Vulnerability database

9,239 results · page 50 of 185

• Oct 22, 2025Tab Ultimate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62060 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Tab Ultimate tabs-pro.This issue affects Tab Ultimate: from n/a through <= 1.8.

  Product

  Tab Ultimate

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update Tab Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Houzez Theme - Functionality: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62058 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through < 4.2.0.

  Product

  Houzez Theme - Functionality

  What to do

  Update Houzez Theme - Functionality to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Houzez Theme - Functionality: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62054 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through <= 4.1.8.

  Product

  Houzez Theme - Functionality

  Affected

  up to 4.1.8

  What to do

  Affects up to 4.1.8. Update Houzez Theme - Functionality to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62042 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post.This issue affects Event post: from n/a through <= 5.10.3.

  Product

  Event post

  Affected

  up to 5.10.3

  What to do

  Affects up to 5.10.3. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Grevo: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62029 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themesion Grevo grevo.This issue affects Grevo: from n/a through <= 2.4.

  Product

  Grevo

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update Grevo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Pie Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62024 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Jernigan Pie Calendar pie-calendar.This issue affects Pie Calendar: from n/a through <= 1.2.9.

  Product

  Pie Calendar

  Affected

  up to 1.2.9

  What to do

  Affects up to 1.2.9. Update Pie Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025s2Member: Improper Control of Generation of Code ('Code Injection')CVE-2025-62023 · WordPress plugins & themes · reported by PatchstackCritical 9

  Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member.This issue affects s2Member: from n/a through 250905.

  Product

  s2Member

  Affected

  up to 250905

  What to do

  Affects up to 250905. Update s2Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025VOD Infomaniak: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62020 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak.This issue affects VOD Infomaniak: from n/a through <= 1.5.11.

  Product

  VOD Infomaniak

  Affected

  up to 1.5.11

  What to do

  Affects up to 1.5.11. Update VOD Infomaniak to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Advanced Coupons for WooCommerce Coupons: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-62015 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons advanced-coupons-for-woocommerce-free.This issue affects Advanced Coupons for WooCommerce Coupons: from n/a through <= 4.6.8.

  Product

  Advanced Coupons for WooCommerce Coupons

  Affected

  up to 4.6.8

  What to do

  Affects up to 4.6.8. Update Advanced Coupons for WooCommerce Coupons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Simple Finance Calculator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60246 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weissmike Simple Finance Calculator simple-finance-calculator allows Reflected XSS.This issue affects Simple Finance Calculator: from n/a through <= 1.0.

  Product

  Simple Finance Calculator

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Simple Finance Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WP Pipes: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-60227 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes wp-pipes allows Path Traversal.This issue affects WP Pipes: from n/a through <= 1.4.3.

  Product

  WP Pipes

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update WP Pipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025PT Luxa Addons: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-60217 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ypromo PT Luxa Addons pt-luxa-addons allows Path Traversal.This issue affects PT Luxa Addons: from n/a through <= 1.2.2.

  Product

  PT Luxa Addons

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update PT Luxa Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Alone: Improper Control of Generation of Code ('Code Injection')CVE-2025-60206 · WordPress plugins & themes · reported by PatchstackCritical 10

  Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a through <= 7.8.3.

  Product

  Alone

  Affected

  up to 7.8.3

  What to do

  Affects up to 7.8.3. Update Alone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WP Tesseract: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60176 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tattersoftware WP Tesseract wp-tesseract allows Stored XSS.This issue affects WP Tesseract: from n/a through <= 1.0.2.

  Product

  WP Tesseract

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update WP Tesseract to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WeShare Buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60135 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NIKITAS GEORGOPOULOS WeShare Buttons e-mailit allows Stored XSS.This issue affects WeShare Buttons: from n/a through <= 13.0.0.

  Product

  WeShare Buttons

  Affected

  up to 13.0.0

  What to do

  Affects up to 13.0.0. Update WeShare Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Werk aan de Muur: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60131 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoefff Werk aan de Muur werk-aan-de-muur allows Stored XSS.This issue affects Werk aan de Muur: from n/a through <= 1.5.

  Product

  Werk aan de Muur

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Werk aan de Muur to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Colibri Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59593 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through < 1.0.334.

  Product

  Colibri Page Builder

  Fixed in

  1.0.334

  What to do

  Update Colibri Page Builder to 1.0.334 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Simple Job Board: Insertion of Sensitive Information Into Sent DataCVE-2025-59579 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Insertion of Sensitive Information Into Sent Data vulnerability in PressTigers Simple Job Board simple-job-board allows Retrieve Embedded Sensitive Data.This issue affects Simple Job Board: from n/a through <= 2.13.7.

  Product

  Simple Job Board

  Affected

  up to 2.13.7

  What to do

  Affects up to 2.13.7. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WorkScout-Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59571 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affects WorkScout-Core: from n/a through < 1.7.06.

  Product

  WorkScout-Core

  What to do

  Update WorkScout-Core to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Workreap (theme's plugin): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-59566 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows Path Traversal.This issue affects Workreap (theme's plugin): from n/a through <= 3.3.5.

  Product

  Workreap (theme's plugin)

  Affected

  up to 3.3.5

  What to do

  Affects up to 3.3.5. Update Workreap (theme's plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025EduMall: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-59564 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a through < 4.4.5.

  Product

  EduMall

  Fixed in

  4.4.5

  What to do

  Update EduMall to 4.4.5 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Billey: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-59558 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through < 2.1.6.

  Product

  Billey

  Fixed in

  2.1.6

  What to do

  Update Billey to 2.1.6 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Learts Addons: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-59557 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Learts Addons learts-addons allows SQL Injection.This issue affects Learts Addons: from n/a through < 1.7.5.

  Product

  Learts Addons

  What to do

  Update Learts Addons to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Medizin: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-59555 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Medizin medizin allows PHP Local File Inclusion.This issue affects Medizin: from n/a through < 1.9.7.

  Product

  Medizin

  Fixed in

  1.9.7

  What to do

  Update Medizin to 1.9.7 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Xcare: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-59550 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designervily Xcare xcare allows PHP Local File Inclusion.This issue affects Xcare: from n/a through < 6.5.

  Product

  Xcare

  What to do

  Update Xcare to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Easy Woocommerce Customizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59006 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Easy Woocommerce Customizer easy-woocommerce-customizer allows Reflected XSS.This issue affects Easy Woocommerce Customizer: from n/a through <= 1.0.2.

  Product

  Easy Woocommerce Customizer

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Easy Woocommerce Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WC Return products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59004 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pco_58 WC Return products wc-return-product allows Reflected XSS.This issue affects WC Return products: from n/a through <= 1.5.

  Product

  WC Return products

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update WC Return products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Doctreat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58971 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AmentoTech Doctreat doctreat allows Reflected XSS.This issue affects Doctreat: from n/a through <= 1.6.7.

  Product

  Doctreat

  Affected

  up to 1.6.7

  What to do

  Affects up to 1.6.7. Update Doctreat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Doctreat: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-58970 · WordPress plugins & themes · reported by PatchstackMedium 6.3

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AmentoTech Doctreat doctreat allows Code Injection.This issue affects Doctreat: from n/a through <= 1.6.7.

  Product

  Doctreat

  Affected

  up to 1.6.7

  What to do

  Affects up to 1.6.7. Update Doctreat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Businext: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58967 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Businext businext allows PHP Local File Inclusion.This issue affects Businext: from n/a through < 2.4.4.

  Product

  Businext

  Fixed in

  2.4.4

  What to do

  Update Businext to 2.4.4 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025NEX-Forms LITE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58966 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms LITE nex-forms-lite allows Reflected XSS.This issue affects NEX-Forms LITE: from n/a through < 8.2.

  Product

  NEX-Forms LITE

  What to do

  Update NEX-Forms LITE to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025CF7 Auto Responder Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58961 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kamleshyadav CF7 Auto Responder Addon CF7-autoresponder-addon allows DOM-Based XSS.This issue affects CF7 Auto Responder Addon: from n/a through <= 2.4.

  Product

  CF7 Auto Responder Addon

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update CF7 Auto Responder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Taskbot: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-58959 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Taskbot taskbot allows Path Traversal.This issue affects Taskbot: from n/a through <= 6.4.

  Product

  Taskbot

  Affected

  up to 6.4

  What to do

  Affects up to 6.4. Update Taskbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025SmilePure: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58958 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove SmilePure smilepure allows PHP Local File Inclusion.This issue affects SmilePure: from n/a through < 1.8.5.

  Product

  SmilePure

  Fixed in

  1.8.5

  What to do

  Update SmilePure to 1.8.5 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Karzo: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58955 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designervily Karzo karzo allows PHP Local File Inclusion.This issue affects Karzo: from n/a through < 2.6.

  Product

  Karzo

  What to do

  Update Karzo to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WP Tactical Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58921 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arevico WP Tactical Popup wp-tactical-popup allows Reflected XSS.This issue affects WP Tactical Popup: from n/a through <= 1.1.

  Product

  WP Tactical Popup

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update WP Tactical Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Author: Munzir: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58916 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Munzir Author: Munzir myshouts-shoutbox allows Reflected XSS.This issue affects Author: Munzir: from n/a through <= 0.9.

  Product

  Author: Munzir

  Affected

  up to 0.9

  What to do

  Affects up to 0.9. Update Author: Munzir to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Simple User Registration: Incorrect Privilege AssignmentCVE-2025-53428 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Incorrect Privilege Assignment vulnerability in N-Media Simple User Registration wp-registration allows Privilege Escalation.This issue affects Simple User Registration: from n/a through <= 6.8.

  Product

  Simple User Registration

  Affected

  up to 6.8

  What to do

  Affects up to 6.8. Update Simple User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025SEO Pyramid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53427 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chibueze Okechukwu SEO Pyramid seo-pyramid allows Reflected XSS.This issue affects SEO Pyramid: from n/a through <= 1.9.8.

  Product

  SEO Pyramid

  Affected

  up to 1.9.8

  What to do

  Affects up to 1.9.8. Update SEO Pyramid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Likert Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53426 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Likert Survey Master likert-survey-master allows Reflected XSS.This issue affects Likert Survey Master: from n/a through <= 0.8.0.1.

  Product

  Likert Survey Master

  Affected

  up to 0.8.0.1

  What to do

  Affects up to 0.8.0.1. Update Likert Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Triss: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53423 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Triss triss allows Reflected XSS.This issue affects Triss: from n/a through <= 2.6.

  Product

  Triss

  Affected

  up to 2.6

  What to do

  Affects up to 2.6. Update Triss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WhatsApp Chat for WordPress and WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53422 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeWarriors WhatsApp Chat for WordPress and WooCommerce tw-whatsapp-chat-rotator allows Reflected XSS.This issue affects WhatsApp Chat for WordPress and WooCommerce: from n/a through <= 1.2.1.

  Product

  WhatsApp Chat for WordPress and WooCommerce

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update WhatsApp Chat for WordPress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025WPLMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53420 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows Reflected XSS.This issue affects WPLMS: from n/a through <= 1.9.9.8.

  Product

  WPLMS

  Affected

  up to 1.9.9.8

  What to do

  Affects up to 1.9.9.8. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Grid Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53352 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Grid Plus grid-plus allows Reflected XSS.This issue affects Grid Plus: from n/a through <= 3.3.

  Product

  Grid Plus

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update Grid Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Fidelo Snippet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53351 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fidelo Software GmbH Fidelo Snippet thebing-snippet allows Reflected XSS.This issue affects Fidelo Snippet: from n/a through <= 1.12.

  Product

  Fidelo Snippet

  Affected

  up to 1.12

  What to do

  Affects up to 1.12. Update Fidelo Snippet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Calendar Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53350 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webjunk Calendar Plus calendar-plus allows Reflected XSS.This issue affects Calendar Plus: from n/a through <= 1.2.4.

  Product

  Calendar Plus

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update Calendar Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Woocommerce Envato Affiliates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53297 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Envato Affiliates wooenvato allows Reflected XSS.This issue affects Woocommerce Envato Affiliates: from n/a through <= 1.2.1.

  Product

  Woocommerce Envato Affiliates

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Woocommerce Envato Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025Toast Mobile Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53238 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Toast Mobile Menu toast-responsive-menu allows Stored XSS.This issue affects Toast Mobile Menu: from n/a through <= 1.0.8.

  Product

  Toast Mobile Menu

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Toast Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025UDesign Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53234 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign Core u-design-core allows Reflected XSS.This issue affects UDesign Core: from n/a through <= 4.14.0.

  Product

  UDesign Core

  Affected

  up to 4.14.0

  What to do

  Affects up to 4.14.0. Update UDesign Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2025RockON DJ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53229 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kamleshyadav RockON DJ rockon allows Reflected XSS.This issue affects RockON DJ: from n/a through <= 3.3.

  Product

  RockON DJ

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update RockON DJ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.