulk Featured Image: Unrestricted Upload of File with Dangerous TypeCVE-2025-28951 · WordPress plugins & themes · reported by PatchstackCritical 9.1

  Unrestricted Upload of File with Dangerous Type vulnerability in CreedAlly Bulk Featured Image bulk-featured-image allows Upload a Web Shell to a Web Server.This issue affects Bulk Featured Image: from n/a through <= 1.2.4.

  Product

  Bulk Featured Image

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update Bulk Featured Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Frontend File Manager: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-27358 · WordPress plugins & themes · reported by PatchstackMedium 4.6

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Code Injection.This issue affects Frontend File Manager: from n/a through <= 23.6.

  Product

  Frontend File Manager

  Affected

  up to 23.6

  What to do

  Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Video Gallery Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27326 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through <= 1.1.0.

  Product

  Video Gallery Block

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Video Gallery Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025WP fancybox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26591 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam WP fancybox wp-fancybox allows Stored XSS.This issue affects WP fancybox: from n/a through <= 1.0.3.

  Product

  WP fancybox

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update WP fancybox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025(Simply) Guest Author Name: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24764 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A. Jones (Simply) Guest Author Name guest-author-name allows DOM-Based XSS.This issue affects (Simply) Guest Author Name: from n/a through <= 4.36.

  Product

  (Simply) Guest Author Name

  Affected

  up to 4.36

  What to do

  Affects up to 4.36. Update (Simply) Guest Author Name to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025uDesign: Missing AuthorizationCVE-2025-24757 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in AndonDesign uDesign udesign.This issue affects uDesign: from n/a through <= 4.11.2.

  Product

  uDesign

  Affected

  up to 4.11.2

  What to do

  Affects up to 4.11.2. Update uDesign to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Avada: Missing AuthorizationCVE-2025-24748 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10.

  Product

  Avada

  Affected

  up to 7.11.10

  What to do

  Affects up to 7.11.10. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Chatra Live Chat + ChatBot + Cart Saver: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24735 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chatra Chatra Live Chat + ChatBot + Cart Saver allows Stored XSS. This issue affects Chatra Live Chat + ChatBot + Cart Saver: from n/a through 1.0.11.

  Product

  Chatra Live Chat + ChatBot + Cart Saver

  Affected

  up to 1.0.11

  What to do

  Affects up to 1.0.11. Update Chatra Live Chat + ChatBot + Cart Saver to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Contact Form 7 reCAPTCHA: Cross-Site Request Forgery (CSRF)CVE-2025-23972 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Brian S. Reed Contact Form 7 reCAPTCHA contact-form-7-recaptcha allows Cross Site Request Forgery.This issue affects Contact Form 7 reCAPTCHA: from n/a through <= 1.2.0.

  Product

  Contact Form 7 reCAPTCHA

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Contact Form 7 reCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Easy restaurant menu manager: Stored Cross-Site ScriptingCVE-2025-6673 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Easy restaurant menu manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's nsc_eprm_menu_link shortcode in versions up to, and including 2.0.1, due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Easy restaurant menu manager

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Easy restaurant menu manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jul 4, 2025Premium Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-11937 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Menu element in all versions up to, and including, 4.10.69 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Premium Addons for Elementor

  Affected

  up to 4.10.69

  What to do

  Affects up to 4.10.69. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jul 4, 2025Uncode Core: Stored Cross-Site ScriptingCVE-2025-6944 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Uncode Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uncode_hl_text' and 'uncode_text_icon' shortcodes in all versions up to, and including, 2.9.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Uncode Core

  Affected

  up to 2.9.4.2

  What to do

  Affects up to 2.9.4.2. Update Uncode Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsupport.undsgn.comwordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.