Vulnerability database

41,251 results · page 407 of 826

• Mar 3, 2025Ps Ads Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23738 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Padam Shankhadev Ps Ads Pro ps-ads-pro allows Reflected XSS.This issue affects Ps Ads Pro: from n/a through <= 1.0.0.

  Product

  Ps Ads Pro

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Ps Ads Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Form To JSON: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23736 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webgdawg Form To JSON form-to-json allows Reflected XSS.This issue affects Form To JSON: from n/a through <= 1.0.

  Product

  Form To JSON

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Form To JSON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Tax Report for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23731 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in infosoftplugin Tax Report for WooCommerce tax-report-for-woocommerce allows Reflected XSS.This issue affects Tax Report for WooCommerce: from n/a through <= 2.2.

  Product

  Tax Report for WooCommerce

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Tax Report for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025ComparePress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23726 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thebloghouse ComparePress comparepress allows Reflected XSS.This issue affects ComparePress: from n/a through <= 2.0.8.

  Product

  ComparePress

  Affected

  up to 2.0.8

  What to do

  Affects up to 2.0.8. Update ComparePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Mobigate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23721 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cloudvn Mobigate mobigatevn allows Reflected XSS.This issue affects Mobigate: from n/a through <= 1.0.3.

  Product

  Mobigate

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Mobigate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Mancx AskMe Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23718 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mancx Mancx AskMe Widget mancx-askme-widget allows Reflected XSS.This issue affects Mancx AskMe Widget: from n/a through <= 0.3.

  Product

  Mancx AskMe Widget

  Affected

  up to 0.3

  What to do

  Affects up to 0.3. Update Mancx AskMe Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Login Watchdog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23716 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JkmAS Login Watchdog login-watchdog allows Stored XSS.This issue affects Login Watchdog: from n/a through <= 1.0.4.

  Product

  Login Watchdog

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Login Watchdog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Cobwebo URL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23688 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in editionskezzal Cobwebo URL Plugin cobwebo-url allows Reflected XSS.This issue affects Cobwebo URL Plugin: from n/a through <= 1.0.

  Product

  Cobwebo URL

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Cobwebo URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 20254 author cheer up donate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23670 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in montashov 4 author cheer up donate 4-author-cheer-up-donate allows Reflected XSS.This issue affects 4 author cheer up donate: from n/a through <= 1.3.

  Product

  4 author cheer up donate

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update 4 author cheer up donate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025ChatGPT Open AI Images & Content for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23668 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mauricio Urrego ChatGPT Open AI Images & Content for WooCommerce glasses-for-woocommerce allows Reflected XSS.This issue affects ChatGPT Open AI Images & Content for WooCommerce: from n/a through <= 2.2.0.

  Product

  ChatGPT Open AI Images & Content for WooCommerce

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update ChatGPT Open AI Images & Content for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Contexto: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23663 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Vaquez Contexto contexto allows Reflected XSS.This issue affects Contexto: from n/a through <= 1.0.

  Product

  Contexto

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Contexto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025新淘客WordPress插件: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23637 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fxy060608 新淘客WordPress插件 wp-xintaoke allows Reflected XSS.This issue affects 新淘客WordPress插件: from n/a through <= 1.1.2.

  Product

  新淘客WordPress插件

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update 新淘客WordPress插件 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025ePermissions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23635 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mobde3net ePermissions epermissions allows Reflected XSS.This issue affects ePermissions: from n/a through <= 1.2.

  Product

  ePermissions

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update ePermissions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Catch Duplicate Switcher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23619 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Catch Themes Catch Duplicate Switcher catch-duplicate-switcher allows Reflected XSS.This issue affects Catch Duplicate Switcher: from n/a through <= 2.0.

  Product

  Catch Duplicate Switcher

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Catch Duplicate Switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Canalplan: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23616 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Canalplan canalplan-ac allows Reflected XSS.This issue affects Canalplan: from n/a through <= 5.31.

  Product

  Canalplan

  Affected

  up to 5.31

  What to do

  Affects up to 5.31. Update Canalplan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Interactive Page Hierarchy: Missing AuthorizationCVE-2025-23615 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in gtekelis Interactive Page Hierarchy interactive-page-hierarchy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Interactive Page Hierarchy: from n/a through <= 1.0.1.

  Product

  Interactive Page Hierarchy

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Interactive Page Hierarchy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Journal: Missing AuthorizationCVE-2025-23613 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in mediabeta WP Journal wpjournal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Journal: from n/a through <= 1.1.

  Product

  WP Journal

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update WP Journal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Send to a Friend Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23600 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pinal.shah Send to a Friend Addon send-booking-invites-to-friends allows Reflected XSS.This issue affects Send to a Friend Addon: from n/a through <= 1.4.1.

  Product

  Send to a Friend Addon

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Send to a Friend Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Page Health-O-Meter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23595 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainpulse Page Health-O-Meter page-health-o-meter allows Reflected XSS.This issue affects Page Health-O-Meter: from n/a through <= 2.0.

  Product

  Page Health-O-Meter

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Page Health-O-Meter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025all-in-one-box-login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23587 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashek Al Mahmud all-in-one-box-login all-in-one-login allows Reflected XSS.This issue affects all-in-one-box-login: from n/a through <= 2.0.1.

  Product

  all-in-one-box-login

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update all-in-one-box-login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Post Category Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23586 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MAL73049 WP Post Category Notifications wp-post-category-notifications allows Reflected XSS.This issue affects WP Post Category Notifications: from n/a through <= 1.0.

  Product

  WP Post Category Notifications

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP Post Category Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Goo.gl Url Shorter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23585 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CantonBolo Goo.gl Url Shorter googl-url-shorter allows Reflected XSS.This issue affects Goo.gl Url Shorter: from n/a through <= 1.0.1.

  Product

  Goo.gl Url Shorter

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Goo.gl Url Shorter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Pin Locations on Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23584 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arsh91 Pin Locations on Map pin-locations-on-map allows Reflected XSS.This issue affects Pin Locations on Map: from n/a through <= 1.0.

  Product

  Pin Locations on Map

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Pin Locations on Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025DZS Ajaxer Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23579 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalzoomstudio DZS Ajaxer Lite dzs-ajaxer-lite-dynamic-page-load allows Stored XSS.This issue affects DZS Ajaxer Lite: from n/a through <= 1.04.

  Product

  DZS Ajaxer Lite

  Affected

  up to 1.04

  What to do

  Affects up to 1.04. Update DZS Ajaxer Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Intro.JS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23576 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cfuze WP Intro.JS wp-intro-js-tours allows Reflected XSS.This issue affects WP Intro.JS: from n/a through <= 1.1.

  Product

  WP Intro.JS

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update WP Intro.JS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025DX Sales CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23575 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevriX DX Sales CRM dx-sales-crm allows Reflected XSS.This issue affects DX Sales CRM: from n/a through <= 1.1.

  Product

  DX Sales CRM

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update DX Sales CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Social Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23570 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mitchell Bundy WP Social Links wp-social-links allows Reflected XSS.This issue affects WP Social Links: from n/a through <= 0.3.1.

  Product

  WP Social Links

  Affected

  up to 0.3.1

  What to do

  Affects up to 0.3.1. Update WP Social Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Wibstats: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23565 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Taylor Wibstats wibstats-statistics-for-wordpress-mu allows Reflected XSS.This issue affects Wibstats: from n/a through <= 0.5.5.

  Product

  Wibstats

  Affected

  up to 0.5.5

  What to do

  Affects up to 0.5.5. Update Wibstats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP FixTag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23564 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mohsenshahbazi WP FixTag wp-fixtag allows Reflected XSS.This issue affects WP FixTag: from n/a through <= v2.0.2.

  Product

  WP FixTag

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update WP FixTag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Explore pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23563 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mbyte Explore pages explore-pages allows Reflected XSS.This issue affects Explore pages: from n/a through <= 1.01.

  Product

  Explore pages

  Affected

  up to 1.01

  What to do

  Affects up to 1.01. Update Explore pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Push Envoy Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23556 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in netbitsolutions Push Envoy Notifications push-envoy allows Reflected XSS.This issue affects Push Envoy Notifications: from n/a through <= 1.0.0.

  Product

  Push Envoy Notifications

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Push Envoy Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Ui Slider Filter By Price: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23555 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chenyenming Ui Slider Filter By Price ui-slider-filter-by-price allows Reflected XSS.This issue affects Ui Slider Filter By Price: from n/a through <= 1.1.

  Product

  Ui Slider Filter By Price

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Ui Slider Filter By Price to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Userbase Access Control: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23553 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Cramer Userbase Access Control userbase-access-control allows Reflected XSS.This issue affects Userbase Access Control: from n/a through <= 1.0.

  Product

  Userbase Access Control

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Userbase Access Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Texteller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23552 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yashar Texteller texteller allows Reflected XSS.This issue affects Texteller: from n/a through <= 1.3.0.

  Product

  Texteller

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Texteller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Maniac SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23549 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in agora32 Maniac SEO maniac-seo allows Reflected XSS.This issue affects Maniac SEO: from n/a through <= 2.0.

  Product

  Maniac SEO

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Maniac SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Awesome Hooks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23539 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in surror Awesome Hooks awesome-hooks allows Reflected XSS.This issue affects Awesome Hooks: from n/a through <= 1.0.1.

  Product

  Awesome Hooks

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Awesome Hooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Contest: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23538 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sophia M Williams WP Contest wp-contest allows Reflected XSS.This issue affects WP Contest: from n/a through <= 1.0.0.

  Product

  WP Contest

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update WP Contest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Track Page Scroll: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23536 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 Track Page Scroll track-page-scroll allows Reflected XSS.This issue affects Track Page Scroll: from n/a through <= 1.0.2.

  Product

  Track Page Scroll

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Track Page Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Swift Calendar Online Appointment Scheduling: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23526 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SwiftCloud Swift Calendar Online Appointment Scheduling online-appointment-scheduling-software allows Reflected XSS.This issue affects Swift Calendar Online Appointment Scheduling: from n/a through <= 1.3.3.

  Product

  Swift Calendar Online Appointment Scheduling

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update Swift Calendar Online Appointment Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025ClickBank Storefront: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23524 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dactum ClickBank Storefront mycbgenie-clickbank-storefront allows Reflected XSS.This issue affects ClickBank Storefront: from n/a through <= 1.7.

  Product

  ClickBank Storefront

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update ClickBank Storefront to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Goodlayers Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23521 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Blocks goodlayers-blocks allows Reflected XSS.This issue affects Goodlayers Blocks: from n/a through <= 1.0.1.

  Product

  Goodlayers Blocks

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Goodlayers Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Heartland Management Terminal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23520 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SecureSubmit Heartland Management Terminal allows Reflected XSS. This issue affects Heartland Management Terminal: from n/a through 1.3.0.

  Product

  Heartland Management Terminal

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Heartland Management Terminal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025G Web Pro Store Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23519 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jas Saran G Web Pro Store Locator gwebpro-store-locator allows Reflected XSS.This issue affects G Web Pro Store Locator: from n/a through <= 2.0.1.

  Product

  G Web Pro Store Locator

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update G Web Pro Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025GoogleMapper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23518 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mrsaucier GoogleMapper googlemapper-2 allows Reflected XSS.This issue affects GoogleMapper: from n/a through <= 2.0.3.

  Product

  GoogleMapper

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update GoogleMapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Google Map on Post/Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23517 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunil chaulagain Google Map on Post/Page google-map-on-postpage allows Reflected XSS.This issue affects Google Map on Post/Page: from n/a through <= 1.1.

  Product

  Google Map on Post/Page

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Google Map on Post/Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Sale with Razorpay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23516 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainvireinfo Sale with Razorpay sell-with-razorpay allows Reflected XSS.This issue affects Sale with Razorpay: from n/a through <= 1.0.

  Product

  Sale with Razorpay

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Sale with Razorpay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025ts-tree: Missing AuthorizationCVE-2025-23515 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in tsecher ts-tree ts-tree allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ts-tree: from n/a through <= 0.1.1.

  Product

  ts-tree

  Affected

  up to 0.1.1

  What to do

  Affects up to 0.1.1. Update ts-tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Pit Login Welcome: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23505 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pantho Bihosh Pit Login Welcome pit-login-welcome allows Reflected XSS.This issue affects Pit Login Welcome: from n/a through <= 1.1.5.

  Product

  Pit Login Welcome

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update Pit Login Welcome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Curated Search: Cross-Site Request Forgery (CSRF)CVE-2025-23502 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Ned Curated Search curated-search allows Stored XSS.This issue affects Curated Search: from n/a through <= 1.2.

  Product

  Curated Search

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Curated Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP FPO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23496 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in husani WP FPO wp-fpo allows Reflected XSS.This issue affects WP FPO: from n/a through <= 1.0.

  Product

  WP FPO

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP FPO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.