Vulnerability database

41,181 results · page 359 of 824

• Apr 24, 2025Carousel-of-post-images: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46536 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RichardHarrison Carousel-of-post-images carousel-of-post-images allows DOM-Based XSS.This issue affects Carousel-of-post-images: from n/a through <= 1.07.

  Product

  Carousel-of-post-images

  Affected

  up to 1.07

  What to do

  Affects up to 1.07. Update Carousel-of-post-images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Image Style Hover: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46534 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DanielRiera Image Style Hover image-content-show-hover allows DOM-Based XSS.This issue affects Image Style Hover: from n/a through <= 1.0.6.

  Product

  Image Style Hover

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Image Style Hover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Landing pages and Domain aliases for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46533 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdrift.no Landing pages and Domain aliases for WordPress landing-pages-and-domain-aliases allows Stored XSS.This issue affects Landing pages and Domain aliases for WordPress: from n/a through <= 0.8.

  Product

  Landing pages and Domain aliases for

  Affected

  up to 0.8

  What to do

  Affects up to 0.8. Update Landing pages and Domain aliases for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Tooltip: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46532 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Haris Zulfiqar Tooltip wp-tooltip allows DOM-Based XSS.This issue affects Tooltip: from n/a through <= 1.0.1.

  Product

  Tooltip

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Tooltip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025WP AVCL Automation Helper (formerly WPFlyLeads): Server-Side Request Forgery (SSRF)CVE-2025-46531 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Server-Side Request Forgery (SSRF) vulnerability in Ankur Vishwakarma WP AVCL Automation Helper (formerly WPFlyLeads) woozap allows Server Side Request Forgery.This issue affects WP AVCL Automation Helper (formerly WPFlyLeads): from n/a through <= 3.4.

  Product

  WP AVCL Automation Helper (formerly WPFlyLeads)

  Affected

  up to 3.4

  What to do

  Affects up to 3.4. Update WP AVCL Automation Helper (formerly WPFlyLeads) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Hacklog Remote Attachment: Cross-Site Request Forgery (CSRF)CVE-2025-46530 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Attachment hacklog-remote-attachment allows Stored XSS.This issue affects Hacklog Remote Attachment: from n/a through <= 1.3.2.

  Product

  Hacklog Remote Attachment

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update Hacklog Remote Attachment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Business Contact Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46529 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StressFree Sites Business Contact Widget business-contact-widget allows Stored XSS.This issue affects Business Contact Widget: from n/a through <= 2.7.0.

  Product

  Business Contact Widget

  Affected

  up to 2.7.0

  What to do

  Affects up to 2.7.0. Update Business Contact Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Availability Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-46528 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Steve Availability Calendar availability allows Stored XSS.This issue affects Availability Calendar: from n/a through <= 0.2.4.

  Product

  Availability Calendar

  Affected

  up to 0.2.4

  What to do

  Affects up to 0.2.4. Update Availability Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025WP Cookie Consent: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46525 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in msmitley WP Cookie Consent wp-cookie-consent allows Stored XSS.This issue affects WP Cookie Consent: from n/a through <= 1.0.

  Product

  WP Cookie Consent

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025WP Filter Post Category: Cross-Site Request Forgery (CSRF)CVE-2025-46524 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in stesvis WP Filter Post Category wp-filter-post-categories allows Stored XSS.This issue affects WP Filter Post Category: from n/a through <= 2.1.4.

  Product

  WP Filter Post Category

  Affected

  up to 2.1.4

  What to do

  Affects up to 2.1.4. Update WP Filter Post Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025COVID-19 (Coronavirus) Update Your Customers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46523 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devignstudiosltd COVID-19 (Coronavirus) Update Your Customers covid-19-alert allows Stored XSS.This issue affects COVID-19 (Coronavirus) Update Your Customers: from n/a through <= 1.5.1.

  Product

  COVID-19 (Coronavirus) Update Your Customers

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update COVID-19 (Coronavirus) Update Your Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Tabs: Cross-Site Request Forgery (CSRF)CVE-2025-46522 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Billy Bryant Tabs gt-tabs allows Stored XSS.This issue affects Tabs: from n/a through <= 4.0.3.

  Product

  Tabs

  Affected

  up to 4.0.3

  What to do

  Affects up to 4.0.3. Update Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025WS Force Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46521 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Silver Muru WS Force Login Page ws-force-login-page allows Stored XSS.This issue affects WS Force Login Page: from n/a through <= 3.0.3.

  Product

  WS Force Login Page

  Affected

  up to 3.0.3

  What to do

  Affects up to 3.0.3. Update WS Force Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Related Posts via Taxonomies: Cross-Site Request Forgery (CSRF)CVE-2025-46520 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in alphasis Related Posts via Taxonomies related-posts-via-taxonomies allows Stored XSS.This issue affects Related Posts via Taxonomies: from n/a through <= 1.0.1.

  Product

  Related Posts via Taxonomies

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Related Posts via Taxonomies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Media Library Downloader: Missing AuthorizationCVE-2025-46519 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in M.Code Media Library Downloader media-library-downloader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media Library Downloader: from n/a through <= 1.3.1.

  Product

  Media Library Downloader

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Media Library Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Blog Manager WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46517 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Blog Manager WP blog-manager-wp allows Stored XSS.This issue affects Blog Manager WP: from n/a through <= 1.0.5.

  Product

  Blog Manager WP

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Blog Manager WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Twitter Card Generator: Cross-Site Request Forgery (CSRF)CVE-2025-46516 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in silencecm Twitter Card Generator twitter-card-generator allows Stored XSS.This issue affects Twitter Card Generator: from n/a through <= 1.0.5.

  Product

  Twitter Card Generator

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Twitter Card Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Milat jQuery Automatic Popup: Cross-Site Request Forgery (CSRF)CVE-2025-46514 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in milat Milat jQuery Automatic Popup milat-jquery-automatic-popup allows Stored XSS.This issue affects Milat jQuery Automatic Popup: from n/a through <= 1.3.1.

  Product

  Milat jQuery Automatic Popup

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Milat jQuery Automatic Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025All in One Time Clock Lite: Cross-Site Request Forgery (CSRF)CVE-2025-46513 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Codebangers All in One Time Clock Lite aio-time-clock-lite allows Cross Site Request Forgery.This issue affects All in One Time Clock Lite: from n/a through < 1.3.326.

  Product

  All in One Time Clock Lite

  What to do

  Update All in One Time Clock Lite to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Custom Functions: Cross-Site Request Forgery (CSRF)CVE-2025-46512 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Shamim Hasan Custom Functions Plugin custom-functions allows Stored XSS.This issue affects Custom Functions Plugin: from n/a through <= 1.1.

  Product

  Custom Functions

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Custom Functions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025BeerXML Shortcode: Server-Side Request Forgery (SSRF)CVE-2025-46511 · WordPress plugins & themes · reported by PatchstackMedium 6.4

  Server-Side Request Forgery (SSRF) vulnerability in Derek Springer BeerXML Shortcode beerxml-shortcode allows Server Side Request Forgery.This issue affects BeerXML Shortcode: from n/a through <= 0.7.1.

  Product

  BeerXML Shortcode

  Affected

  up to 0.7.1

  What to do

  Affects up to 0.7.1. Update BeerXML Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Contact Form 7 Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-46510 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in harrysudana Contact Form 7 Calendar cf7-calendar allows Stored XSS.This issue affects Contact Form 7 Calendar: from n/a through <= 3.0.1.

  Product

  Contact Form 7 Calendar

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update Contact Form 7 Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025360 View: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46509 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrey Mikhalchuk 360 View 360-view allows Stored XSS.This issue affects 360 View: from n/a through <= 1.1.0.

  Product

  360 View

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update 360 View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Advanced lazy load: Cross-Site Request Forgery (CSRF)CVE-2025-46508 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in kasonzhao Advanced lazy load advanced-lazy-load allows Stored XSS.This issue affects Advanced lazy load: from n/a through <= 1.6.0.

  Product

  Advanced lazy load

  Affected

  up to 1.6.0

  What to do

  Affects up to 1.6.0. Update Advanced lazy load to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Unsafe Mimetypes: Cross-Site Request Forgery (CSRF)CVE-2025-46507 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ldrumm Unsafe Mimetypes unsafe-mimetypes allows Stored XSS.This issue affects Unsafe Mimetypes: from n/a through <= 0.1.4.

  Product

  Unsafe Mimetypes

  Affected

  up to 0.1.4

  What to do

  Affects up to 0.1.4. Update Unsafe Mimetypes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025WpZon – Amazon Affiliate: Cross-Site Request Forgery (CSRF)CVE-2025-46506 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Lora77 WpZon – Amazon Affiliate Plugin wpzon allows Reflected XSS.This issue affects WpZon – Amazon Affiliate Plugin: from n/a through <= 1.3.

  Product

  WpZon – Amazon Affiliate

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update WpZon – Amazon Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Peekaboo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46505 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in farinspace Peekaboo peekaboo allows Stored XSS.This issue affects Peekaboo: from n/a through <= 1.1.

  Product

  Peekaboo

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Peekaboo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Vasaio QR Code: Cross-Site Request Forgery (CSRF)CVE-2025-46504 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Olar Marius Vasaio QR Code vasaio-qr-code allows Stored XSS.This issue affects Vasaio QR Code: from n/a through <= 1.2.5.

  Product

  Vasaio QR Code

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Vasaio QR Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Simple Google Photos Grid: Server-Side Request Forgery (SSRF)CVE-2025-46503 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Server-Side Request Forgery (SSRF) vulnerability in josheli Simple Google Photos Grid simple-google-photos-grid allows Server Side Request Forgery.This issue affects Simple Google Photos Grid: from n/a through <= 1.5.

  Product

  Simple Google Photos Grid

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Simple Google Photos Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025LSD Custom taxonomy and category meta: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46502 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bas Matthee LSD Custom taxonomy and category meta custom-taxonomy-category-and-term-fields allows Cross Site Request Forgery.This issue affects LSD Custom taxonomy and category meta: from n/a through <= 1.3.2.

  Product

  LSD Custom taxonomy and category meta

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update LSD Custom taxonomy and category meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Mixcloud Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46501 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in biancardi Mixcloud Embed mixcloud-embed allows Stored XSS.This issue affects Mixcloud Embed: from n/a through <= 2.2.0.

  Product

  Mixcloud Embed

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update Mixcloud Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025PayPal Express Checkout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46499 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hccoder PayPal Express Checkout paypal-express-checkout allows Stored XSS.This issue affects PayPal Express Checkout: from n/a through <= 2.1.2.

  Product

  PayPal Express Checkout

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update PayPal Express Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Zalo Official Live Chat: Cross-Site Request Forgery (CSRF)CVE-2025-46498 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in nghialuu Zalo Official Live Chat zalo-official-live-chat allows Cross Site Request Forgery.This issue affects Zalo Official Live Chat: from n/a through <= 1.0.0.

  Product

  Zalo Official Live Chat

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Zalo Official Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Navegg Analytics: Cross-Site Request Forgery (CSRF)CVE-2025-46497 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Navegg Navegg Analytics navegg allows Stored XSS.This issue affects Navegg Analytics: from n/a through <= 3.3.3.

  Product

  Navegg Analytics

  Affected

  up to 3.3.3

  What to do

  Affects up to 3.3.3. Update Navegg Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Mini twitter feed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46496 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oniswap Mini twitter feed mini-twitter-feed allows Stored XSS.This issue affects Mini twitter feed: from n/a through <= 3.0.

  Product

  Mini twitter feed

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update Mini twitter feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Drop Caps: Cross-Site Request Forgery (CSRF)CVE-2025-46495 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in tomontoast Drop Caps drop-caps allows Stored XSS.This issue affects Drop Caps: from n/a through <= 2.1.

  Product

  Drop Caps

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Drop Caps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Call Now PHT Blog: Cross-Site Request Forgery (CSRF)CVE-2025-46492 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Pham Thanh Call Now PHT Blog call-now-coccoc-pht-blog allows Stored XSS.This issue affects Call Now PHT Blog: from n/a through <= 2.4.1.

  Product

  Call Now PHT Blog

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update Call Now PHT Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Multi-Column Taxonomy List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46491 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthew Muro Multi-Column Taxonomy List multi-column-taxonomy-list allows Stored XSS.This issue affects Multi-Column Taxonomy List: from n/a through <= 1.5.

  Product

  Multi-Column Taxonomy List

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Multi-Column Taxonomy List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Bulk Assign Linked Products For WooCommerce: Missing AuthorizationCVE-2025-46489 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in vinodvaswani9 Bulk Assign Linked Products For WooCommerce wc-bulk-assign-linked-products allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bulk Assign Linked Products For WooCommerce: from n/a through <= 2.1.

  Product

  Bulk Assign Linked Products For WooCommerce

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Bulk Assign Linked Products For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025WP Customize Login Page: Missing AuthorizationCVE-2025-46485 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Customize Login Page: from n/a through <= 1.6.5.

  Product

  WP Customize Login Page

  Affected

  up to 1.6.5

  What to do

  Affects up to 1.6.5. Update WP Customize Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Image Hover Effects For WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46484 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nasir179125 Image Hover Effects For WPBakery Page Builder image-hover-effects-for-visual-composer allows DOM-Based XSS.This issue affects Image Hover Effects For WPBakery Page Builder: from n/a through <= 2.0.

  Product

  Image Hover Effects For WPBakery Page Builder

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Image Hover Effects For WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Peadig’s Google +1 Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46483 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Moss Peadig’s Google +1 Button google-1 allows DOM-Based XSS.This issue affects Peadig’s Google +1 Button: from n/a through <= 0.1.2.

  Product

  Peadig’s Google +1 Button

  Affected

  up to 0.1.2

  What to do

  Affects up to 0.1.2. Update Peadig’s Google +1 Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Flickr Shortcode Importer: Deserialization of Untrusted DataCVE-2025-46481 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Deserialization of Untrusted Data vulnerability in Michael Cannon Flickr Shortcode Importer flickr-shortcode-importer allows Object Injection.This issue affects Flickr Shortcode Importer: from n/a through <= 2.2.3.

  Product

  Flickr Shortcode Importer

  Affected

  up to 2.2.3

  What to do

  Affects up to 2.2.3. Update Flickr Shortcode Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Nepali Post Date: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46480 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Padam Shankhadev Nepali Post Date nepali-post-date allows Stored XSS.This issue affects Nepali Post Date: from n/a through <= 5.1.1.

  Product

  Nepali Post Date

  Affected

  up to 5.1.1

  What to do

  Affects up to 5.1.1. Update Nepali Post Date to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025BBCode Deluxe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46479 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevynCJohnson BBCode Deluxe bbcode-deluxe allows DOM-Based XSS.This issue affects BBCode Deluxe: from n/a through <= 2020.08.01.2.

  Product

  BBCode Deluxe

  Affected

  up to 2020.08.01.2

  What to do

  Affects up to 2020.08.01.2. Update BBCode Deluxe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Dropdown Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46478 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaloha Dropdown Content dropdown-content allows Stored XSS.This issue affects Dropdown Content: from n/a through <= 1.0.2.

  Product

  Dropdown Content

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Dropdown Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025WP Customize Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46477 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Stored XSS.This issue affects WP Customize Login Page: from n/a through <= 1.6.5.

  Product

  WP Customize Login Page

  Affected

  up to 1.6.5

  What to do

  Affects up to 1.6.5. Update WP Customize Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Awesome Wp Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46476 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nayon46 Awesome Wp Image Gallery awesome-wp-image-gallery allows Stored XSS.This issue affects Awesome Wp Image Gallery: from n/a through <= 1.0.

  Product

  Awesome Wp Image Gallery

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Awesome Wp Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Able Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46475 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Dolson Able Player ableplayer allows DOM-Based XSS.This issue affects Able Player: from n/a through <= 1.2.1.

  Product

  Able Player

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Able Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Social Counter: Deserialization of Untrusted DataCVE-2025-46473 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Deserialization of Untrusted Data vulnerability in Prisna Social Counter social-counter allows Object Injection.This issue affects Social Counter: from n/a through <= 2.0.5.

  Product

  Social Counter

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update Social Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.