Vulnerability database

41,188 results · page 385 of 824

• Apr 1, 2025Google Font Fix: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30614 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Haozhe Xie Google Font Fix google-font-fix allows Reflected XSS.This issue affects Google Font Fix: from n/a through <= 2.3.1.

  Product

  Google Font Fix

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update Google Font Fix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Nmedia MailChimp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30613 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N-Media Nmedia MailChimp nmedia-mailchimp-widget allows Stored XSS.This issue affects Nmedia MailChimp: from n/a through <= 5.4.

  Product

  Nmedia MailChimp

  Affected

  up to 5.4

  What to do

  Affects up to 5.4. Update Nmedia MailChimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Quick Localization: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30607 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Name.ly Quick Localization quick-localization allows Reflected XSS.This issue affects Quick Localization: from n/a through <= 0.1.0.

  Product

  Quick Localization

  Affected

  up to 0.1.0

  What to do

  Affects up to 0.1.0. Update Quick Localization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Include URL: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30594 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in samsk Include URL include-url allows Path Traversal.This issue affects Include URL: from n/a through <= 0.3.5.

  Product

  Include URL

  Affected

  up to 0.3.5

  What to do

  Affects up to 0.3.5. Update Include URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Flickr set slideshows: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30589 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dourou Flickr set slideshows flickr-set-slideshows allows SQL Injection.This issue affects Flickr set slideshows: from n/a through <= 0.9.

  Product

  Flickr set slideshows

  Affected

  up to 0.9

  What to do

  Affects up to 0.9. Update Flickr set slideshows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Pesapal Gateway for Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30579 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jakeii Pesapal Gateway for Woocommerce pesapal-for-woocommerce allows Reflected XSS.This issue affects Pesapal Gateway for Woocommerce: from n/a through <= 2.1.0.

  Product

  Pesapal Gateway for Woocommerce

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Pesapal Gateway for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Tidekey: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30563 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in makong Tidekey tidekey allows Reflected XSS.This issue affects Tidekey: from n/a through <= 1.1.

  Product

  Tidekey

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Tidekey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Kento WordPress Stats: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30559 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Kento WordPress Stats kento-wp-stats allows Stored XSS.This issue affects Kento WordPress Stats: from n/a through <= 1.1.

  Product

  Kento WordPress Stats

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Kento WordPress Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Advanced Post Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30548 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VarDump s.r.l. Advanced Post Search advanced-post-search allows Reflected XSS.This issue affects Advanced Post Search: from n/a through <= 1.1.0.

  Product

  Advanced Post Search

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Advanced Post Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Cards: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30547 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Tufts WP Cards wp-cards allows Reflected XSS.This issue affects WP Cards: from n/a through <= 1.5.1.

  Product

  WP Cards

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update WP Cards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025OK Poster Group: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30544 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in svmidi OK Poster Group ok-poster-group allows Reflected XSS.This issue affects OK Poster Group: from n/a through <= 1.1.

  Product

  OK Poster Group

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update OK Poster Group to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Breezing Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30520 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crosstec Breezing Forms breezing-forms allows Reflected XSS.This issue affects Breezing Forms: from n/a through <= 1.2.8.11.

  Product

  Breezing Forms

  Affected

  up to 1.2.8.11

  What to do

  Affects up to 1.2.8.11. Update Breezing Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Lana Downloads Manager: Does not validate user input used in a pathCVE-2025-2048 · WordPress plugins & themes · reported by WPScanMedium 4.1

  The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server

  Product

  Lana Downloads Manager

  Fixed in

  1.10.0

  What to do

  Update Lana Downloads Manager to 1.10.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Apr 1, 2025Vitepos: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-22277 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.4.

  Product

  Vitepos

  Affected

  up to 3.1.4

  What to do

  Affects up to 3.1.4. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Gutentor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-1986 · WordPress plugins & themes · reported by WPScanMedium 4.1

  The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

  Product

  Gutentor

  Fixed in

  3.4.7

  What to do

  Update Gutentor to 3.4.7 or newer.

  Full record and what to do →NVD recordwpscan.com

• Apr 1, 2025Avada (Fusion) Builder: Stored Cross-Site ScriptingCVE-2025-1665 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 3.11.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Avada (Fusion) Builder

  Affected

  up to 3.11.14

  What to do

  Affects up to 3.11.14. Update Avada (Fusion) Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordavada.comwordfence.com

• Apr 1, 2025Awesome Support – WordPress HelpDesk & Support: Sensitive Information ExposureCVE-2024-13567 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.3.1 via the 'awesome-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/awesome-support directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 6.3.1.

  Product

  Awesome Support – WordPress HelpDesk & Support

  Affected

  up to 6.3.1

  What to do

  Affects up to 6.3.1. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 1, 2025Import Export Suite for CSV and XML Datafeed: Arbitrary file uploadsCVE-2025-2008 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import_single_post_as_csv() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1.

  Product

  Import Export Suite for CSV and XML Datafeed

  Affected

  up to 7.19

  What to do

  Affects up to 7.19. Update Import Export Suite for CSV and XML Datafeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 1, 2025Import Export Suite for CSV and XML Datafeed: Arbitrary file deletionCVE-2025-2007 · WordPress plugins & themes · reported by WordfenceHigh 8.1

  The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteImage() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1.

  Product

  Import Export Suite for CSV and XML Datafeed

  Affected

  up to 7.19

  What to do

  Affects up to 7.19. Update Import Export Suite for CSV and XML Datafeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 31, 2025Infusionsoft Web Form JavaScript: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31629 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob Allred Infusionsoft Web Form JavaScript infusionsoft-web-form-javascript allows Stored XSS.This issue affects Infusionsoft Web Form JavaScript: from n/a through <= 1.1.1.

  Product

  Infusionsoft Web Form JavaScript

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Infusionsoft Web Form JavaScript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Media LIbrary Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31627 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through <= 3.24.

  Product

  Media LIbrary Assistant

  Affected

  up to 3.24

  What to do

  Affects up to 3.24. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Useinfluence: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31625 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ramanparashar Useinfluence useinfluence allows Stored XSS.This issue affects Useinfluence: from n/a through <= 1.0.8.

  Product

  Useinfluence

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Useinfluence to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Processing Projects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31624 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LABCAT Processing Projects processing-projects allows DOM-Based XSS.This issue affects Processing Projects: from n/a through <= 1.0.2.

  Product

  Processing Projects

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Processing Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Rich Text Editor: Cross-Site Request Forgery (CSRF)CVE-2025-31623 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in richtexteditor Rich Text Editor richtexteditor allows Stored XSS.This issue affects Rich Text Editor: from n/a through <= 1.0.1.

  Product

  Rich Text Editor

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Rich Text Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025byBrick Accordion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31621 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davidpaulsson byBrick Accordion bybrick-accordion allows Stored XSS.This issue affects byBrick Accordion: from n/a through <= 1.0.

  Product

  byBrick Accordion

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update byBrick Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025CoverManager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31620 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in carperfer CoverManager covermanager allows Stored XSS.This issue affects CoverManager: from n/a through <= 0.0.1.

  Product

  CoverManager

  Affected

  up to 0.0.1

  What to do

  Affects up to 0.0.1. Update CoverManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Connector to CiviCRM with CiviMcRestFace: Missing AuthorizationCVE-2025-31618 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Jaap Jansma Connector to CiviCRM with CiviMcRestFace connector-civicrm-mcrestface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Connector to CiviCRM with CiviMcRestFace: from n/a through <= 1.0.10.

  Product

  Connector to CiviCRM with CiviMcRestFace

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update Connector to CiviCRM with CiviMcRestFace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025PostmarkApp Email Integrator: Cross-Site Request Forgery (CSRF)CVE-2025-31617 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Gagan Deep Singh PostmarkApp Email Integrator postmarkapp-email-integrator allows Cross Site Request Forgery.This issue affects PostmarkApp Email Integrator: from n/a through <= 2.4.

  Product

  PostmarkApp Email Integrator

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update PostmarkApp Email Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Varnish: Cross-Site Request Forgery (CSRF)CVE-2025-31616 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in AdminGeekZ Varnish WordPress varnish-wp allows Cross Site Request Forgery.This issue affects Varnish WordPress: from n/a through <= 1.7.

  Product

  Varnish

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Varnish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Simple Contact Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31615 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in owenr88 Simple Contact Forms simple-contact-forms allows Stored XSS.This issue affects Simple Contact Forms: from n/a through <= 1.6.4.

  Product

  Simple Contact Forms

  Affected

  up to 1.6.4

  What to do

  Affects up to 1.6.4. Update Simple Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Terms Before Download: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31614 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hiroprot Terms Before Download terms-before-download allows Stored XSS.This issue affects Terms Before Download: from n/a through <= 1.0.5.

  Product

  Terms Before Download

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Terms Before Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025AB Google Map Travel: Cross-Site Request Forgery (CSRF)CVE-2025-31613 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Aboobacker. AB Google Map Travel ab-google-map-travel allows Cross Site Request Forgery.This issue affects AB Google Map Travel : from n/a through <= 4.6.

  Product

  AB Google Map Travel

  Affected

  up to 4.6

  What to do

  Affects up to 4.6. Update AB Google Map Travel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Auto Post After Image Upload: Missing AuthorizationCVE-2025-31611 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Shaharia Azam Auto Post After Image Upload auto-post-after-image-upload allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Post After Image Upload: from n/a through <= 1.6.

  Product

  Auto Post After Image Upload

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Auto Post After Image Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31610 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gingerplugins Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme gp-notification-bar allows Stored XSS.This issue affects Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme: from n/a through <= 1.1.

  Product

  Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025WPCargo Track & Trace: Missing AuthorizationCVE-2025-31609 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.

  Product

  WPCargo Track & Trace

  Affected

  up to 8.0.2

  What to do

  Affects up to 8.0.2. Update WPCargo Track & Trace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025CookieHint WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31608 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reDim GmbH CookieHint WP cookiehint-wp allows Stored XSS.This issue affects CookieHint WP: from n/a through <= 1.0.0.

  Product

  CookieHint WP

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update CookieHint WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Simple-Audioplayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31607 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flomei Simple-Audioplayer simple-audioplayer allows Stored XSS.This issue affects Simple-Audioplayer: from n/a through <= 1.1.

  Product

  Simple-Audioplayer

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Simple-Audioplayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025SP Blog Designer: Missing AuthorizationCVE-2025-31606 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Missing Authorization vulnerability in softpulseinfotech SP Blog Designer sp-blog-designer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SP Blog Designer: from n/a through <= 1.0.0.

  Product

  SP Blog Designer

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update SP Blog Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Welcome Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31605 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WeblineIndia Welcome Popup welcome-popup allows Stored XSS.This issue affects Welcome Popup: from n/a through <= 1.0.10.

  Product

  Welcome Popup

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update Welcome Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Cal.com: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-31604 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cal.com Cal.com cal-com allows Stored XSS.This issue affects Cal.com: from n/a through <= 1.0.0.

  Product

  Cal.com

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Cal.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025CF7 Spreadsheets: Missing AuthorizationCVE-2025-31603 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Spreadsheets: from n/a through <= 2.3.2.

  Product

  CF7 Spreadsheets

  Affected

  up to 2.3.2

  What to do

  Affects up to 2.3.2. Update CF7 Spreadsheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Apimo Connector: Cross-Site Request Forgery (CSRF)CVE-2025-31602 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Proptech Plugin Apimo Connector apimo allows Cross Site Request Forgery.This issue affects Apimo Connector: from n/a through <= 2.6.5.1.

  Product

  Apimo Connector

  Affected

  up to 2.6.5.1

  What to do

  Affects up to 2.6.5.1. Update Apimo Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Appointy Appointment Scheduler: Cross-Site Request Forgery (CSRF)CVE-2025-31601 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in appointy Appointy Appointment Scheduler appointy-appointment-scheduler allows Cross Site Request Forgery.This issue affects Appointy Appointment Scheduler: from n/a through <= 4.2.1.

  Product

  Appointy Appointment Scheduler

  Affected

  up to 4.2.1

  What to do

  Affects up to 4.2.1. Update Appointy Appointment Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025DesignO: Cross-Site Request Forgery (CSRF)CVE-2025-31600 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in designnbuy DesignO designo allows Cross Site Request Forgery.This issue affects DesignO: from n/a through <= 2.6.0.

  Product

  DesignO

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update DesignO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Quantity Dynamic Pricing & Bulk Discounts for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31598 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Quantity Dynamic Pricing & Bulk Discounts for WooCommerce wholesale-pricing-woocommerce allows Stored XSS.This issue affects Quantity Dynamic Pricing & Bulk Discounts for WooCommerce: from n/a through <= 4.0.3.

  Product

  Quantity Dynamic Pricing & Bulk Discounts for WooCommerce

  Affected

  up to 4.0.3

  What to do

  Affects up to 4.0.3. Update Quantity Dynamic Pricing & Bulk Discounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Ultimate Live Cricket WordPress Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31597 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crazycric Ultimate Live Cricket WordPress Lite ultimate-live-cricket-lite allows Stored XSS.This issue affects Ultimate Live Cricket WordPress Lite: from n/a through <= 1.4.2.

  Product

  Ultimate Live Cricket WordPress Lite

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update Ultimate Live Cricket WordPress Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Chat by Chatwee: Missing AuthorizationCVE-2025-31596 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Chatwee Chat by Chatwee chatwee allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chat by Chatwee: from n/a through <= 2.1.3.

  Product

  Chat by Chatwee

  Affected

  up to 2.1.3

  What to do

  Affects up to 2.1.3. Update Chat by Chatwee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Timeline Event History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31595 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Timeline Event History timeline-event-history allows Stored XSS.This issue affects Timeline Event History: from n/a through <= 3.2.

  Product

  Timeline Event History

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update Timeline Event History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025OpenMenu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31593 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OpenMenu OpenMenu allows Stored XSS. This issue affects OpenMenu: from n/a through 3.5.

  Product

  OpenMenu

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update OpenMenu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Send E-mail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31592 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo Melchiorre Send E-mail send-e-mail allows Stored XSS.This issue affects Send E-mail: from n/a through <= 1.3.

  Product

  Send E-mail

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Send E-mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.