Vulnerability database

41,262 results · page 429 of 826

• Jan 27, 2025WP Multistore Locator: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-24680 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Reflected XSS.This issue affects WP Multistore Locator: from n/a through <= 2.4.7.

  Product

  WP Multistore Locator

  Affected

  up to 2.4.7

  What to do

  Affects up to 2.4.7. Update WP Multistore Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Save as PDF: Deserialization of Untrusted DataCVE-2025-24671 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Deserialization of Untrusted Data vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Object Injection.This issue affects Save as PDF: from n/a through <= 4.4.0.

  Product

  Save as PDF

  Affected

  up to 4.4.0

  What to do

  Affects up to 4.4.0. Update Save as PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Small Package Quotes – Worldwide Express Edition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24667 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows SQL Injection.This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through <= 5.2.17.

  Product

  Small Package Quotes – Worldwide Express Edition

  Affected

  up to 5.2.17

  What to do

  Affects up to 5.2.17. Update Small Package Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Small Package Quotes – Unishippers Edition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24665 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows SQL Injection.This issue affects Small Package Quotes – Unishippers Edition: from n/a through <= 2.4.8.

  Product

  Small Package Quotes – Unishippers Edition

  Affected

  up to 2.4.8

  What to do

  Affects up to 2.4.8. Update Small Package Quotes – Unishippers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025LearnDash LMS: Missing AuthorizationCVE-2025-24662 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in LearnDash LearnDash LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnDash LMS: from n/a through 4.20.0.1.

  Product

  LearnDash LMS

  Affected

  up to 4.20.0.1

  What to do

  Affects up to 4.20.0.1. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Admin and Site Enhancements (ASE) Pro: Missing AuthorizationCVE-2025-24653 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Admin and Site Enhancements (ASE) Pro: from n/a through 7.6.1.1.

  Product

  Admin and Site Enhancements (ASE) Pro

  Affected

  up to 7.6.1.1

  What to do

  Affects up to 7.6.1.1. Update Admin and Site Enhancements (ASE) Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Google Captcha: Authentication Bypass by SpoofingCVE-2025-24628 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Authentication Bypass by Spoofing vulnerability in bestwebsoft Google Captcha google-captcha allows Identity Spoofing.This issue affects Google Captcha: from n/a through <= 1.78.

  Product

  Google Captcha

  Affected

  up to 1.78

  What to do

  Affects up to 1.78. Update Google Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Music Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24626 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Music Store music-store allows Reflected XSS.This issue affects Music Store: from n/a through <= 1.1.19.

  Product

  Music Store

  Affected

  up to 1.1.19

  What to do

  Affects up to 1.1.19. Update Music Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2025-24606 · WordPress plugins & themes · reported by PatchstackMedium 6.4

  Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.1.

  Product

  Client Invoicing by Sprout Invoices

  Affected

  up to 20.8.1

  What to do

  Affects up to 20.8.1. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Print Barcode Labels for your WooCommerce products/orders: Missing AuthorizationCVE-2025-24603 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Print Barcode Labels for your WooCommerce products/orders a4-barcode-generator.This issue affects Print Barcode Labels for your WooCommerce products/orders: from n/a through <= 3.4.10.

  Product

  Print Barcode Labels for your WooCommerce products/orders

  Affected

  up to 3.4.10

  What to do

  Affects up to 3.4.10. Update Print Barcode Labels for your WooCommerce products/orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025RSVPMarker: Missing AuthorizationCVE-2025-24600 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in davidfcarr RSVPMarker rsvpmaker.This issue affects RSVPMarker : from n/a through <= 11.4.5.

  Product

  RSVPMarker

  Affected

  up to 11.4.5

  What to do

  Affects up to 11.4.5. Update RSVPMarker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Edwiser Bridge: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24593 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Reflected XSS.This issue affects Edwiser Bridge: from n/a through <= 3.0.8.

  Product

  Edwiser Bridge

  Affected

  up to 3.0.8

  What to do

  Affects up to 3.0.8. Update Edwiser Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025picu: Missing AuthorizationCVE-2025-24590 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in picu picu picu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects picu: from n/a through <= 2.4.0.

  Product

  picu

  Affected

  up to 2.4.0

  What to do

  Affects up to 2.4.0. Update picu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: Cross-Site Request Forgery (CSRF)CVE-2025-24540 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Cross Site Request Forgery.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.18.9.

  Product

  Coming Soon Page, Under Construction & Maintenance Mode by SeedProd

  Affected

  up to 6.18.9

  What to do

  Affects up to 6.18.9. Update Coming Soon Page, Under Construction & Maintenance Mode by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025BuddyPress Groups Extras: Cross-Site Request Forgery (CSRF)CVE-2025-24538 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Slava Abakumov BuddyPress Groups Extras buddypress-groups-extras allows Cross Site Request Forgery.This issue affects BuddyPress Groups Extras: from n/a through <= 3.6.10.

  Product

  BuddyPress Groups Extras

  Affected

  up to 3.6.10

  What to do

  Affects up to 3.6.10. Update BuddyPress Groups Extras to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025The Events Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-24537 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site Request Forgery.This issue affects The Events Calendar: from n/a through <= 6.7.0.

  Product

  The Events Calendar

  Affected

  up to 6.7.0

  What to do

  Affects up to 6.7.0. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Fare Calculator: Missing AuthorizationCVE-2025-23982 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Missing Authorization vulnerability in Gopi krishnan Fare Calculator fare-calculator allows Stored XSS.This issue affects Fare Calculator: from n/a through <= 1.1.

  Product

  Fare Calculator

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Fare Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025PAPERCITE: Missing AuthorizationCVE-2025-23849 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in bpiwowar PAPERCITE papercite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PAPERCITE: from n/a through <= 0.5.18.

  Product

  PAPERCITE

  Affected

  up to 0.5.18

  What to do

  Affects up to 0.5.18. Update PAPERCITE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025LawPress – Law Firm Website Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23756 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ivanchernyakov LawPress – Law Firm Website Management lawpress allows Reflected XSS.This issue affects LawPress – Law Firm Website Management: from n/a through <= 1.4.5.

  Product

  LawPress – Law Firm Website Management

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update LawPress – Law Firm Website Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025The Loops: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23754 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ulrich Sossou The Loops the-loops allows Reflected XSS.This issue affects The Loops: from n/a through <= 1.0.2.

  Product

  The Loops

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update The Loops to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025CGD Arrange Terms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23752 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Clifton Griffin CGD Arrange Terms shopp-arrange allows Reflected XSS.This issue affects CGD Arrange Terms: from n/a through <= 1.1.3.

  Product

  CGD Arrange Terms

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update CGD Arrange Terms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025WP Smart Tooltip: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23669 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nurul Amin WP Smart Tooltip wp-smart-tool-tip allows Stored XSS.This issue affects WP Smart Tooltip: from n/a through <= 1.0.0.

  Product

  WP Smart Tooltip

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update WP Smart Tooltip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Donate visa: Missing AuthorizationCVE-2025-23656 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Saul Morales Pacheco Donate visa donate-visa allows Stored XSS.This issue affects Donate visa: from n/a through <= 1.0.0.

  Product

  Donate visa

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Donate visa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025CubePM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23574 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Lau CubePM cubepm allows Reflected XSS.This issue affects CubePM: from n/a through <= 1.0.

  Product

  CubePM

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update CubePM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025RSVPMaker Volunteer Roles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23531 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davidfcarr RSVPMaker Volunteer Roles rsvpmaker-volunteer-roles allows Reflected XSS.This issue affects RSVPMaker Volunteer Roles: from n/a through <= 1.5.1.

  Product

  RSVPMaker Volunteer Roles

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update RSVPMaker Volunteer Roles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Minterpress: Missing AuthorizationCVE-2025-23529 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in blokhauswp Minterpress minterpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Minterpress: from n/a through <= 1.0.5.

  Product

  Minterpress

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Minterpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Houzez: Missing AuthorizationCVE-2025-24754 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0.

  Product

  Houzez

  Affected

  up to 3.4.0

  What to do

  Affects up to 3.4.0. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Morkva UA Shipping: Path Traversal: '.../...//'CVE-2025-24685 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Path Traversal: '.../...//' vulnerability in Ihor Kit Morkva UA Shipping morkva-ua-shipping allows PHP Local File Inclusion.This issue affects Morkva UA Shipping: from n/a through <= 1.0.18.

  Product

  Morkva UA Shipping

  Affected

  up to 1.0.18

  What to do

  Affects up to 1.0.18. Update Morkva UA Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025LTL Freight Quotes – Worldwide Express Edition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24664 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows SQL Injection.This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through <= 5.0.20.

  Product

  LTL Freight Quotes – Worldwide Express Edition

  Affected

  up to 5.0.20

  What to do

  Affects up to 5.0.20. Update LTL Freight Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Shipping for Nova Poshta: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24612 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through <= 1.19.6.

  Product

  Shipping for Nova Poshta

  Affected

  up to 1.19.6

  What to do

  Affects up to 1.19.6. Update Shipping for Nova Poshta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025FundPress: Deserialization of Untrusted DataCVE-2025-24601 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Deserialization of Untrusted Data vulnerability in ThimPress FundPress fundpress allows Object Injection.This issue affects FundPress: from n/a through <= 2.0.6.

  Product

  FundPress

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update FundPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Ultimate Store Kit Elementor Addons: Missing AuthorizationCVE-2025-24584 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.3.0.

  Product

  Ultimate Store Kit Elementor Addons

  Affected

  up to 2.3.0

  What to do

  Affects up to 2.3.0. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Responsive Slider by MetaSlider: Cross-Site Request Forgery (CSRF)CVE-2025-24533 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Cross Site Request Forgery.This issue affects Responsive Slider by MetaSlider: from n/a through <= 3.92.0.

  Product

  Responsive Slider by MetaSlider

  Affected

  up to 3.92.0

  What to do

  Affects up to 3.92.0. Update Responsive Slider by MetaSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Passwordless WP – Login with your glance or fingerprint: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23792 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Busters Passwordless WP – Login with your glance or fingerprint passwordless-wp allows Reflected XSS.This issue affects Passwordless WP – Login with your glance or fingerprint: from n/a through <= 1.1.6.

  Product

  Passwordless WP – Login with your glance or fingerprint

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Passwordless WP – Login with your glance or fingerprint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Shipdeo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23457 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shipdeoplugin Shipdeo shipdeo-woo allows Reflected XSS.This issue affects Shipdeo: from n/a through <= 1.2.8.

  Product

  Shipdeo

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update Shipdeo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Simple Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22513 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Simple Locator simple-locator allows Reflected XSS.This issue affects Simple Locator: from n/a through <= 2.0.4.

  Product

  Simple Locator

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update Simple Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploadedCVE-2024-13117 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded

  Product

  Social Share Buttons for

  Affected

  up to 2.7

  What to do

  Affects up to 2.7. Update Social Share Buttons for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Jan 27, 2025Crelly Slider: Does not sanitise and escape some of its settingsCVE-2024-13116 · WordPress plugins & themes · reported by WPScanLow 3.8

  The Crelly Slider WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

  Product

  Crelly Slider

  Fixed in

  1.4.7

  What to do

  Update Crelly Slider to 1.4.7 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jan 27, 2025WP Triggers Lite: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-13095 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

  Product

  WP Triggers Lite

  Affected

  up to 2.5.3

  What to do

  Affects up to 2.5.3. Update WP Triggers Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 27, 2025WP Triggers Lite: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13094 · WordPress plugins & themes · reported by WPScanHigh 7.1

  The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

  Product

  WP Triggers Lite

  Affected

  up to 2.5.3

  What to do

  Affects up to 2.5.3. Update WP Triggers Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 27, 2025Dyn Business Panel: Does not have CSRF check in some placesCVE-2024-13057 · WordPress plugins & themes · reported by WPScanHigh 7.1

  The Dyn Business Panel WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

  Product

  Dyn Business Panel

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Dyn Business Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 27, 2025Dyn Business Panel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13056 · WordPress plugins & themes · reported by WPScanHigh 7.1

  The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

  Product

  Dyn Business Panel

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Dyn Business Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 27, 2025Dyn Business Panel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13055 · WordPress plugins & themes · reported by WPScanHigh 7.1

  The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

  Product

  Dyn Business Panel

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Dyn Business Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 27, 2025Dental Optimizer Patient Generator App: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13052 · WordPress plugins & themes · reported by WPScanHigh 7.1

  The Dental Optimizer Patient Generator App WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

  Product

  Dental Optimizer Patient Generator App

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Dental Optimizer Patient Generator App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 27, 2025Altra Side Menu: Does not have CSRF checks in some placesCVE-2024-12774 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Altra Side Menu WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary menu via a CSRF attack

  Product

  Altra Side Menu

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Altra Side Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Jan 27, 2025Altra Side Menu: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12773 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The Altra Side Menu WordPress plugin through 2.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

  Product

  Altra Side Menu

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Altra Side Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Jan 27, 2025WP Customer Area: Does not have CSRF checks in some placesCVE-2024-12436 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

  Product

  WP Customer Area

  Affected

  up to 8.2.4

  What to do

  Affects up to 8.2.4. Update WP Customer Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 27, 2025WC Affiliate: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12321 · WordPress plugins & themes · reported by WPScanHigh 7.1

  The WC Affiliate WordPress plugin through 2.3.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

  Product

  WC Affiliate

  Affected

  up to 2.3.9

  What to do

  Affects up to 2.3.9. Update WC Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 27, 2025WP Customer Area: Does not have CSRF check in placeCVE-2024-12280 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF check in place when deleting its logs, which could allow attackers to make a logged in to delete them via a CSRF attack

  Product

  WP Customer Area

  Affected

  up to 8.2.4

  What to do

  Affects up to 8.2.4. Update WP Customer Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 26, 2025Survey Maker: Stored Cross-Site ScriptingCVE-2024-13505 · WordPress plugins & themes · reported by WordfenceMedium 5.5

  The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ays_sections[5][questions][8][title]’ parameter in all versions up to, and including, 5.1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

  Product

  Survey Maker

  Affected

  up to 5.1.3.3

  What to do

  Affects up to 5.1.3.3. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.