Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

6,570 results · page 32 of 132

Sep 22, 2025JSM file_get_contents() Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58653 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JS Morisset JSM file_get_contents() Shortcode wp-file-get-contents allows Stored XSS.This issue affects JSM file_get_contents() Shortcode: from n/a through <= 2.7.1.
Product
JSM file_get_contents() Shortcode
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update JSM file_get_contents() Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Carousel Ultimate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58652 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Carousel Ultimate carousel allows Stored XSS.This issue affects Carousel Ultimate: from n/a through <= 1.8.
Product
Carousel Ultimate
Affected
up to 1.8
What to do
Affects up to 1.8. Update Carousel Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025PlayerJS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58651 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PlayerJS PlayerJS playerjs allows DOM-Based XSS.This issue affects PlayerJS: from n/a through <= 2.24.
Product
PlayerJS
Affected
up to 2.24
What to do
Affects up to 2.24. Update PlayerJS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Simple JWT Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58648 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Stored XSS.This issue affects Simple JWT Login: from n/a through <= 3.6.4.
Product
Simple JWT Login
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update Simple JWT Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Simple Restaurant Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58647 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Will.I.am Simple Restaurant Menu simple-restaurant-menu allows Stored XSS.This issue affects Simple Restaurant Menu: from n/a through <= 1.2.
Product
Simple Restaurant Menu
Affected
up to 1.2
What to do
Affects up to 1.2. Update Simple Restaurant Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Mobi2Go: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58646 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chtombleson Mobi2Go mobi2go allows Stored XSS.This issue affects Mobi2Go: from n/a through <= 1.0.0.
Product
Mobi2Go
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Mobi2Go to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Gravitate Automated Tester: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58645 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gravitate Gravitate Automated Tester gravitate-automated-tester allows Stored XSS.This issue affects Gravitate Automated Tester: from n/a through <= 1.4.5.
Product
Gravitate Automated Tester
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Gravitate Automated Tester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025AnyClip Luminous Studio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58271 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AnyClip Video Platform AnyClip Luminous Studio anyclip-media allows Stored XSS.This issue affects AnyClip Luminous Studio: from n/a through <= 1.3.3.
Product
AnyClip Luminous Studio
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update AnyClip Luminous Studio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Gianism: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58266 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fumiki Takahashi Gianism gianism allows Stored XSS.This issue affects Gianism: from n/a through <= 6.0.0.
Product
Gianism
Affected
up to 6.0.0
What to do
Affects up to 6.0.0. Update Gianism to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Events Manager – OpenStreetMaps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58265 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stonehenge Creations Events Manager – OpenStreetMaps stonehenge-em-osm allows Stored XSS.This issue affects Events Manager – OpenStreetMaps: from n/a through <= 4.2.1.
Product
Events Manager – OpenStreetMaps
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Events Manager – OpenStreetMaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025JupiterX Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58264 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artbees JupiterX Core jupiterx-core allows Stored XSS.This issue affects JupiterX Core: from n/a through <= 4.11.0.
Product
JupiterX Core
Affected
up to 4.11.0
What to do
Affects up to 4.11.0. Update JupiterX Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025BuddyPress Notification Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58263 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev BuddyPress Notification Widget buddypress-notifications-widget allows Stored XSS.This issue affects BuddyPress Notification Widget: from n/a through <= 1.3.3.
Product
BuddyPress Notification Widget
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update BuddyPress Notification Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Highlight and Share: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58260 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Stored XSS.This issue affects Highlight and Share: from n/a through <= 5.1.1.
Product
Highlight and Share
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update Highlight and Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Verowa Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58257 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Stored XSS.This issue affects Verowa Connect: from n/a through <= 3.2.3.
Product
Verowa Connect
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update Verowa Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025DOAJ Export: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58256 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Brinley DOAJ Export doaj-export allows Stored XSS.This issue affects DOAJ Export: from n/a through <= 1.0.4.
Product
DOAJ Export
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update DOAJ Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025StylePress for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58254 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dtbaker StylePress for Elementor full-site-builder-for-elementor allows Stored XSS.This issue affects StylePress for Elementor: from n/a through <= 1.2.1.
Product
StylePress for Elementor
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update StylePress for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Real Estate Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58253 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows DOM-Based XSS.This issue affects Real Estate Manager: from n/a through <= 7.3.
Product
Real Estate Manager
Affected
up to 7.3
What to do
Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Pinterest Pinboard Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58248 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codefish Pinterest Pinboard Widget pinterest-pinboard-widget allows Stored XSS.This issue affects Pinterest Pinboard Widget: from n/a through <= 1.0.7.
Product
Pinterest Pinboard Widget
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Pinterest Pinboard Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58245 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bestweblayout Portfolio portfolio allows DOM-Based XSS.This issue affects Portfolio : from n/a through <= 2.58.
Product
Portfolio
Affected
up to 2.58
What to do
Affects up to 2.58. Update Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Bg Church Memos: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58242 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vadim Bogaiskov Bg Church Memos bg-church-memos allows DOM-Based XSS.This issue affects Bg Church Memos: from n/a through <= 1.1.
Product
Bg Church Memos
Affected
up to 1.1
What to do
Affects up to 1.1. Update Bg Church Memos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025SnapWidget Social Photo Feed Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58241 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snapwidget SnapWidget Social Photo Feed Widget snapwidget-wp-instagram-widget allows DOM-Based XSS.This issue affects SnapWidget Social Photo Feed Widget: from n/a through <= 1.1.0.
Product
SnapWidget Social Photo Feed Widget
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update SnapWidget Social Photo Feed Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025xili-tidy-tags: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58240 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-tidy-tags xili-tidy-tags allows Stored XSS.This issue affects xili-tidy-tags: from n/a through <= 1.12.06.
Product
xili-tidy-tags
Affected
up to 1.12.06
What to do
Affects up to 1.12.06. Update xili-tidy-tags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WP Category Dropdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58239 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chandrika Sista WP Category Dropdown wp-category-dropdown allows Stored XSS.This issue affects WP Category Dropdown: from n/a through <= 1.9.
Product
WP Category Dropdown
Affected
up to 1.9
What to do
Affects up to 1.9. Update WP Category Dropdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025PilotPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58238 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ONTRAPORT PilotPress pilotpress allows Stored XSS.This issue affects PilotPress: from n/a through <= 2.0.36.
Product
PilotPress
Affected
up to 2.0.36
What to do
Affects up to 2.0.36. Update PilotPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025LC Wizard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58237 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Niaj Morshed LC Wizard ghl-wizard allows Stored XSS.This issue affects LC Wizard: from n/a through <= 2.2.4.
Product
LC Wizard
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update LC Wizard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Front End Users: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58235 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows Stored XSS.This issue affects Front End Users: from n/a through <= 3.2.35.
Product
Front End Users
Affected
up to 3.2.35
What to do
Affects up to 3.2.35. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025JS Job Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58234 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomSky JS Job Manager js-jobs allows Stored XSS.This issue affects JS Job Manager: from n/a through <= 2.0.2.
Product
JS Job Manager
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update JS Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025SQL Chart Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58233 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Guaven Labs SQL Chart Builder sql-chart-builder allows DOM-Based XSS.This issue affects SQL Chart Builder: from n/a through <= 2.3.7.2.
Product
SQL Chart Builder
Affected
up to 2.3.7.2
What to do
Affects up to 2.3.7.2. Update SQL Chart Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Image Editor by Pixo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58232 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ickata Image Editor by Pixo image-editor-by-pixo allows DOM-Based XSS.This issue affects Image Editor by Pixo: from n/a through <= 2.3.8.
Product
Image Editor by Pixo
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update Image Editor by Pixo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Bitly: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58231 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bitlydeveloper Bitly wp-bitly allows Stored XSS.This issue affects Bitly: from n/a through <= 2.8.0.
Product
Bitly
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update Bitly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025ZoloBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58230 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes ZoloBlocks zoloblocks allows DOM-Based XSS.This issue affects ZoloBlocks: from n/a through <= 2.3.12.
Product
ZoloBlocks
Affected
up to 2.3.12
What to do
Affects up to 2.3.12. Update ZoloBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Sitekit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58229 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue affects Sitekit: from n/a through <= 2.0.
Product
Sitekit
Affected
up to 2.0
What to do
Affects up to 2.0. Update Sitekit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Quick View for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58228 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC Quick View for WooCommerce woo-quickview allows Stored XSS.This issue affects Quick View for WooCommerce: from n/a through <= 2.2.16.
Product
Quick View for WooCommerce
Affected
up to 2.2.16
What to do
Affects up to 2.2.16. Update Quick View for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Podlove Subscribe button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58227 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alexander Lueken Podlove Subscribe button podlove-subscribe-button allows Stored XSS.This issue affects Podlove Subscribe button: from n/a through <= 1.3.11.
Product
Podlove Subscribe button
Affected
up to 1.3.11
What to do
Affects up to 1.3.11. Update Podlove Subscribe button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025VoucherPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58223 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Taylor VoucherPress voucherpress allows Stored XSS.This issue affects VoucherPress: from n/a through <= 1.5.7.
Product
VoucherPress
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update VoucherPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Card Elements for WPBakery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58220 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Techeshta Card Elements for WPBakery card-elements-for-wpbakery allows DOM-Based XSS.This issue affects Card Elements for WPBakery: from n/a through <= 1.0.8.
Product
Card Elements for WPBakery
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Card Elements for WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Draft: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58033 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leeshadle Draft website-builder allows Stored XSS.This issue affects Draft: from n/a through <= 3.0.9.
Product
Draft
Affected
up to 3.0.9
What to do
Affects up to 3.0.9. Update Draft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Nextend Facebook Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58031 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nextendweb Nextend Facebook Connect nextend-facebook-connect allows Stored XSS.This issue affects Nextend Facebook Connect : from n/a through <= 3.1.19.
Product
Nextend Facebook Connect
Affected
up to 3.1.19
What to do
Affects up to 3.1.19. Update Nextend Facebook Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Page-list: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58030 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Page-list page-list allows Stored XSS.This issue affects Page-list: from n/a through <= 5.8.
Product
Page-list
Affected
up to 5.8
What to do
Affects up to 5.8. Update Page-list to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Designil PDPA Thailand: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58028 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aum Watcharapon Designil PDPA Thailand pdpa-thailand allows Stored XSS.This issue affects Designil PDPA Thailand: from n/a through <= 2.0.1.
Product
Designil PDPA Thailand
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Designil PDPA Thailand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025NGG Smart Image Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58027 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows Stored XSS.This issue affects NGG Smart Image Search: from n/a through <= 3.4.3.
Product
NGG Smart Image Search
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update NGG Smart Image Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Termageddon: Cookie Consent & Privacy Compliance: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58026 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in termageddon Termageddon: Cookie Consent & Privacy Compliance termageddon-usercentrics allows Stored XSS.This issue affects Termageddon: Cookie Consent & Privacy Compliance: from n/a through <= 1.8.1.
Product
Termageddon: Cookie Consent & Privacy Compliance
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Termageddon: Cookie Consent & Privacy Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Master Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58025 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Master Slider master-slider allows Stored XSS.This issue affects Master Slider: from n/a through <= 3.11.0.
Product
Master Slider
Affected
up to 3.11.0
What to do
Affects up to 3.11.0. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Genealogical Tree: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58023 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in akdevs Genealogical Tree genealogical-tree allows Stored XSS.This issue affects Genealogical Tree: from n/a through <= 2.2.7.
Product
Genealogical Tree
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update Genealogical Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025ShortCode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58022 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxpagels ShortCode shortcode allows Stored XSS.This issue affects ShortCode: from n/a through <= 0.8.1.
Product
ShortCode
Affected
up to 0.8.1
What to do
Affects up to 0.8.1. Update ShortCode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025List Child Pages Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58021 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in douglaskarr List Child Pages Shortcode list-child-pages-shortcode allows Stored XSS.This issue affects List Child Pages Shortcode: from n/a through <= 1.3.1.
Product
List Child Pages Shortcode
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update List Child Pages Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Theater for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58020 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress theatre allows Stored XSS.This issue affects Theater for WordPress: from n/a through <= 0.18.8.
Product
Theater for
Affected
up to 0.18.8
What to do
Affects up to 0.18.8. Update Theater for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Search Atlas SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58019 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Search Atlas Group Search Atlas SEO metasync allows Stored XSS.This issue affects Search Atlas SEO: from n/a through <= 2.5.4.
Product
Search Atlas SEO
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update Search Atlas SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Mail Subscribe List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58018 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Leishman Mail Subscribe List mail-subscribe-list allows Stored XSS.This issue affects Mail Subscribe List: from n/a through <= 2.1.10.
Product
Mail Subscribe List
Affected
up to 2.1.10
What to do
Affects up to 2.1.10. Update Mail Subscribe List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Ultimate Store Kit Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58017 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.8.6.
Product
Ultimate Store Kit Elementor Addons
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.