Vulnerability database

5,817 results · page 48 of 117

• Apr 4, 2025Chamber Dashboard Business Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32162 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Morgan Kay Chamber Dashboard Business Directory allows DOM-Based XSS. This issue affects Chamber Dashboard Business Directory: from n/a through 3.3.11.

  Product

  Chamber Dashboard Business Directory

  Affected

  up to 3.3.11

  What to do

  Affects up to 3.3.11. Update Chamber Dashboard Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Arkhe Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32161 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryo Arkhe Blocks arkhe-blocks allows Stored XSS.This issue affects Arkhe Blocks: from n/a through <= 2.27.1.

  Product

  Arkhe Blocks

  Affected

  up to 2.27.1

  What to do

  Affects up to 2.27.1. Update Arkhe Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025ActiveCampaign: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32136 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in activecampaign ActiveCampaign activecampaign-subscription-forms allows Stored XSS.This issue affects ActiveCampaign: from n/a through <= 8.1.16.

  Product

  ActiveCampaign

  Affected

  up to 8.1.16

  What to do

  Affects up to 8.1.16. Update ActiveCampaign to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Split Test For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32135 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rocketelements Split Test For Elementor split-test-for-elementor allows Stored XSS.This issue affects Split Test For Elementor: from n/a through <= 1.8.4.

  Product

  Split Test For Elementor

  Affected

  up to 1.8.4

  What to do

  Affects up to 1.8.4. Update Split Test For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025URL Shortify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32134 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders URL Shortify url-shortify allows Stored XSS.This issue affects URL Shortify: from n/a through <= 1.10.5.1.

  Product

  URL Shortify

  Affected

  up to 1.10.5.1

  What to do

  Affects up to 1.10.5.1. Update URL Shortify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Secure Copy Content Protection and Content Locking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32133 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Stored XSS.This issue affects Secure Copy Content Protection and Content Locking: from n/a through <= 4.5.5.

  Product

  Secure Copy Content Protection and Content Locking

  Affected

  up to 4.5.5

  What to do

  Affects up to 4.5.5. Update Secure Copy Content Protection and Content Locking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025FunnelCockpit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32132 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelCockpit FunnelCockpit funnelcockpit allows Stored XSS.This issue affects FunnelCockpit: from n/a through <= 1.4.3.

  Product

  FunnelCockpit

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update FunnelCockpit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Social Intents: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32131 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in socialintents Social Intents live-chat-support-by-social-intents allows Stored XSS.This issue affects Social Intents: from n/a through <= 1.6.19.

  Product

  Social Intents

  Affected

  up to 1.6.19

  What to do

  Affects up to 1.6.19. Update Social Intents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Posts Footer Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32130 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. Posts Footer Manager intelly-posts-footer-manager allows Stored XSS.This issue affects Posts Footer Manager: from n/a through <= 2.2.0.

  Product

  Posts Footer Manager

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update Posts Footer Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Welcome Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32129 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. Welcome Bar intelly-welcome-bar allows Stored XSS.This issue affects Welcome Bar: from n/a through <= 2.0.4.

  Product

  Welcome Bar

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update Welcome Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Gravel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31418 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in noonnoo Gravel allows Reflected XSS.This issue affects Gravel: from n/a through 1.6.

  Product

  Gravel

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Gravel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Awesome Event Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31416 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking allows Reflected XSS.This issue affects Awesome Event Booking: from n/a through <= 2.8.4.

  Product

  Awesome Event Booking

  Affected

  up to 2.8.4

  What to do

  Affects up to 2.8.4. Update Awesome Event Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Tiger: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31407 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hutsixdigital Tiger allows Stored XSS.This issue affects Tiger: from n/a through 2.0.

  Product

  Tiger

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Tiger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Sequel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31389 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Introvoke Inc. dba Sequel.io Sequel sequel allows Reflected XSS.This issue affects Sequel: from n/a through <= 1.0.11.

  Product

  Sequel

  Affected

  up to 1.0.11

  What to do

  Affects up to 1.0.11. Update Sequel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Simplish: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22281 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in joshix Simplish simplish allows Stored XSS.This issue affects Simplish: from n/a through <= 2.6.4.

  Product

  Simplish

  Affected

  up to 2.6.4

  What to do

  Affects up to 2.6.4. Update Simplish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025ez Form Calculator Premium: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22282 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in keksdieb ez Form Calculator Premium ez-form-calculator-premium allows Reflected XSS.This issue affects ez Form Calculator Premium: from n/a through <= 2.14.1.2.

  Product

  ez Form Calculator Premium

  Affected

  up to 2.14.1.2

  What to do

  Affects up to 2.14.1.2. Update ez Form Calculator Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Team Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31907 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labib Ahmed Team Builder team-display allows Reflected XSS.This issue affects Team Builder: from n/a through <= 1.3.

  Product

  Team Builder

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Team Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Team Rosters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31905 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark O'Donnell Team Rosters team-rosters allows Reflected XSS.This issue affects Team Rosters: from n/a through <= 4.7.

  Product

  Team Rosters

  Affected

  up to 4.7

  What to do

  Affects up to 4.7. Update Team Rosters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025XV Random Quotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31903 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xavi Ivars XV Random Quotes xv-random-quotes allows Reflected XSS.This issue affects XV Random Quotes: from n/a through <= 2.0.0.

  Product

  XV Random Quotes

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update XV Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Social Share And Social Locker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31902 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems Social Share And Social Locker social-share-and-social-locker-arsocial allows Reflected XSS.This issue affects Social Share And Social Locker: from n/a through <= 1.4.1.

  Product

  Social Share And Social Locker

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Social Share And Social Locker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Digihood HTML Sitemap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31901 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digihood Digihood HTML Sitemap wedesin-html-sitemap allows Reflected XSS.This issue affects Digihood HTML Sitemap: from n/a through <= 3.1.1.

  Product

  Digihood HTML Sitemap

  Affected

  up to 3.1.1

  What to do

  Affects up to 3.1.1. Update Digihood HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Lexicata: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31900 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lexicata Lexicata lexicata allows Reflected XSS.This issue affects Lexicata: from n/a through <= 1.0.16.

  Product

  Lexicata

  Affected

  up to 1.0.16

  What to do

  Affects up to 1.0.16. Update Lexicata to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Awesome Logos: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31899 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpshopee Awesome Logos awesome-logos allows Reflected XSS.This issue affects Awesome Logos: from n/a through <= 1.2.

  Product

  Awesome Logos

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Awesome Logos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025MediaView: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31898 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dustinscarberry MediaView mediaview allows Reflected XSS.This issue affects MediaView: from n/a through <= 1.1.2.

  Product

  MediaView

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update MediaView to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Botnet Attack Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31893 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cheesefather Botnet Attack Blocker botnet-attack-blocker allows Stored XSS.This issue affects Botnet Attack Blocker: from n/a through <= 2.0.0.

  Product

  Botnet Attack Blocker

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Botnet Attack Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Support Helpdesk Ticket System Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31626 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alisaleem252 Support Helpdesk Ticket System Lite ticket-help-desk-system-lite allows Reflected XSS.This issue affects Support Helpdesk Ticket System Lite: from n/a through 4.5.2.

  Product

  Support Helpdesk Ticket System Lite

  Affected

  up to 4.5.2

  What to do

  Affects up to 4.5.2. Update Support Helpdesk Ticket System Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Advanced Typekit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31622 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Utkarsh Kukreti Advanced Typekit advanced-typekit allows Stored XSS.This issue affects Advanced Typekit: from n/a through <= 1.0.1.

  Product

  Advanced Typekit

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Advanced Typekit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Contact Form vCard Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31582 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani Contact Form vCard Generator contact-form-vcard-generator allows Stored XSS.This issue affects Contact Form vCard Generator: from n/a through <= 2.4.

  Product

  Contact Form vCard Generator

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update Contact Form vCard Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025PeproDev CF7 Database: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31573 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev CF7 Database pepro-cf7-database allows Stored XSS.This issue affects PeproDev CF7 Database: from n/a through <= 2.0.0.

  Product

  PeproDev CF7 Database

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update PeproDev CF7 Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025CF7 Spreadsheets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31536 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Reflected XSS.This issue affects CF7 Spreadsheets: from n/a through <= 2.3.2.

  Product

  CF7 Spreadsheets

  Affected

  up to 2.3.2

  What to do

  Affects up to 2.3.2. Update CF7 Spreadsheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025WP_Identicon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31468 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scottsm WP_Identicon wp-identicon allows Reflected XSS.This issue affects WP_Identicon: from n/a through <= 2.0.

  Product

  WP_Identicon

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update WP_Identicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Flickr Photostream: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31467 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in miro.mannino Flickr Photostream flickr-photostream allows Reflected XSS.This issue affects Flickr Photostream: from n/a through <= 3.1.8.

  Product

  Flickr Photostream

  Affected

  up to 3.1.8

  What to do

  Affects up to 3.1.8. Update Flickr Photostream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Search engine keywords highlighter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31442 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e1tekoap42 Search engine keywords highlighter keywords-highlight-tool allows Reflected XSS.This issue affects Search engine keywords highlighter: from n/a through <= 0.1.3.

  Product

  Search engine keywords highlighter

  Affected

  up to 0.1.3

  What to do

  Affects up to 0.1.3. Update Search engine keywords highlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Blubrry PowerPress Podcasting plugin MultiSite add-on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31436 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Angelo Mandato Blubrry PowerPress Podcasting plugin MultiSite add-on powerpress-multisite allows Reflected XSS.This issue affects Blubrry PowerPress Podcasting plugin MultiSite add-on: from n/a through <= 0.1.1.

  Product

  Blubrry PowerPress Podcasting plugin MultiSite add-on

  Affected

  up to 0.1.1

  What to do

  Affects up to 0.1.1. Update Blubrry PowerPress Podcasting plugin MultiSite add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025CM Header and Footer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31091 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Header and Footer cm-header-footer-script-loader allows Stored XSS.This issue affects CM Header and Footer: from n/a through <= 1.2.4.

  Product

  CM Header and Footer

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update CM Header and Footer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Snow Storm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30858 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Snow Storm snow-storm allows Reflected XSS.This issue affects Snow Storm: from n/a through <= 1.4.6.

  Product

  Snow Storm

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update Snow Storm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Latest Custom Post Type Updates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30616 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Wood Latest Custom Post Type Updates latest-custom-post-type-updates allows Reflected XSS.This issue affects Latest Custom Post Type Updates: from n/a through <= 1.3.0.

  Product

  Latest Custom Post Type Updates

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Latest Custom Post Type Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 3, 2025Wptobe-signinup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30611 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wptobe Wptobe-signinup wptobe-signinup allows Reflected XSS.This issue affects Wptobe-signinup: from n/a through <= 1.1.2.

  Product

  Wptobe-signinup

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Wptobe-signinup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Extensions for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31889 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in petesheppard84 Extensions for Elementor. This issue affects Extensions for Elementor: from n/a through 2.0.40.

  Product

  Extensions for Elementor

  Affected

  up to 2.0.40

  What to do

  Affects up to 2.0.40. Update Extensions for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Nova Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31819 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks.This issue affects Nova Blocks: from n/a through <= 2.1.8.

  Product

  Nova Blocks

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update Nova Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Auto scroll for reading: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31594 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPglob Auto scroll for reading auto-scroll-for-reading allows Reflected XSS.This issue affects Auto scroll for reading: from n/a through <= 1.1.4.

  Product

  Auto scroll for reading

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Auto scroll for reading to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Fonts Manager | Custom Fonts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31578 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wisdomlogix Solutions Pvt. Ltd. Fonts Manager | Custom Fonts fonts-manager-custom-fonts allows Reflected XSS.This issue affects Fonts Manager | Custom Fonts: from n/a through <= 1.2.

  Product

  Fonts Manager | Custom Fonts

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Fonts Manager | Custom Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025The Logo Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31571 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cynob IT Consultancy The Logo Slider the-logo-slider allows Reflected XSS.This issue affects The Logo Slider: from n/a through <= 1.0.0.

  Product

  The Logo Slider

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update The Logo Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025LeadLab by wiredminds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31568 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wiredmindshelp LeadLab by wiredminds wiredminds-leadlab allows Reflected XSS.This issue affects LeadLab by wiredminds: from n/a through <= 1.3.

  Product

  LeadLab by wiredminds

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update LeadLab by wiredminds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025AI Search Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31563 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vimal Kava AI Search Bar open-ai-search-bar allows Stored XSS.This issue affects AI Search Bar: from n/a through <= 2.1.

  Product

  AI Search Bar

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update AI Search Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Ultimate Push Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31548 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Reflected XSS.This issue affects Ultimate Push Notifications: from n/a through <= 1.2.0.

  Product

  Ultimate Push Notifications

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Ultimate Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Bulk NoIndex & NoFollow Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31537 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madfishdigital Bulk NoIndex & NoFollow Toolkit bulk-noindex-nofollow-toolkit-by-mad-fish allows Reflected XSS.This issue affects Bulk NoIndex & NoFollow Toolkit: from n/a through <= 2.16.

  Product

  Bulk NoIndex & NoFollow Toolkit

  Affected

  up to 2.16

  What to do

  Affects up to 2.16. Update Bulk NoIndex & NoFollow Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025CGM Event Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31462 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rzfarrell CGM Event Calendar cgm-event-calendar allows Reflected XSS.This issue affects CGM Event Calendar: from n/a through <= 0.8.5.

  Product

  CGM Event Calendar

  Affected

  up to 0.8.5

  What to do

  Affects up to 0.8.5. Update CGM Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025NanoSupport: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31461 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mayeenul Islam NanoSupport nanosupport allows Reflected XSS.This issue affects NanoSupport: from n/a through <= 0.6.0.

  Product

  NanoSupport

  Affected

  up to 0.6.0

  What to do

  Affects up to 0.6.0. Update NanoSupport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Limit Max IPs Per User: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31455 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ralxz Limit Max IPs Per User limit-max-ips-per-user allows DOM-Based XSS.This issue affects Limit Max IPs Per User: from n/a through <= 1.5.

  Product

  Limit Max IPs Per User

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Limit Max IPs Per User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.