Vulnerability database

5,857 results · page 37 of 118

• Jun 20, 2025WP Voting Contest: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50017 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt WP Voting Contest wp-voting-contest allows Stored XSS.This issue affects WP Voting Contest: from n/a through <= 5.8.

  Product

  WP Voting Contest

  Affected

  up to 5.8

  What to do

  Affects up to 5.8. Update WP Voting Contest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025IP Based Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50016 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brijeshk89 IP Based Login ip-based-login allows Stored XSS.This issue affects IP Based Login: from n/a through <= 2.4.2.

  Product

  IP Based Login

  Affected

  up to 2.4.2

  What to do

  Affects up to 2.4.2. Update IP Based Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Hand Talk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50015 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rodrigo Bastos Hand Talk handtalk allows Stored XSS.This issue affects Hand Talk: from n/a through <= 6.1.

  Product

  Hand Talk

  Affected

  up to 6.1

  What to do

  Affects up to 6.1. Update Hand Talk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025PDPA Consent for Thailand: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50014 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iamapinan PDPA Consent for Thailand pdpa-consent allows Stored XSS.This issue affects PDPA Consent for Thailand: from n/a through <= 1.1.1.

  Product

  PDPA Consent for Thailand

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update PDPA Consent for Thailand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025CSV Importer Improved: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50013 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Judge CSV Importer Improved csv-importer-improved allows Stored XSS.This issue affects CSV Importer Improved: from n/a through <= 0.6.1.

  Product

  CSV Importer Improved

  Affected

  up to 0.6.1

  What to do

  Affects up to 0.6.1. Update CSV Importer Improved to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Inventory Presser: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50012 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fridaysystems Inventory Presser inventory-presser allows Stored XSS.This issue affects Inventory Presser: from n/a through <= 15.2.6.

  Product

  Inventory Presser

  Affected

  up to 15.2.6

  What to do

  Affects up to 15.2.6. Update Inventory Presser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Recipes manager - WPH: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50011 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Félix Martínez Recipes manager - WPH allows Stored XSS. This issue affects Recipes manager - WPH: from n/a through 1.0.4.

  Product

  Recipes manager - WPH

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Recipes manager - WPH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Elessi: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49873 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Elessi elessi-theme allows Reflected XSS.This issue affects Elessi: from n/a through <= 6.3.9.

  Product

  Elessi

  Affected

  up to 6.3.9

  What to do

  Affects up to 6.3.9. Update Elessi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025CubeWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49882 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Tauqeer CubeWP cubewp-framework allows DOM-Based XSS.This issue affects CubeWP: from n/a through <= 1.1.23.

  Product

  CubeWP

  Affected

  up to 1.1.23

  What to do

  Affects up to 1.1.23. Update CubeWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Responsive Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49881 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Stored XSS.This issue affects Responsive Blocks: from n/a through <= 2.0.5.

  Product

  Responsive Blocks

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update Responsive Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025WPAdverts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49878 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.This issue affects WPAdverts: from n/a through <= 2.2.4.

  Product

  WPAdverts

  Affected

  up to 2.2.4

  What to do

  Affects up to 2.2.4. Update WPAdverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025If-So Dynamic Content Personalization: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49875 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Stored XSS.This issue affects If-So Dynamic Content Personalization: from n/a through <= 1.9.3.1.

  Product

  If-So Dynamic Content Personalization

  Affected

  up to 1.9.3.1

  What to do

  Affects up to 1.9.3.1. Update If-So Dynamic Content Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Noptin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49871 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows Stored XSS.This issue affects Noptin: from n/a through <= 3.8.7.

  Product

  Noptin

  Affected

  up to 3.8.7

  What to do

  Affects up to 3.8.7. Update Noptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Advanced Sermons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49863 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Advanced Sermons advanced-sermons allows Stored XSS.This issue affects Advanced Sermons: from n/a through <= 3.6.

  Product

  Advanced Sermons

  Affected

  up to 3.6

  What to do

  Affects up to 3.6. Update Advanced Sermons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Ebook Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49862 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in motov.net Ebook Store ebook-store allows Stored XSS.This issue affects Ebook Store: from n/a through <= 5.8008.

  Product

  Ebook Store

  Affected

  up to 5.8008

  What to do

  Affects up to 5.8008. Update Ebook Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Kama Click Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49861 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timur Kamaev Kama Click Counter kama-clic-counter allows Stored XSS.This issue affects Kama Click Counter: from n/a through <= 4.0.3.

  Product

  Kama Click Counter

  Affected

  up to 4.0.3

  What to do

  Affects up to 4.0.3. Update Kama Click Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025WP Views Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49859 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in etruel WP Views Counter wpecounter allows Stored XSS.This issue affects WP Views Counter: from n/a through <= 2.0.3.

  Product

  WP Views Counter

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update WP Views Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Arconix Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49858 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.17.

  Product

  Arconix Shortcodes

  Affected

  up to 2.1.17

  What to do

  Affects up to 2.1.17. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Meks Flexible Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49855 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks Flexible Shortcodes meks-flexible-shortcodes allows DOM-Based XSS.This issue affects Meks Flexible Shortcodes: from n/a through <= 1.3.7.

  Product

  Meks Flexible Shortcodes

  Affected

  up to 1.3.7

  What to do

  Affects up to 1.3.7. Update Meks Flexible Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025PostaPanduri: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49452 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Ladó PostaPanduri postapanduri allows SQL Injection.This issue affects PostaPanduri: from n/a through <= 2.1.3.

  Product

  PostaPanduri

  Affected

  up to 2.1.3

  What to do

  Affects up to 2.1.3. Update PostaPanduri to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025WP2LEADS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49316 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through <= 3.5.0.

  Product

  WP2LEADS

  Affected

  up to 3.5.0

  What to do

  Affects up to 3.5.0. Update WP2LEADS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Echo RSS Feed Post Generator Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49312 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRevolution Echo RSS Feed Post Generator Plugin for WordPress rss-feed-post-generator-echo allows Reflected XSS.This issue affects Echo RSS Feed Post Generator Plugin for WordPress: from n/a through <= 5.4.8.1.

  Product

  Echo RSS Feed Post Generator Plugin for

  Affected

  up to 5.4.8.1

  What to do

  Affects up to 5.4.8.1. Update Echo RSS Feed Post Generator Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Ultimate Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49266 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Reflected XSS.This issue affects Ultimate Reviews: from n/a through <= 3.2.14.

  Product

  Ultimate Reviews

  Affected

  up to 3.2.14

  What to do

  Affects up to 3.2.14. Update Ultimate Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025eForm - WordPress Form Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48333 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPQuark eForm - WordPress Form Builder wp-fsqm-pro allows Reflected XSS.This issue affects eForm - WordPress Form Builder: from n/a through < 4.19.1.

  Product

  eForm - WordPress Form Builder

  What to do

  Update eForm - WordPress Form Builder to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Track, Analyze & Optimize by WP Tao: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48145 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-tao allows Reflected XSS.This issue affects Track, Analyze & Optimize by WP Tao: from n/a through <= 1.3.

  Product

  Track, Analyze & Optimize by WP Tao

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Track, Analyze & Optimize by WP Tao to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Nasa Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39508 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Nasa Core nasa-core allows Reflected XSS.This issue affects Nasa Core: from n/a through <= 6.4.4.

  Product

  Nasa Core

  Affected

  up to 6.4.4

  What to do

  Affects up to 6.4.4. Update Nasa Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Elite Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30988 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player elite-video-player allows Stored XSS.This issue affects Elite Video Player: from n/a through <= 10.0.5.

  Product

  Elite Video Player

  Affected

  up to 10.0.5

  What to do

  Affects up to 10.0.5. Update Elite Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025WC MyParcel Belgium: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48279 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Perdaan WC MyParcel Belgium allows Reflected XSS. This issue affects WC MyParcel Belgium: from 4.5.5 through beta.

  Product

  WC MyParcel Belgium

  What to do

  Update WC MyParcel Belgium to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025Formulario de contacto SalesUp!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48143 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salesup2019 Formulario de contacto SalesUp! formularios-de-contacto-salesup allows Reflected XSS.This issue affects Formulario de contacto SalesUp!: from n/a through <= 1.0.14.

  Product

  Formulario de contacto SalesUp!

  Affected

  up to 1.0.14

  What to do

  Affects up to 1.0.14. Update Formulario de contacto SalesUp! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025History Log by click5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47598 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in click5 History Log by click5 history-log-by-click5 allows Stored XSS.This issue affects History Log by click5: from n/a through <= 1.0.13.

  Product

  History Log by click5

  Affected

  up to 1.0.13

  What to do

  Affects up to 1.0.13. Update History Log by click5 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025MC Woocommerce Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47487 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Reflected XSS.This issue affects MC Woocommerce Wishlist: from n/a through <= 1.9.1.

  Product

  MC Woocommerce Wishlist

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update MC Woocommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025Backup and Staging by WP Time Capsule: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47477 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Reflected XSS.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.23.

  Product

  Backup and Staging by WP Time Capsule

  Affected

  up to 1.22.23

  What to do

  Affects up to 1.22.23. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025WP Email Delivery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39539 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brewlabs WP Email Delivery wp-email-delivery allows Reflected XSS.This issue affects WP Email Delivery: from n/a through <= 1.20.11.23.

  Product

  WP Email Delivery

  Affected

  up to 1.20.11.23

  What to do

  Affects up to 1.20.11.23. Update WP Email Delivery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025WordPress FlatNews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32305 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sneeit WordPress FlatNews Theme flatnews allows Reflected XSS.This issue affects WordPress FlatNews Theme: from n/a through <= 5.8.

  Product

  WordPress FlatNews

  Affected

  up to 5.8

  What to do

  Affects up to 5.8. Update WordPress FlatNews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025SHOUT: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31925 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup SHOUT lbg-audio8-html5-radio_ads allows Reflected XSS.This issue affects SHOUT: from n/a through <= 3.5.3.

  Product

  SHOUT

  Affected

  up to 3.5.3

  What to do

  Affects up to 3.5.3. Update SHOUT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025Universal Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31917 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player universal_video_player allows Reflected XSS.This issue affects Universal Video Player: from n/a through <= 3.8.3.

  Product

  Universal Video Player

  Affected

  up to 3.8.3

  What to do

  Affects up to 3.8.3. Update Universal Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025Spare: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31638 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeton Spare allows Reflected XSS. This issue affects Spare: from n/a through 1.7.

  Product

  Spare

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Spare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025Sticky Radio Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31426 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutcast_sticky allows Reflected XSS.This issue affects Sticky Radio Player: from n/a through <= 3.4.

  Product

  Sticky Radio Player

  Affected

  up to 3.4

  What to do

  Affects up to 3.4. Update Sticky Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025WP Lead Capturing Pages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31424 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through < 2.6.

  Product

  WP Lead Capturing Pages

  What to do

  Update WP Lead Capturing Pages to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31061 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redqteam Wishlist wishlist allows Reflected XSS.This issue affects Wishlist: from n/a through <= 2.1.0.

  Product

  Wishlist

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025Revolution Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31058 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Revolution Video Player revolution_video_player allows Reflected XSS.This issue affects Revolution Video Player: from n/a through <= 2.9.2.

  Product

  Revolution Video Player

  Affected

  up to 2.9.2

  What to do

  Affects up to 2.9.2. Update Revolution Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 9, 2025Universal Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31057 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player elementor_widget_universal_video_player allows Reflected XSS.This issue affects Universal Video Player: from n/a through <= 1.4.0.

  Product

  Universal Video Player

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Universal Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025SEPA Girocode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49450 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mhallmann SEPA Girocode sepa-girocode allows Stored XSS.This issue affects SEPA Girocode: from n/a through <= 0.5.1.

  Product

  SEPA Girocode

  Affected

  up to 0.5.1

  What to do

  Affects up to 0.5.1. Update SEPA Girocode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Bacon Ipsum: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49443 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris McCoy Bacon Ipsum bacon-ipsum allows Stored XSS.This issue affects Bacon Ipsum: from n/a through <= 2.4.

  Product

  Bacon Ipsum

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update Bacon Ipsum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Simple Nested Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49442 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mostafa Shahiri Simple Nested Menu simple-nested-menu allows Stored XSS.This issue affects Simple Nested Menu: from n/a through <= 1.0.

  Product

  Simple Nested Menu

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Simple Nested Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WP Security Master: Cross-Site Request Forgery (CSRF)CVE-2025-49440 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Vuong Nguyen WP Security Master wp-security-master allows Cross Site Request Forgery.This issue affects WP Security Master: from n/a through <= 1.0.2.

  Product

  WP Security Master

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update WP Security Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Video Embeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49429 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Burnette Video Embeds video-embeds allows Stored XSS.This issue affects Video Embeds: from n/a through <= 0.1.1.

  Product

  Video Embeds

  Affected

  up to 0.1.1

  What to do

  Affects up to 0.1.1. Update Video Embeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Abbie Expander: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49427 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Burnette Abbie Expander abbie-expander allows Stored XSS.This issue affects Abbie Expander: from n/a through <= 1.0.1.

  Product

  Abbie Expander

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Abbie Expander to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Simple Membership: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49333 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership simple-membership allows Stored XSS.This issue affects Simple Membership: from n/a through <= 4.6.3.

  Product

  Simple Membership

  Affected

  up to 4.6.3

  What to do

  Affects up to 4.6.3. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025404 Page by SeedProd: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49322 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeedProd 404 Page by SeedProd allows Stored XSS. This issue affects 404 Page by SeedProd: from n/a through n/a.

  Product

  404 Page by SeedProd

  What to do

  Update 404 Page by SeedProd to the newest version.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.