Vulnerability database

41,181 results · page 364 of 824

• Apr 17, 2025uListing: Deserialization of Untrusted DataCVE-2025-32662 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Deserialization of Untrusted Data vulnerability in Stylemix uListing ulisting allows Object Injection.This issue affects uListing: from n/a through <= 2.2.0.

  Product

  uListing

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025JS Job Manager: Unrestricted Upload of File with Dangerous TypeCVE-2025-32660 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unrestricted Upload of File with Dangerous Type vulnerability in JoomSky JS Job Manager js-jobs allows Upload a Web Shell to a Web Server.This issue affects JS Job Manager: from n/a through <= 2.0.2.

  Product

  JS Job Manager

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update JS Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025HelpGent: Deserialization of Untrusted DataCVE-2025-32658 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Deserialization of Untrusted Data vulnerability in wpWax HelpGent helpgent allows Object Injection.This issue affects HelpGent: from n/a through <= 2.2.5.

  Product

  HelpGent

  Affected

  up to 2.2.5

  What to do

  Affects up to 2.2.5. Update HelpGent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Restrict User Registration: Cross-Site Request Forgery (CSRF)CVE-2025-32655 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in DevriX Restrict User Registration restrict-user-registration allows Stored XSS.This issue affects Restrict User Registration: from n/a through <= 1.0.1.

  Product

  Restrict User Registration

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Restrict User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Cart66 Cloud: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32653 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lee Blue Cart66 Cloud cart66-cloud allows Reflected XSS.This issue affects Cart66 Cloud: from n/a through <= 2.3.7.

  Product

  Cart66 Cloud

  Affected

  up to 2.3.7

  What to do

  Affects up to 2.3.7. Update Cart66 Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Solace Extra: Unrestricted Upload of File with Dangerous TypeCVE-2025-32652 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Unrestricted Upload of File with Dangerous Type vulnerability in solacewp Solace Extra solace-extra allows Using Malicious Files.This issue affects Solace Extra: from n/a through <= 1.3.1.

  Product

  Solace Extra

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Solace Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025SERPed.net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32651 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in serpednet SERPed.net serped-net allows Reflected XSS.This issue affects SERPed.net: from n/a through <= 4.6.

  Product

  SERPed.net

  Affected

  up to 4.6

  What to do

  Affects up to 4.6. Update SERPed.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025GB Gallery Slideshow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32649 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gb-plugins GB Gallery Slideshow gb-gallery-slideshow allows Reflected XSS.This issue affects GB Gallery Slideshow: from n/a through <= 1.3.

  Product

  GB Gallery Slideshow

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update GB Gallery Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Projectopia: Incorrect Privilege AssignmentCVE-2025-32648 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Incorrect Privilege Assignment vulnerability in Projectopia Projectopia projectopia-core allows Privilege Escalation.This issue affects Projectopia: from n/a through <= 5.1.24.

  Product

  Projectopia

  Affected

  up to 5.1.24

  What to do

  Affects up to 5.1.24. Update Projectopia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Question Answer: Deserialization of Untrusted DataCVE-2025-32647 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Deserialization of Untrusted Data vulnerability in PickPlugins Question Answer question-answer allows Object Injection.This issue affects Question Answer: from n/a through <= 1.2.73.

  Product

  Question Answer

  Affected

  up to 1.2.73

  What to do

  Affects up to 1.2.73. Update Question Answer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Question Answer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32646 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Question Answer question-answer allows Reflected XSS.This issue affects Question Answer: from n/a through <= 1.2.70.

  Product

  Question Answer

  Affected

  up to 1.2.70

  What to do

  Affects up to 1.2.70. Update Question Answer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Affiliate Links Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32639 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wecantrack Affiliate Links Lite affiliate-links allows Reflected XSS.This issue affects Affiliate Links Lite: from n/a through <= 3.1.0.

  Product

  Affiliate Links Lite

  Affected

  up to 3.1.0

  What to do

  Affects up to 3.1.0. Update Affiliate Links Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Mobile App for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32638 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weptile Mobile App for WooCommerce mobile-app-for-woocommerce allows Stored XSS.This issue affects Mobile App for WooCommerce: from n/a through <= 0.4.61.

  Product

  Mobile App for WooCommerce

  Affected

  up to 0.4.61

  What to do

  Affects up to 0.4.61. Update Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP Donate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32637 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ketanajani WP Donate wp-donate allows Stored XSS.This issue affects WP Donate: from n/a through <= 2.0.

  Product

  WP Donate

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update WP Donate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Local Magic: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32636 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in matthewrubin Local Magic local-magic allows SQL Injection.This issue affects Local Magic: from n/a through <= 2.9.0.

  Product

  Local Magic

  Affected

  up to 2.9.0

  What to do

  Affects up to 2.9.0. Update Local Magic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Hive Support: Insertion of Sensitive Information Into Sent DataCVE-2025-32635 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Insertion of Sensitive Information Into Sent Data vulnerability in Hive Support Hive Support hive-support allows Retrieve Embedded Sensitive Data.This issue affects Hive Support: from n/a through <= 1.2.6.

  Product

  Hive Support

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Run Contests, Raffles, and Giveaways with ContestsWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32634 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mdedev Run Contests, Raffles, and Giveaways with ContestsWP contest-code-checker allows Reflected XSS.This issue affects Run Contests, Raffles, and Giveaways with ContestsWP: from n/a through <= 2.1.1.

  Product

  Run Contests, Raffles, and Giveaways with ContestsWP

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update Run Contests, Raffles, and Giveaways with ContestsWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP-BusinessDirectory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32630 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Reflected XSS.This issue affects WP-BusinessDirectory: from n/a through <= 3.1.2.

  Product

  WP-BusinessDirectory

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update WP-BusinessDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Crowdfunding for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32628 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Crowdfunding for WooCommerce crowdfunding-for-woocommerce allows Reflected XSS.This issue affects Crowdfunding for WooCommerce: from n/a through <= 3.1.12.

  Product

  Crowdfunding for WooCommerce

  Affected

  up to 3.1.12

  What to do

  Affects up to 3.1.12. Update Crowdfunding for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025JS Job Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32626 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Job Manager js-jobs allows SQL Injection.This issue affects JS Job Manager: from n/a through <= 2.0.2.

  Product

  JS Job Manager

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update JS Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Mobile Pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32625 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pootlepress Mobile Pages mobile-pages allows Reflected XSS.This issue affects Mobile Pages: from n/a through <= 1.0.2.

  Product

  Mobile Pages

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025OTP-less one tap Sign in: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32622 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTP-less OTP-less one tap Sign in otpless allows Reflected XSS.This issue affects OTP-less one tap Sign in: from n/a through <= 2.0.58.

  Product

  OTP-less one tap Sign in

  Affected

  up to 2.0.58

  What to do

  Affects up to 2.0.58. Update OTP-less one tap Sign in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Doppler Forms: Missing AuthorizationCVE-2025-32620 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Missing Authorization vulnerability in fromdoppler Doppler Forms doppler-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Doppler Forms: from n/a through <= 2.4.6.

  Product

  Doppler Forms

  Affected

  up to 2.4.6

  What to do

  Affects up to 2.4.6. Update Doppler Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Clinked Client Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32615 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Clinked Clinked Client Portal clinked-client-portal allows Reflected XSS.This issue affects Clinked Client Portal: from n/a through <= 1.10.

  Product

  Clinked Client Portal

  Affected

  up to 1.10

  What to do

  Affects up to 1.10. Update Clinked Client Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Debug Log Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32613 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bowo Debug Log Manager debug-log-manager allows Stored XSS.This issue affects Debug Log Manager: from n/a through <= 2.3.4.

  Product

  Debug Log Manager

  Affected

  up to 2.3.4

  What to do

  Affects up to 2.3.4. Update Debug Log Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WooCommerce TBC Credit Card Payment Gateway (Free): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32611 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in We Are De WooCommerce TBC Credit Card Payment Gateway (Free) woo-tbc-payment-gateway allows Reflected XSS.This issue affects WooCommerce TBC Credit Card Payment Gateway (Free): from n/a through <= 2.0.0.

  Product

  WooCommerce TBC Credit Card Payment Gateway (Free)

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update WooCommerce TBC Credit Card Payment Gateway (Free) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Verowa Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32609 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Reflected XSS.This issue affects Verowa Connect: from n/a through <= 3.0.4.

  Product

  Verowa Connect

  Affected

  up to 3.0.4

  What to do

  Affects up to 3.0.4. Update Verowa Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Movylo Marketing Automation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32608 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Movylo Movylo Marketing Automation movylo-widget allows Reflected XSS.This issue affects Movylo Marketing Automation: from n/a through <= 2.0.7.

  Product

  Movylo Marketing Automation

  Affected

  up to 2.0.7

  What to do

  Affects up to 2.0.7. Update Movylo Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Listings for Buildium: Cross-Site Request Forgery (CSRF)CVE-2025-32606 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Deepak Khokhar Listings for Buildium listings-for-buildium allows Stored XSS.This issue affects Listings for Buildium: from n/a through <= 0.1.5.

  Product

  Listings for Buildium

  Affected

  up to 0.1.5

  What to do

  Affects up to 0.1.5. Update Listings for Buildium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025MemberPress Discord Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32605 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in expresstechsoftware MemberPress Discord Addon expresstechsoftwares-memberpress-discord-add-on allows Reflected XSS.This issue affects MemberPress Discord Addon: from n/a through <= 1.1.1.

  Product

  MemberPress Discord Addon

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update MemberPress Discord Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025AWSA Shipping: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32604 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sajjad Aslani AWSA Shipping awsa-shipping allows Reflected XSS.This issue affects AWSA Shipping: from n/a through <= 1.3.0.

  Product

  AWSA Shipping

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update AWSA Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WooMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32602 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpcraft WooMS wooms allows Reflected XSS.This issue affects WooMS: from n/a through <= 9.12.

  Product

  WooMS

  Affected

  up to 9.12

  What to do

  Affects up to 9.12. Update WooMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Real Estate Manager: Improper Control of Generation of Code ('Code Injection')CVE-2025-32596 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Improper Control of Generation of Code ('Code Injection') vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Code Injection.This issue affects Real Estate Manager: from n/a through <= 7.3.

  Product

  Real Estate Manager

  Affected

  up to 7.3

  What to do

  Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Simple WP Events: Insertion of Sensitive Information Into Sent DataCVE-2025-32594 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Insertion of Sensitive Information Into Sent Data vulnerability in WPMinds Simple WP Events simple-wp-events allows Retrieve Embedded Sensitive Data.This issue affects Simple WP Events: from n/a through <= 1.8.17.

  Product

  Simple WP Events

  Affected

  up to 1.8.17

  What to do

  Affects up to 1.8.17. Update Simple WP Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Add Product Frontend for WooCommerce: Missing AuthorizationCVE-2025-32593 · WordPress plugins & themes · reported by PatchstackHigh 8.2

  Missing Authorization vulnerability in Bytes Technolab Add Product Frontend for WooCommerce add-product-frontend-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Add Product Frontend for WooCommerce: from n/a through <= 1.0.8.

  Product

  Add Product Frontend for WooCommerce

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Add Product Frontend for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025TableOn: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32592 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 TableOn posts-table-filterable allows Stored XSS.This issue affects TableOn: from n/a through <= 1.0.3.

  Product

  TableOn

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update TableOn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Web2application: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32590 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tzin111 Web2application web2application allows Reflected XSS.This issue affects Web2application: from n/a through <= 6.1.

  Product

  Web2application

  Affected

  up to 6.1

  What to do

  Affects up to 6.1. Update Web2application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Credova_Financial: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32588 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Credova Financial Credova_Financial credova-financial allows Reflected XSS.This issue affects Credova_Financial: from n/a through <= 2.4.8.

  Product

  Credova_Financial

  Affected

  up to 2.4.8

  What to do

  Affects up to 2.4.8. Update Credova_Financial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025PDF 2 Post: Improper Control of Generation of Code ('Code Injection')CVE-2025-32583 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Improper Control of Generation of Code ('Code Injection') vulnerability in termel PDF 2 Post pdf2post allows Remote Code Inclusion.This issue affects PDF 2 Post: from n/a through <= 2.4.0.

  Product

  PDF 2 Post

  Affected

  up to 2.4.0

  What to do

  Affects up to 2.4.0. Update PDF 2 Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP AutoKeyword: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32582 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EXEIdeas International WP AutoKeyword wp-autokeyword allows Stored XSS.This issue affects WP AutoKeyword: from n/a through <= 1.0.

  Product

  WP AutoKeyword

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP AutoKeyword to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Coming Soon Countdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32578 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mapro Collins Coming Soon Countdown coming-soon-countdown allows Reflected XSS.This issue affects Coming Soon Countdown: from n/a through <= 2.2.

  Product

  Coming Soon Countdown

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Coming Soon Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025KiotViet Sync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32573 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kiotviet KiotViet Sync allows SQL Injection. This issue affects KiotViet Sync: from n/a through 1.8.3.

  Product

  KiotViet Sync

  Affected

  up to 1.8.3

  What to do

  Affects up to 1.8.3. Update KiotViet Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Kata Plus: Deserialization of Untrusted DataCVE-2025-32572 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Deserialization of Untrusted Data vulnerability in Climax Themes Kata Plus kata-plus allows Object Injection.This issue affects Kata Plus: from n/a through <= 1.5.3.

  Product

  Kata Plus

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update Kata Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025TuriTop Booking System: Deserialization of Untrusted DataCVE-2025-32571 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Deserialization of Untrusted Data vulnerability in TuriTop TuriTop Booking System turitop-booking-system allows Object Injection.This issue affects TuriTop Booking System: from n/a through <= 1.0.10.

  Product

  TuriTop Booking System

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update TuriTop Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025License For Envato: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32566 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashraful Sarkar Naiem License For Envato license-envato allows Reflected XSS.This issue affects License For Envato: from n/a through <= 1.0.0.

  Product

  License For Envato

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update License For Envato to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Stop Registration Spam: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32564 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tomroyal Stop Registration Spam allows Reflected XSS. This issue affects Stop Registration Spam: from n/a through 1.24.

  Product

  Stop Registration Spam

  Affected

  up to 1.24

  What to do

  Affects up to 1.24. Update Stop Registration Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP Easy Poll: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32562 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com WP Easy Poll wp-easy-poll-afo allows Reflected XSS.This issue affects WP Easy Poll: from n/a through <= 2.2.9.

  Product

  WP Easy Poll

  Affected

  up to 2.2.9

  What to do

  Affects up to 2.2.9. Update WP Easy Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP_DEBUG Toggle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32561 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plugins.club WP_DEBUG Toggle enable-wp-debug-toggle allows Reflected XSS.This issue affects WP_DEBUG Toggle: from n/a through <= 1.1.

  Product

  WP_DEBUG Toggle

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update WP_DEBUG Toggle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP-Hijri: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32560 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mohammad I. Okfie WP-Hijri wp-hijri allows Reflected XSS.This issue affects WP-Hijri: from n/a through <= 1.5.3.

  Product

  WP-Hijri

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update WP-Hijri to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP Featured Screenshot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32557 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rico Macchi WP Featured Screenshot wp-featured-screenshot allows Reflected XSS.This issue affects WP Featured Screenshot: from n/a through <= 1.3.

  Product

  WP Featured Screenshot

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update WP Featured Screenshot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.