Vulnerability database

9,239 results · page 45 of 185

• Dec 9, 2025Store Locator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67516 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows Blind SQL Injection.This issue affects Store Locator WordPress: from n/a through <= 1.6.2.

  Product

  Store Locator

  Affected

  up to 1.6.2

  What to do

  Affects up to 1.6.2. Update Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Wilmër: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67515 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wilmër wilmer allows PHP Local File Inclusion.This issue affects Wilmër: from n/a through < 3.5.

  Product

  Wilmër

  Fixed in

  3.5

  What to do

  Update Wilmër to 3.5 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Simple Link Directory: Cross-Site Request Forgery (CSRF)CVE-2025-67465 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud Simple Link Directory simple-link-directory allows Cross Site Request Forgery.This issue affects Simple Link Directory: from n/a through <= 8.8.3.

  Product

  Simple Link Directory

  Affected

  up to 8.8.3

  What to do

  Affects up to 8.8.3. Update Simple Link Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025GiveWP: Improper Control of Generation of Code ('Code Injection')CVE-2025-66533 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Control of Generation of Code ('Code Injection') vulnerability in Liquid Web / StellarWP GiveWP give allows Code Injection.This issue affects GiveWP: from n/a through 4.13.1.

  Product

  GiveWP

  Affected

  up to 4.13.1

  What to do

  Affects up to 4.13.1. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Simple Folio: Cross-Site Request Forgery (CSRF)CVE-2025-64256 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Folio simple-folio allows Cross Site Request Forgery.This issue affects Simple Folio: from n/a through <= 1.1.0.

  Product

  Simple Folio

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Simple Folio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025The7 Elements: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-63076 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dream-Theme The7 Elements dt-the7-core allows PHP Local File Inclusion.This issue affects The7 Elements: from n/a through <= 2.7.11.

  Product

  The7 Elements

  Affected

  up to 2.7.11

  What to do

  Affects up to 2.7.11. Update The7 Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Betheme: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63075 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in muffingroup Betheme betheme allows DOM-Based XSS.This issue affects Betheme: from n/a through <= 28.2.

  Product

  Betheme

  Affected

  up to 28.2

  What to do

  Affects up to 28.2. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025The7: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-63074 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dream-Theme The7 dt-the7 allows PHP Local File Inclusion.This issue affects The7: from n/a through < 12.8.1.1.

  Product

  The7

  What to do

  Update The7 to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025The7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63073 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dream-Theme The7 dt-the7 allows DOM-Based XSS.This issue affects The7: from n/a through < 12.9.0.

  Product

  The7

  What to do

  Update The7 to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Cornerstone: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63072 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in THEMECO Cornerstone cornerstone allows Stored XSS.This issue affects Cornerstone: from n/a through <= 7.7.3.

  Product

  Cornerstone

  Affected

  up to 7.7.3

  What to do

  Affects up to 7.7.3. Update Cornerstone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Contact Form 7 – Dynamic Text Extension: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-63068 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in sevenspark Contact Form 7 – Dynamic Text Extension contact-form-7-dynamic-text-extension allows Code Injection.This issue affects Contact Form 7 – Dynamic Text Extension: from n/a through <= 5.0.5.

  Product

  Contact Form 7 – Dynamic Text Extension

  Affected

  up to 5.0.5

  What to do

  Affects up to 5.0.5. Update Contact Form 7 – Dynamic Text Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Porto Theme - Functionality: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63066 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in p-themes Porto Theme - Functionality porto-functionality allows Stored XSS.This issue affects Porto Theme - Functionality: from n/a through < 3.7.3.

  Product

  Porto Theme - Functionality

  What to do

  Update Porto Theme - Functionality to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025EventON: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63064 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON eventon allows Stored XSS.This issue affects EventON: from n/a through <= 4.9.12.

  Product

  EventON

  Affected

  up to 4.9.12

  What to do

  Affects up to 4.9.12. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025UDesign Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-63062 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AndonDesign UDesign Core u-design-core allows PHP Local File Inclusion.This issue affects UDesign Core: from n/a through <= 4.14.0.

  Product

  UDesign Core

  Affected

  up to 4.14.0

  What to do

  Affects up to 4.14.0. Update UDesign Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025KALLYAS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63061 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hogash KALLYAS kallyas allows DOM-Based XSS.This issue affects KALLYAS: from n/a through < 4.25.0.

  Product

  KALLYAS

  What to do

  Update KALLYAS to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Ninja Popups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63059 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arscode Ninja Popups arscode-ninja-popups allows Stored XSS.This issue affects Ninja Popups: from n/a through <= 4.7.8.

  Product

  Ninja Popups

  Affected

  up to 4.7.8

  What to do

  Affects up to 4.7.8. Update Ninja Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Wp Ultimate Review: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63057 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows DOM-Based XSS.This issue affects Wp Ultimate Review: from n/a through <= 2.3.7.

  Product

  Wp Ultimate Review

  Affected

  up to 2.3.7

  What to do

  Affects up to 2.3.7. Update Wp Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Master Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63055 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.0.9.9.4.

  Product

  Master Addons for Elementor

  Affected

  up to 2.0.9.9.4

  What to do

  Affects up to 2.0.9.9.4. Update Master Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025SimpLy Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63052 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows Stored XSS.This issue affects SimpLy Gallery: from n/a through <= 3.3.2.1.

  Product

  SimpLy Gallery

  Affected

  up to 3.3.2.1

  What to do

  Affects up to 3.3.2.1. Update SimpLy Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025REHub Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63050 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam REHub Framework rehub-framework allows Stored XSS.This issue affects REHub Framework: from n/a through < 19.9.9.7.

  Product

  REHub Framework

  What to do

  Update REHub Framework to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025ListingPro Lead Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63048 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro Lead Form listingpro-lead-form allows DOM-Based XSS.This issue affects ListingPro Lead Form: from n/a through <= 1.0.7.

  Product

  ListingPro Lead Form

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update ListingPro Lead Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025ListingPro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63046 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro-plugin allows DOM-Based XSS.This issue affects ListingPro: from n/a through <= 2.9.9.

  Product

  ListingPro

  Affected

  up to 2.9.9

  What to do

  Affects up to 2.9.9. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Master Slider Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63045 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Master Slider Pro masterslider allows DOM-Based XSS.This issue affects Master Slider Pro: from n/a through <= 3.7.12.

  Product

  Master Slider Pro

  Affected

  up to 3.7.12

  What to do

  Affects up to 3.7.12. Update Master Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Xpro Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63044 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows DOM-Based XSS.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.19.1.

  Product

  Xpro Elementor Addons

  Affected

  up to 1.4.19.1

  What to do

  Affects up to 1.4.19.1. Update Xpro Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Tutor LMS Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63042 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons allows Stored XSS.This issue affects Tutor LMS Elementor Addons: from n/a through <= 3.0.1.

  Product

  Tutor LMS Elementor Addons

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update Tutor LMS Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Ronneby Theme Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63037 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DFDevelopment Ronneby Theme Core ronneby-core allows DOM-Based XSS.This issue affects Ronneby Theme Core: from n/a through <= 1.5.68.

  Product

  Ronneby Theme Core

  Affected

  up to 1.5.68

  What to do

  Affects up to 1.5.68. Update Ronneby Theme Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Ronneby Theme Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-63036 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DFDevelopment Ronneby Theme Core ronneby-core allows PHP Local File Inclusion.This issue affects Ronneby Theme Core: from n/a through <= 1.5.68.

  Product

  Ronneby Theme Core

  Affected

  up to 1.5.68

  What to do

  Affects up to 1.5.68. Update Ronneby Theme Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025WPLMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63035 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows DOM-Based XSS.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.

  Product

  WPLMS

  Affected

  up to 1.9.9.5.4

  What to do

  Affects up to 1.9.9.5.4. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Make Section & Column Clickable For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63033 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Riyadh Ahmed Make Section & Column Clickable For Elementor make-section-column-clickable-elementor allows Stored XSS.This issue affects Make Section & Column Clickable For Elementor: from n/a through <= 2.4.

  Product

  Make Section & Column Clickable For Elementor

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update Make Section & Column Clickable For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025WP Hotel Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63011 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows DOM-Based XSS.This issue affects WP Hotel Booking: from n/a through <= 2.2.8.

  Product

  WP Hotel Booking

  Affected

  up to 2.2.8

  What to do

  Affects up to 2.2.8. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025North - Required: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-63003 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes North - Required Plugin north-plugin allows PHP Local File Inclusion.This issue affects North - Required Plugin: from n/a through <= 1.4.2.

  Product

  North - Required

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update North - Required to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Image&Video FullScreen Background: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-62093 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Image&Video FullScreen Background lbg_fullscreen_fullwidth_slider allows SQL Injection.This issue affects Image&Video FullScreen Background: from n/a through <= 1.6.7.

  Product

  Image&Video FullScreen Background

  Affected

  up to 1.6.7

  What to do

  Affects up to 1.6.7. Update Image&Video FullScreen Background to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Generic Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62082 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Uddin Generic Elements generic-elements-for-elementor allows Stored XSS.This issue affects Generic Elements: from n/a through <= 1.2.9.

  Product

  Generic Elements

  Affected

  up to 1.2.9

  What to do

  Affects up to 1.2.9. Update Generic Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 5, 2025User Generator and Importer: Cross-Site Request ForgeryCVE-2025-12879 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The User Generator and Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing nonce validation in the "Import Using CSV File" function. This makes it possible for unauthenticated attackers to elevate user privileges by creating arbitrary accounts with administrator privileges via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.

  Product

  User Generator and Importer

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update User Generator and Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Dec 4, 2025Demo Importer Plus: Arbitrary file uploadCVE-2025-13066 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

  Product

  Demo Importer Plus

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update Demo Importer Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Dec 3, 2025Fluent Booking: Unauthorized calendar import and managementCVE-2025-13756 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Fluent Booking plugin for WordPress is vulnerable to unauthorized calendar import and management due to a missing capability check on the "importCalendar" function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with subscriber level access and above, to import arbitrary calendars and manage them.

  Product

  Fluent Booking

  Affected

  up to 1.9.11

  What to do

  Affects up to 1.9.11. Update Fluent Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Dec 1, 2025Arconix Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-13835 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.20.

  Product

  Arconix Shortcodes

  Affected

  up to 2.1.20

  What to do

  Affects up to 2.1.20. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 27, 2025Simple Folio: Stored Cross-Site ScriptingCVE-2025-12151 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'portfolio_name' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Simple Folio

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Simple Folio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Nov 21, 2025Easy Invoice: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-66115 · WordPress plugins & themes · reported by PatchstackMedium 6.6

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MatrixAddons Easy Invoice easy-invoice allows PHP Local File Inclusion.This issue affects Easy Invoice: from n/a through <= 2.1.4.

  Product

  Easy Invoice

  Affected

  up to 2.1.4

  What to do

  Affects up to 2.1.4. Update Easy Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 21, 2025Nelio Popups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66111 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nelio Software Nelio Popups nelio-popups allows Stored XSS.This issue affects Nelio Popups: from n/a through <= 1.3.0.

  Product

  Nelio Popups

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Nelio Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 21, 2025Travelers' Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66098 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camille V Travelers' Map travelers-map allows Stored XSS.This issue affects Travelers' Map: from n/a through <= 2.3.2.

  Product

  Travelers' Map

  Affected

  up to 2.3.2

  What to do

  Affects up to 2.3.2. Update Travelers' Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 21, 2025KiviCare: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-66095 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.13.

  Product

  KiviCare

  Affected

  up to 3.6.13

  What to do

  Affects up to 3.6.13. Update KiviCare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 21, 2025Extensions for Leaflet Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66093 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows DOM-Based XSS.This issue affects Extensions for Leaflet Map: from n/a through <= 4.8.

  Product

  Extensions for Leaflet Map

  Affected

  up to 4.8

  What to do

  Affects up to 4.8. Update Extensions for Leaflet Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 21, 2025Accordion Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66092 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bqworks Accordion Slider accordion-slider allows Stored XSS.This issue affects Accordion Slider: from n/a through <= 1.9.13.

  Product

  Accordion Slider

  Affected

  up to 1.9.13

  What to do

  Affects up to 1.9.13. Update Accordion Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 21, 2025Stylish Cost Calculator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66091 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator allows DOM-Based XSS.This issue affects Stylish Cost Calculator: from n/a through <= 8.1.5.

  Product

  Stylish Cost Calculator

  Affected

  up to 8.1.5

  What to do

  Affects up to 8.1.5. Update Stylish Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 21, 2025SKT Skill Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66090 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar skt-skill-bar allows DOM-Based XSS.This issue affects SKT Skill Bar: from n/a through <= 2.5.

  Product

  SKT Skill Bar

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update SKT Skill Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 21, 2025Head Meta Data: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66081 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Head Meta Data head-meta-data allows Stored XSS.This issue affects Head Meta Data: from n/a through <= 20250327.

  Product

  Head Meta Data

  Affected

  up to 20250327

  What to do

  Affects up to 20250327. Update Head Meta Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 21, 2025Funnel Builder by FunnelKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66067 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows DOM-Based XSS.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.13.1.2.

  Product

  Funnel Builder by FunnelKit

  Affected

  up to 3.13.1.2

  What to do

  Affects up to 3.13.1.2. Update Funnel Builder by FunnelKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 21, 2025Envo Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66066 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo Extra envo-extra allows Stored XSS.This issue affects Envo Extra: from n/a through <= 1.9.11.

  Product

  Envo Extra

  Affected

  up to 1.9.11

  What to do

  Affects up to 1.9.11. Update Envo Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 21, 2025Seriously Simple Podcasting: Cross-Site Request Forgery (CSRF)CVE-2025-66061 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Cross Site Request Forgery.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0.

  Product

  Seriously Simple Podcasting

  Affected

  up to 3.13.0

  What to do

  Affects up to 3.13.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.