Vulnerability database

9,239 results · page 35 of 185

• Jan 22, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67923 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.7.7.

  Product

  JetEngine

  Affected

  up to 3.7.7

  What to do

  Affects up to 3.7.7. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Anon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67620 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CleverSoft Anon anon2x allows Reflected XSS.This issue affects Anon: from n/a through <= 2.2.10.

  Product

  Anon

  Affected

  up to 2.2.10

  What to do

  Affects up to 2.2.10. Update Anon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Mella: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67616 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Mella mella allows PHP Local File Inclusion.This issue affects Mella: from n/a through <= 1.2.29.

  Product

  Mella

  Affected

  up to 1.2.29

  What to do

  Affects up to 1.2.29. Update Mella to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Myour: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67615 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bslthemes Myour myour allows PHP Local File Inclusion.This issue affects Myour: from n/a through <= 1.5.1.

  Product

  Myour

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update Myour to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026TheNa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67614 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foreverpinetree TheNa thena allows Reflected XSS.This issue affects TheNa: from n/a through <= 1.5.5.

  Product

  TheNa

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update TheNa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Grand Restaurant Theme Elements for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63026 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant Theme Elements for Elementor grandrestaurant-elementor allows Stored XSS.This issue affects Grand Restaurant Theme Elements for Elementor: from n/a through <= 2.1.1.

  Product

  Grand Restaurant Theme Elements for Elementor

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update Grand Restaurant Theme Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026WerkStatt: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-63017 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes WerkStatt Plugin werkstatt-plugin allows PHP Local File Inclusion.This issue affects WerkStatt Plugin: from n/a through <= 1.6.6.

  Product

  WerkStatt

  Affected

  up to 1.6.6

  What to do

  Affects up to 1.6.6. Update WerkStatt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Affiliate Link Tracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62077 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SEOSEON EUROPE S.L Affiliate Link Tracker affiliate-link-tracker allows Stored XSS.This issue affects Affiliate Link Tracker: from n/a through <= 0.2.

  Product

  Affiliate Link Tracker

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update Affiliate Link Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Depot: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-54003 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Depot depot allows PHP Local File Inclusion.This issue affects Depot: from n/a through <= 1.16.

  Product

  Depot

  Affected

  up to 1.16

  What to do

  Affects up to 1.16. Update Depot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026WordPress Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53240 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in adamlabs WordPress Photo Gallery photo-gallery-portfolio allows Reflected XSS.This issue affects WordPress Photo Gallery: from n/a through <= 1.1.0.

  Product

  WordPress Photo Gallery

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update WordPress Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026flexo-posts-manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52762 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexostudio flexo-posts-manager flexo-posts-manager allows Reflected XSS.This issue affects flexo-posts-manager: from n/a through <= 1.0001.

  Product

  flexo-posts-manager

  Affected

  up to 1.0001

  What to do

  Affects up to 1.0001. Update flexo-posts-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Restaurante: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52746 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ayecode Restaurante restaurante allows Reflected XSS.This issue affects Restaurante: from n/a through <= 3.0.7.

  Product

  Restaurante

  Affected

  up to 3.0.7

  What to do

  Affects up to 3.0.7. Update Restaurante to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026xSmart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50006 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jthemes xSmart xsmart allows Reflected XSS.This issue affects xSmart: from n/a through <= 1.2.9.4.

  Product

  xSmart

  Affected

  up to 1.2.9.4

  What to do

  Affects up to 1.2.9.4. Update xSmart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026tagDiv Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50005 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows DOM-Based XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.2.

  Product

  tagDiv Composer

  Affected

  up to 5.4.2

  What to do

  Affects up to 5.4.2. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Amuli: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-50003 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Amuli amuli allows PHP Local File Inclusion.This issue affects Amuli: from n/a through <= 2.3.0.

  Product

  Amuli

  Affected

  up to 2.3.0

  What to do

  Affects up to 2.3.0. Update Amuli to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Athens: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49994 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Athens athens allows PHP Local File Inclusion.This issue affects Athens: from n/a through <= 1.1.6.

  Product

  Athens

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Athens to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Pondol BBS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49336 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pondol Pondol BBS pondol-bbs allows Stored XSS.This issue affects Pondol BBS: from n/a through <= 1.1.8.4.

  Product

  Pondol BBS

  Affected

  up to 1.1.8.4

  What to do

  Affects up to 1.1.8.4. Update Pondol BBS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Drone: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49249 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ApusTheme Drone drone allows Reflected XSS.This issue affects Drone: from n/a through <= 1.40.

  Product

  Drone

  Affected

  up to 1.40

  What to do

  Affects up to 1.40. Update Drone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Accordion Slider PRO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49066 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Accordion Slider PRO accordion_slider_pro allows Reflected XSS.This issue affects Accordion Slider PRO: from n/a through <= 1.2.

  Product

  Accordion Slider PRO

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Accordion Slider PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026WP Lead Capturing Pages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49055 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5.

  Product

  WP Lead Capturing Pages

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update WP Lead Capturing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026WP Lead Capturing Pages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49050 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5.

  Product

  WP Lead Capturing Pages

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update WP Lead Capturing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026DZS Video Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49049 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZoomIt DZS Video Gallery dzs-videogallery allows SQL Injection.This issue affects DZS Video Gallery: from n/a through <= 12.39.

  Product

  DZS Video Gallery

  Affected

  up to 12.39

  What to do

  Affects up to 12.39. Update DZS Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026xPromoter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49046 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup xPromoter top_bar_promoter allows Reflected XSS.This issue affects xPromoter: from n/a through <= 1.3.4.

  Product

  xPromoter

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update xPromoter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Super Interactive Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49045 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Interactive Maps super-interactive-maps allows Reflected XSS.This issue affects Super Interactive Maps: from n/a through <= 2.3.

  Product

  Super Interactive Maps

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Super Interactive Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Magic Responsive Slider and Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49043 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Magic Responsive Slider and Carousel WordPress magic_carousel allows Reflected XSS.This issue affects Magic Responsive Slider and Carousel WordPress: from n/a through <= 1.6.

  Product

  Magic Responsive Slider and Carousel

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Magic Responsive Slider and Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Magic Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48094 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Magic Slider magic_slider allows Reflected XSS.This issue affects Magic Slider: from n/a through <= 2.2.

  Product

  Magic Slider

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Magic Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Image&Video FullScreen Background: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47666 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Image&Video FullScreen Background lbg_fullscreen_fullwidth_slider allows Reflected XSS.This issue affects Image&Video FullScreen Background: from n/a through <= 1.6.7.

  Product

  Image&Video FullScreen Background

  Affected

  up to 1.6.7

  What to do

  Affects up to 1.6.7. Update Image&Video FullScreen Background to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026WoodMart: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-47600 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in xtemos WoodMart woodmart allows Code Injection.This issue affects WoodMart: from n/a through <= 8.3.7.

  Product

  WoodMart

  Affected

  up to 8.3.7

  What to do

  Affects up to 8.3.7. Update WoodMart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Stackable: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47500 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Stored XSS.This issue affects Stackable: from n/a through <= 3.19.5.

  Product

  Stackable

  Affected

  up to 3.19.5

  What to do

  Affects up to 3.19.5. Update Stackable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Anarkali: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47474 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ninetheme Anarkali anarkali allows PHP Local File Inclusion.This issue affects Anarkali: from n/a through <= 1.0.9.

  Product

  Anarkali

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Anarkali to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026HTML5 Video Player with Playlist & Multiple Skins: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32123 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup HTML5 Video Player with Playlist & Multiple Skins lbg-vp2-html5-rightside allows Reflected XSS.This issue affects HTML5 Video Player with Playlist & Multiple Skins: from n/a through <= 5.3.5.

  Product

  HTML5 Video Player with Playlist & Multiple Skins

  Affected

  up to 5.3.5

  What to do

  Affects up to 5.3.5. Update HTML5 Video Player with Playlist & Multiple Skins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026HTML5 Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27005 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup HTML5 Video Player lbg-vp2-html5-bottom allows Reflected XSS.This issue affects HTML5 Video Player: from n/a through <= 5.3.5.

  Product

  HTML5 Video Player

  Affected

  up to 5.3.5

  What to do

  Affects up to 5.3.5. Update HTML5 Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 17, 2026Demo Importer Plus: XML External Entity Injection (XXE)CVE-2025-14478 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in vulnerable configurations. This only impacts sites on versions of PHP older than 8.0.

  Product

  Demo Importer Plus

  Affected

  up to 2.0.9

  What to do

  Affects up to 2.0.9. Update Demo Importer Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 17, 2026CM E-Mail Blacklist – Simple email filtering for safer registration: Stored Cross-Site ScriptingCVE-2026-0691 · WordPress plugins & themes · reported by WordfenceMedium 4.4

  The CM E-Mail Blacklist – Simple email filtering for safer registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'black_email' parameter in all versions up to, and including, 1.6.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

  Product

  CM E-Mail Blacklist – Simple email filtering for safer registration

  Affected

  up to 1.6.2

  What to do

  Affects up to 1.6.2. Update CM E-Mail Blacklist – Simple email filtering for safer registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 16, 2026RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging: Reflected Cross-Site ScriptingCVE-2025-14375 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 5.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging

  Affected

  up to 5.0.10

  What to do

  Affects up to 5.0.10. Update RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 14, 2026Appointment Booking Calendar — Simply Schedule Appointments Booking: Blind SQL InjectionCVE-2025-12166 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection via the `order` and `append_where_sql` parameters in all versions up to, and including, 1.6.9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  Product

  Appointment Booking Calendar — Simply Schedule Appointments Booking

  Affected

  up to 1.6.9.9

  What to do

  Affects up to 1.6.9.9. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 13, 2026the slider import search feature and tab parameter: WPForms 1.7.8 contains a cross-site scriptingCVE-2020-36919 · WordPress plugins & themes · reported by VulnCheckMedium 5.1

  WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts through the ListTable.php endpoint to execute arbitrary JavaScript in victim's browser.

  Product

  the slider import search feature and tab parameter

  Affected

  up to 1.7.8

  What to do

  Affects up to 1.7.8. Update the slider import search feature and tab parameter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordpress.orgexploit-db.com

• Jan 13, 2026Lemonsoft WordPress add on: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2025-9427 · WordPress plugins & themes · reported by db4dfee8-a97e-4877-bfae-eba6d14a2166High 8.4

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Lemonsoft WordPress add on allows Cross-Site Scripting (XSS).This issue affects WordPress add on: 2025.7.1.

  Product

  Lemonsoft WordPress add on

  What to do

  Update Lemonsoft WordPress add on to the newest version.

  Full record and what to do →NVD recordlemondoc.atlassian.net

• Jan 8, 2026Handmade Framework: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22521 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in G5Theme Handmade Framework handmade-framework allows PHP Local File Inclusion.This issue affects Handmade Framework: from n/a through <= 3.9.

  Product

  Handmade Framework

  Affected

  up to 3.9

  What to do

  Affects up to 3.9. Update Handmade Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026MediaPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22519 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev MediaPress mediapress allows Stored XSS.This issue affects MediaPress: from n/a through <= 1.6.2.

  Product

  MediaPress

  Affected

  up to 1.6.2

  What to do

  Affects up to 1.6.2. Update MediaPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026X Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22518 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows DOM-Based XSS.This issue affects X Addons for Elementor: from n/a through <= 1.0.23.

  Product

  X Addons for Elementor

  Affected

  up to 1.0.23

  What to do

  Affects up to 1.0.23. Update X Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Easy Media Download: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-69169 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noor Alam Easy Media Download easy-media-download allows Reflection Injection.This issue affects Easy Media Download: from n/a through <= 1.1.11.

  Product

  Easy Media Download

  Affected

  up to 1.1.11

  What to do

  Affects up to 1.1.11. Update Easy Media Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Scroll rss excerpt: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68892 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus@hotmail.com Scroll rss excerpt scroll-rss-excerpt allows Reflected XSS.This issue affects Scroll rss excerpt: from n/a through <= 5.0.

  Product

  Scroll rss excerpt

  Affected

  up to 5.0

  What to do

  Affects up to 5.0. Update Scroll rss excerpt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026WP App Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68891 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Sutana WP App Bar wp-app-bar allows Reflected XSS.This issue affects WP App Bar: from n/a through <= 1.5.

  Product

  WP App Bar

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update WP App Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026e-shops: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68890 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hands01 e-shops e-shops-cart2 allows DOM-Based XSS.This issue affects e-shops: from n/a through <= 1.0.4.

  Product

  e-shops

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update e-shops to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Pinpoll: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68889 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pinpoll Pinpoll pinpoll allows Reflected XSS.This issue affects Pinpoll: from n/a through <= 4.0.0.

  Product

  Pinpoll

  Affected

  up to 4.0.0

  What to do

  Affects up to 4.0.0. Update Pinpoll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026WP-BusinessDirectory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68887 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Reflected XSS.This issue affects WP-BusinessDirectory: from n/a through <= 4.0.1.

  Product

  WP-BusinessDirectory

  Affected

  up to 4.0.1

  What to do

  Affects up to 4.0.1. Update WP-BusinessDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Flaming Password Reset: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68875 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jcaruso001 Flaming Password Reset flaming-password-reset allows Stored XSS.This issue affects Flaming Password Reset: from n/a through <= 1.0.3.

  Product

  Flaming Password Reset

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Flaming Password Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Visitor Stats Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68874 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Visitor Stats Widget visitor-stats-widget allows Reflected XSS.This issue affects Visitor Stats Widget: from n/a through <= 1.5.0.

  Product

  Visitor Stats Widget

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update Visitor Stats Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026PRIMER by chloédigital: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68873 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chloédigital PRIMER by chloédigital primer-by-chloedigital allows Reflected XSS.This issue affects PRIMER by chloédigital: from n/a through <= 1.0.25.

  Product

  PRIMER by chloédigital

  Affected

  up to 1.0.25

  What to do

  Affects up to 1.0.25. Update PRIMER by chloédigital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.