Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

5,817 results · page 53 of 117

Mar 27, 2025Blog, Posts and Category Filter for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22648 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Devs Blog, Posts and Category Filter for Elementor blog-posts-and-category-for-elementor allows Stored XSS.This issue affects Blog, Posts and Category Filter for Elementor: from n/a through <= 2.0.1.
Product
Blog, Posts and Category Filter for Elementor
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Blog, Posts and Category Filter for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025aThemes Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22646 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.0.8.
Product
aThemes Addons for Elementor
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update aThemes Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22644 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce vayu-blocks allows Stored XSS.This issue affects Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: from n/a through <= 1.4.7.
Product
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Quick Interest Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26738 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Graham Quick Interest Slider quick-interest-slider allows DOM-Based XSS.This issue affects Quick Interest Slider: from n/a through <= 3.1.5.
Product
Quick Interest Slider
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Quick Interest Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025City Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26737 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yudleethemes City Store allows DOM-Based XSS.This issue affects City Store: from n/a through 1.4.5.
Product
City Store
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update City Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025MorningTime Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26736 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in victortihai MorningTime Lite morningtime-lite allows Stored XSS.This issue affects MorningTime Lite: from n/a through <= 1.3.2.
Product
MorningTime Lite
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update MorningTime Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Hester: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26734 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in peregrinethemes Hester hester allows Stored XSS.This issue affects Hester: from n/a through <= 1.1.10.
Product
Hester
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update Hester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025StoreBiz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26732 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burgersoftware StoreBiz storebiz allows DOM-Based XSS.This issue affects StoreBiz: from n/a through <= 1.0.32.
Product
StoreBiz
Affected
up to 1.0.32
What to do
Affects up to 1.0.32. Update StoreBiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025ARPrice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26731 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARPrice arprice allows Stored XSS.This issue affects ARPrice: from n/a through <= 4.1.3.
Product
ARPrice
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Power Mag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22816 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetrendy Power Mag power-mag allows DOM-Based XSS.This issue affects Power Mag: from n/a through <= 1.1.5.
Product
Power Mag
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Power Mag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025The Pack Elementor addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30925 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through <= 2.1.1.
Product
The Pack Elementor addons
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Simplebooklet PDF Viewer and Embedder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30922 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in simplebooklet Simplebooklet PDF Viewer and Embedder simplebooklet allows Stored XSS.This issue affects Simplebooklet PDF Viewer and Embedder: from n/a through <= 1.1.1.
Product
Simplebooklet PDF Viewer and Embedder
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Simplebooklet PDF Viewer and Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025WP Posts Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30920 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Stored XSS.This issue affects WP Posts Carousel: from n/a through <= 1.3.7.
Product
WP Posts Carousel
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update WP Posts Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Structured Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30918 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme Structured Content structured-content allows Stored XSS.This issue affects Structured Content: from n/a through <= 1.6.3.
Product
Structured Content
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Structured Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025SecuPress Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30907 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SecuPress SecuPress Free secupress allows DOM-Based XSS.This issue affects SecuPress Free: from n/a through <= 2.2.5.3.
Product
SecuPress Free
Affected
up to 2.2.5.3
What to do
Affects up to 2.2.5.3. Update SecuPress Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Chartify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30904 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Chartify chart-builder allows Stored XSS.This issue affects Chartify: from n/a through <= 3.1.7.
Product
Chartify
Affected
up to 3.1.7
What to do
Affects up to 3.1.7. Update Chartify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025SyntaxHighlighter Evolved: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30903 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Mills SyntaxHighlighter Evolved syntaxhighlighter allows DOM-Based XSS.This issue affects SyntaxHighlighter Evolved: from n/a through <= 3.7.1.
Product
SyntaxHighlighter Evolved
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update SyntaxHighlighter Evolved to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Zoho Billing – Embed Payment Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30900 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Subscriptions Zoho Billing – Embed Payment Form allows Stored XSS. This issue affects Zoho Billing – Embed Payment Form: from n/a through 4.0.
Product
Zoho Billing – Embed Payment Form
Affected
up to 4.0
What to do
Affects up to 4.0. Update Zoho Billing – Embed Payment Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025User Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30899 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through <= 4.0.3.
Product
User Registration
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30898 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahdi Yousefi [MahdiY] افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) persian-woocommerce-shipping allows Stored XSS.This issue affects افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری): from n/a through <= 4.2.3.
Product
افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری)
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025LeadConnector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30893 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeadConnector LeadConnector leadconnector allows DOM-Based XSS.This issue affects LeadConnector: from n/a through <= 3.0.2.
Product
LeadConnector
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update LeadConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Greenshift: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30873 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Stored XSS.This issue affects Greenshift: from n/a through <= 11.0.2.
Product
Greenshift
Affected
up to 11.0.2
What to do
Affects up to 11.0.2. Update Greenshift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025SearchIQ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30867 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SearchIQ SearchIQ searchiq allows Stored XSS.This issue affects SearchIQ: from n/a through <= 4.7.
Product
SearchIQ
Affected
up to 4.7
What to do
Affects up to 4.7. Update SearchIQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Off-Canvas Sidebars & Menus (Slidebars): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30860 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars allows DOM-Based XSS.This issue affects Off-Canvas Sidebars & Menus (Slidebars): from n/a through <= 0.5.8.2.
Product
Off-Canvas Sidebars & Menus (Slidebars)
Affected
up to 0.5.8.2
What to do
Affects up to 0.5.8.2. Update Off-Canvas Sidebars & Menus (Slidebars) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Dr. Flex: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30850 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sfaerber Dr. Flex dr-flex allows Stored XSS.This issue affects Dr. Flex: from n/a through <= 2.0.0.
Product
Dr. Flex
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Dr. Flex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Novelist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30847 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashley Novelist novelist allows Stored XSS.This issue affects Novelist: from n/a through <= 1.2.3.
Product
Novelist
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Novelist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Cozy Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30838 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through <= 2.1.6.
Product
Cozy Blocks
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update Cozy Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025LatePoint: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30836 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LatePoint LatePoint latepoint allows Stored XSS.This issue affects LatePoint: from n/a through <= 5.1.6.
Product
LatePoint
Affected
up to 5.1.6
What to do
Affects up to 5.1.6. Update LatePoint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Themify Event Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30832 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Event Post themify-event-post allows DOM-Based XSS.This issue affects Themify Event Post: from n/a through <= 1.3.2.
Product
Themify Event Post
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Themify Event Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025IP Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30826 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy IP Locator ip-locator allows DOM-Based XSS.This issue affects IP Locator: from n/a through <= 4.1.0.
Product
IP Locator
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update IP Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025jAlbum Bridge: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30818 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mlaza jAlbum Bridge jalbum-bridge allows DOM-Based XSS.This issue affects jAlbum Bridge: from n/a through <= 2.0.17.
Product
jAlbum Bridge
Affected
up to 2.0.17
What to do
Affects up to 2.0.17. Update jAlbum Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Listamester: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30813 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in listamester Listamester listamester allows Stored XSS.This issue affects Listamester: from n/a through <= 2.3.5.
Product
Listamester
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Listamester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025SKT Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30812 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Addons for Elementor skt-addons-for-elementor allows Stored XSS.This issue affects SKT Addons for Elementor: from n/a through <= 3.5.
Product
SKT Addons for Elementor
Affected
up to 3.5
What to do
Affects up to 3.5. Update SKT Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Gum Elementor Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30800 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atawai Gum Elementor Addon gum-elementor-addon allows Stored XSS.This issue affects Gum Elementor Addon: from n/a through <= 1.3.10.
Product
Gum Elementor Addon
Affected
up to 1.3.10
What to do
Affects up to 1.3.10. Update Gum Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025WP Google Street View: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30799 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup WP Google Street View wp-google-street-view allows Stored XSS.This issue affects WP Google Street View: from n/a through <= 1.1.5.
Product
WP Google Street View
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update WP Google Street View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Comment Approved Notifier Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30792 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ufukart Comment Approved Notifier Extended comment-approved-notifier-extended allows Stored XSS.This issue affects Comment Approved Notifier Extended: from n/a through <= 5.2.
Product
Comment Approved Notifier Extended
Affected
up to 5.2
What to do
Affects up to 5.2. Update Comment Approved Notifier Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Clearout Email Validator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30789 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in clearoutio Clearout Email Validator clearout-email-validator allows Stored XSS.This issue affects Clearout Email Validator: from n/a through <= 3.2.0.
Product
Clearout Email Validator
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Clearout Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Quotes llama: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30786 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oooorgle Quotes llama quotes-llama allows DOM-Based XSS.This issue affects Quotes llama: from n/a through <= 3.1.0.
Product
Quotes llama
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Quotes llama to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Audio Album: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30780 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cubecolour Audio Album audio-album allows Stored XSS.This issue affects Audio Album: from n/a through <= 1.5.0.
Product
Audio Album
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Audio Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Doneren met Mollie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30779 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick van Wobbie Doneren met Mollie doneren-met-mollie allows Stored XSS.This issue affects Doneren met Mollie: from n/a through <= 2.10.7.
Product
Doneren met Mollie
Affected
up to 2.10.7
What to do
Affects up to 2.10.7. Update Doneren met Mollie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Sitekit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30776 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue affects Sitekit: from n/a through <= 1.8.
Product
Sitekit
Affected
up to 1.8
What to do
Affects up to 1.8. Update Sitekit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025WP Cassify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30771 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alain-Aymerick FRANCOIS WP Cassify wp-cassify allows DOM-Based XSS.This issue affects WP Cassify: from n/a through <= 2.3.5.
Product
WP Cassify
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update WP Cassify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Charitable: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30770 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Charitable charitable allows DOM-Based XSS.This issue affects Charitable: from n/a through <= 1.8.4.7.
Product
Charitable
Affected
up to 1.8.4.7
What to do
Affects up to 1.8.4.7. Update Charitable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025jAlbum Bridge: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30768 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mlaza jAlbum Bridge jalbum-bridge allows Stored XSS.This issue affects jAlbum Bridge: from n/a through <= 2.0.18.
Product
jAlbum Bridge
Affected
up to 2.0.18
What to do
Affects up to 2.0.18. Update jAlbum Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30766 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows DOM-Based XSS.This issue affects Happy Addons for Elementor: from n/a through <= 3.16.2.
Product
Happy Addons for Elementor
Affected
up to 3.16.2
What to do
Affects up to 3.16.2. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025EO4WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30763 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer EO4WP fw-integration-for-emailoctopus allows Stored XSS.This issue affects EO4WP: from n/a through <= 1.0.8.4.
Product
EO4WP
Affected
up to 1.0.8.4
What to do
Affects up to 1.0.8.4. Update EO4WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Fancybox Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28935 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in puzich Fancybox Plus fancybox-plus allows Reflected XSS.This issue affects Fancybox Plus: from n/a through <= 1.0.1.
Product
Fancybox Plus
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Fancybox Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Simple Post Series: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28934 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chaozh Simple Post Series simple-post-series allows Reflected XSS.This issue affects Simple Post Series: from n/a through <= 2.4.4.
Product
Simple Post Series
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Simple Post Series to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Are you robot google recaptcha for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28928 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sureshdsk Are you robot google recaptcha for wordpress are-you-robot-recaptcha allows Reflected XSS.This issue affects Are you robot google recaptcha for wordpress: from n/a through <= 2.2.
Product
Are you robot google recaptcha for
Affected
up to 2.2
What to do
Affects up to 2.2. Update Are you robot google recaptcha for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025ZenphotoPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28924 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simbul ZenphotoPress zenphotopress allows Reflected XSS.This issue affects ZenphotoPress: from n/a through <= 1.8.
Product
ZenphotoPress
Affected
up to 1.8
What to do
Affects up to 1.8. Update ZenphotoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.