Vulnerability database

6,571 results · page 34 of 132

• Sep 22, 2025Epeken All Kurir: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57906 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in epeken Epeken All Kurir epeken-all-kurir allows Stored XSS.This issue affects Epeken All Kurir: from n/a through <= 2.0.6.

  Product

  Epeken All Kurir

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update Epeken All Kurir to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Sales Count Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57904 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-EXPERTS.IN Sales Count Manager for WooCommerce wc-sales-count-manager allows Stored XSS.This issue affects Sales Count Manager for WooCommerce: from n/a through <= 2.6.

  Product

  Sales Count Manager for WooCommerce

  Affected

  up to 2.6

  What to do

  Affects up to 2.6. Update Sales Count Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WooCommerce Additional Fees On Checkout (Free): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57903 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPSuperiors Developer WooCommerce Additional Fees On Checkout (Free) woo-additional-fees-on-checkout-wordpress allows Stored XSS.This issue affects WooCommerce Additional Fees On Checkout (Free): from n/a through <= 1.5.2.

  Product

  WooCommerce Additional Fees On Checkout (Free)

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update WooCommerce Additional Fees On Checkout (Free) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025GutenKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57900 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ataur R GutenKit gutenkit-blocks-addon allows Stored XSS.This issue affects GutenKit: from n/a through <= 2.4.2.

  Product

  GutenKit

  Affected

  up to 2.4.2

  What to do

  Affects up to 2.4.2. Update GutenKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Frontend Admin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57898 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Vega WP Frontend Admin display-admin-page-on-frontend allows Stored XSS.This issue affects WP Frontend Admin: from n/a through <= 1.22.7.

  Product

  WP Frontend Admin

  Affected

  up to 1.22.7

  What to do

  Affects up to 1.22.7. Update WP Frontend Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025DELUCKS SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53570 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Stored XSS.This issue affects DELUCKS SEO: from n/a through <= 2.7.0.

  Product

  DELUCKS SEO

  Affected

  up to 2.7.0

  What to do

  Affects up to 2.7.0. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025BMI Adult & Kid Calculator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53469 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mortgage Calculator BMI Adult & Kid Calculator bmi-adultkid-calculator allows Stored XSS.This issue affects BMI Adult & Kid Calculator: from n/a through <= 1.2.2.

  Product

  BMI Adult & Kid Calculator

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update BMI Adult & Kid Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Login-Logout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53467 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Login-Logout login-logout allows Stored XSS.This issue affects Login-Logout: from n/a through <= 3.8.

  Product

  Login-Logout

  Affected

  up to 3.8

  What to do

  Affects up to 3.8. Update Login-Logout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Better Find and Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53466 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Better Find and Replace real-time-auto-find-and-replace allows Stored XSS.This issue affects Better Find and Replace: from n/a through <= 1.7.6.

  Product

  Better Find and Replace

  Affected

  up to 1.7.6

  What to do

  Affects up to 1.7.6. Update Better Find and Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Mailto Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53464 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Online Optimisation WP Mailto Links wp-mailto-links allows Stored XSS.This issue affects WP Mailto Links: from n/a through <= 3.1.4.

  Product

  WP Mailto Links

  Affected

  up to 3.1.4

  What to do

  Affects up to 3.1.4. Update WP Mailto Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025HT Mega – Absolute Addons for WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53463 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Mega – Absolute Addons for WPBakery Page Builder ht-mega-for-wpbakery allows DOM-Based XSS.This issue affects HT Mega – Absolute Addons for WPBakery Page Builder: from n/a through <= 1.0.9.

  Product

  HT Mega – Absolute Addons for WPBakery Page Builder

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update HT Mega – Absolute Addons for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025SAPO Feed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53462 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SAPO SAPO Feed sapo-feed allows Stored XSS.This issue affects SAPO Feed: from n/a through <= 2.4.2.

  Product

  SAPO Feed

  Affected

  up to 2.4.2

  What to do

  Affects up to 2.4.2. Update SAPO Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025AffiliateWP – External Referral Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53460 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi AffiliateWP – External Referral Links affiliatewp-external-referral-links allows Stored XSS.This issue affects AffiliateWP – External Referral Links: from n/a through <= 1.2.0.

  Product

  AffiliateWP – External Referral Links

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update AffiliateWP – External Referral Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Goracash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53458 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davaxi Goracash goracash allows Stored XSS.This issue affects Goracash: from n/a through <= 1.1.

  Product

  Goracash

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Goracash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025CashBill.pl – Płatności WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53455 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CashBill CashBill.pl – Płatności WooCommerce cashbill-payment-method allows Stored XSS.This issue affects CashBill.pl – Płatności WooCommerce: from n/a through <= 3.2.1.

  Product

  CashBill.pl – Płatności WooCommerce

  Affected

  up to 3.2.1

  What to do

  Affects up to 3.2.1. Update CashBill.pl – Płatności WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Ultimate WP Mail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53454 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Stored XSS.This issue affects Ultimate WP Mail: from n/a through <= 1.3.8.

  Product

  Ultimate WP Mail

  Affected

  up to 1.3.8

  What to do

  Affects up to 1.3.8. Update Ultimate WP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025ShopLentor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58990 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Stored XSS.This issue affects ShopLentor: from n/a through <= 3.2.0.

  Product

  ShopLentor

  Affected

  up to 3.2.0

  What to do

  Affects up to 3.2.0. Update ShopLentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Dynamic Text Field For Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58989 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silverplugins217 Dynamic Text Field For Contact Form 7 dynamic-text-field-for-contact-form-7 allows Stored XSS.This issue affects Dynamic Text Field For Contact Form 7: from n/a through <= 1.0.

  Product

  Dynamic Text Field For Contact Form 7

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Dynamic Text Field For Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025My Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58988 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Dolson My Tickets my-tickets allows Stored XSS.This issue affects My Tickets: from n/a through <= 2.0.22.

  Product

  My Tickets

  Affected

  up to 2.0.22

  What to do

  Affects up to 2.0.22. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Football Pool: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58987 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.This issue affects Football Pool: from n/a through <= 2.12.6.

  Product

  Football Pool

  Affected

  up to 2.12.6

  What to do

  Affects up to 2.12.6. Update Football Pool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Additional Custom Product Tabs for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58985 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce product-tabs-for-woocommerce allows Stored XSS.This issue affects Additional Custom Product Tabs for WooCommerce: from n/a through <= 1.7.3.

  Product

  Additional Custom Product Tabs for WooCommerce

  Affected

  up to 1.7.3

  What to do

  Affects up to 1.7.3. Update Additional Custom Product Tabs for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58984 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through <= 2.11.20.

  Product

  Welcart e-Commerce

  Affected

  up to 2.11.20

  What to do

  Affects up to 2.11.20. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Include Me: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58983 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefano Lissa Include Me include-me allows Stored XSS.This issue affects Include Me: from n/a through <= 1.3.2.

  Product

  Include Me

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update Include Me to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Pixeline's Email Protector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58982 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline Pixeline's Email Protector pixelines-email-protector allows Stored XSS.This issue affects Pixeline's Email Protector: from n/a through <= 1.3.8.

  Product

  Pixeline's Email Protector

  Affected

  up to 1.3.8

  What to do

  Affects up to 1.3.8. Update Pixeline's Email Protector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Blog Designer PRO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47694 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.

  Product

  Blog Designer PRO

  Affected

  up to 3.4.7

  What to do

  Affects up to 3.4.7. Update Blog Designer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025WooCommerce Photo Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47570 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews.This issue affects WooCommerce Photo Reviews: from n/a through <= 1.3.13.

  Product

  WooCommerce Photo Reviews

  Affected

  up to 1.3.13

  What to do

  Affects up to 1.3.13. Update WooCommerce Photo Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025WP Weixin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30875 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alexandre Froger WP Weixin wp-weixin allows Stored XSS.This issue affects WP Weixin: from n/a through <= 1.3.16.

  Product

  WP Weixin

  Affected

  up to 1.3.16

  What to do

  Affects up to 1.3.16. Update WP Weixin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in: Unauthorized access and modification of dataCVE-2025-9542 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple plugin's functions in all versions up to, and including, 5.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify integration settings or view existing automations.

  Product

  AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in

  Affected

  up to 5.3.7

  What to do

  Affects up to 5.3.7. Update AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Sep 9, 2025AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in: Unauthorized modification of dataCVE-2025-9539 · WordPress plugins & themes · reported by WordfenceHigh 8

  The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the automatorwp_ajax_import_automation_from_url function in all versions up to, and including, 5.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary automations, which can lead to Remote Code Execution or Privilege escalation once such automation is activated by the administrator

  Product

  AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in

  Affected

  up to 5.3.6

  What to do

  Affects up to 5.3.6. Update AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Sep 5, 2025WordPress Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53307 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder WordPress Assistant assistant allows Reflected XSS.This issue affects WordPress Assistant: from n/a through <= 1.5.2.

  Product

  WordPress Assistant

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update WordPress Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Easy Flash Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48105 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Boiardt Easy Flash Embed easy-flash-embed allows Stored XSS.This issue affects Easy Flash Embed: from n/a through <= 1.0.

  Product

  Easy Flash Embed

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Easy Flash Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Today's Date Inserter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48103 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mulscully Today's Date Inserter todays-date-inserter allows Stored XSS.This issue affects Today's Date Inserter: from n/a through <= 1.2.1.

  Product

  Today's Date Inserter

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Today's Date Inserter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48102 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gourl GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership gourl-bitcoin-payment-gateway-paid-downloads-membership allows Stored XSS.This issue affects GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership: from n/a through <= 1.6.6.

  Product

  GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership

  Affected

  up to 1.6.6

  What to do

  Affects up to 1.6.6. Update GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Course Booking Platform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58887 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Course Finder | andré martin - it solutions & research UG Course Booking Platform course-booking-platform allows Stored XSS.This issue affects Course Booking Platform: from n/a through <= 1.0.0.

  Product

  Course Booking Platform

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Course Booking Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Instant Locations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58886 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tan Nguyen Instant Locations instant-locations allows Stored XSS.This issue affects Instant Locations: from n/a through <= 1.0.

  Product

  Instant Locations

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Instant Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025vipdrv: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58884 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ivan Drago vipdrv vipdrv-vip-test-drive allows Stored XSS.This issue affects vipdrv: from n/a through <= 1.0.3.

  Product

  vipdrv

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update vipdrv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Search Cloud One: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58883 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Harris Search Cloud One search-cloud-one allows Stored XSS.This issue affects Search Cloud One: from n/a through <= 2.2.5.

  Product

  Search Cloud One

  Affected

  up to 2.2.5

  What to do

  Affects up to 2.2.5. Update Search Cloud One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Simple Text Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58882 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in w1zzard Simple Text Slider simple-text-slider allows Stored XSS.This issue affects Simple Text Slider: from n/a through <= 1.0.5.

  Product

  Simple Text Slider

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Simple Text Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Translate This gTranslate Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58880 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reubenthiessen Translate This gTranslate Shortcode translate-this-google-translate-web-element-shortcode allows Stored XSS.This issue affects Translate This gTranslate Shortcode: from n/a through <= 1.0.

  Product

  Translate This gTranslate Shortcode

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Translate This gTranslate Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Aparat Video Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58876 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ali Aghdam Aparat Video Shortcode aparat-shortcode allows Stored XSS.This issue affects Aparat Video Shortcode: from n/a through <= 0.2.4.

  Product

  Aparat Video Shortcode

  Affected

  up to 0.2.4

  What to do

  Affects up to 0.2.4. Update Aparat Video Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025WP Github Gist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58875 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sudar Muthu WP Github Gist wp-github-gist allows Stored XSS.This issue affects WP Github Gist: from n/a through <= 0.5.

  Product

  WP Github Gist

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update WP Github Gist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025StoryMap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58874 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in josepsitjar StoryMap wp-storymap allows DOM-Based XSS.This issue affects StoryMap: from n/a through <= 2.1.

  Product

  StoryMap

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update StoryMap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Pushe Web Push Notification: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58873 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pusheco Pushe Web Push Notification pushe-webpush allows Stored XSS.This issue affects Pushe Web Push Notification: from n/a through <= 0.5.0.

  Product

  Pushe Web Push Notification

  Affected

  up to 0.5.0

  What to do

  Affects up to 0.5.0. Update Pushe Web Push Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Master Paper Collapse Toggle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58871 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Luis Rock Master Paper Collapse Toggle master-paper-collapse-toggle allows Stored XSS.This issue affects Master Paper Collapse Toggle: from n/a through <= 1.1.

  Product

  Master Paper Collapse Toggle

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Master Paper Collapse Toggle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025WP-GraphViz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58870 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeBAAT WP-GraphViz wp-graphviz allows DOM-Based XSS.This issue affects WP-GraphViz: from n/a through <= 1.5.1.

  Product

  WP-GraphViz

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update WP-GraphViz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025SimaCookie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58868 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simasicher SimaCookie simasicher-dsgvo-cookie allows Stored XSS.This issue affects SimaCookie: from n/a through <= 1.3.2.

  Product

  SimaCookie

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update SimaCookie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Easy Download Media Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58867 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Remi Corson Easy Download Media Counter easy-download-media-counter allows Stored XSS.This issue affects Easy Download Media Counter: from n/a through <= 1.2.

  Product

  Easy Download Media Counter

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Easy Download Media Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025金数据: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58864 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iamroody 金数据 jinshuju allows Stored XSS.This issue affects 金数据: from n/a through <= 1.0.

  Product

  金数据

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update 金数据 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Zoomify embed for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58863 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SdeWijs Zoomify embed for WP zoom-image-shortcode allows Stored XSS.This issue affects Zoomify embed for WP: from n/a through <= 1.5.2.

  Product

  Zoomify embed for WP

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update Zoomify embed for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025WordPress Events Calendar Plugin – connectDaily: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58862 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in George Sexton WordPress Events Calendar Plugin – connectDaily connect-daily-web-calendar allows Stored XSS.This issue affects WordPress Events Calendar Plugin – connectDaily: from n/a through <= 1.5.5.

  Product

  WordPress Events Calendar Plugin – connectDaily

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update WordPress Events Calendar Plugin – connectDaily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.