Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

5,857 results · page 54 of 118

Mar 27, 2025StoreBiz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26732 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burgersoftware StoreBiz storebiz allows DOM-Based XSS.This issue affects StoreBiz: from n/a through <= 1.0.32.
Product
StoreBiz
Affected
up to 1.0.32
What to do
Affects up to 1.0.32. Update StoreBiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025ARPrice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26731 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARPrice arprice allows Stored XSS.This issue affects ARPrice: from n/a through <= 4.1.3.
Product
ARPrice
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Power Mag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22816 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetrendy Power Mag power-mag allows DOM-Based XSS.This issue affects Power Mag: from n/a through <= 1.1.5.
Product
Power Mag
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Power Mag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025The Pack Elementor addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30925 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through <= 2.1.1.
Product
The Pack Elementor addons
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Simplebooklet PDF Viewer and Embedder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30922 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in simplebooklet Simplebooklet PDF Viewer and Embedder simplebooklet allows Stored XSS.This issue affects Simplebooklet PDF Viewer and Embedder: from n/a through <= 1.1.1.
Product
Simplebooklet PDF Viewer and Embedder
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Simplebooklet PDF Viewer and Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025WP Posts Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30920 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Stored XSS.This issue affects WP Posts Carousel: from n/a through <= 1.3.7.
Product
WP Posts Carousel
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update WP Posts Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Structured Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30918 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme Structured Content structured-content allows Stored XSS.This issue affects Structured Content: from n/a through <= 1.6.3.
Product
Structured Content
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Structured Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025SecuPress Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30907 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SecuPress SecuPress Free secupress allows DOM-Based XSS.This issue affects SecuPress Free: from n/a through <= 2.2.5.3.
Product
SecuPress Free
Affected
up to 2.2.5.3
What to do
Affects up to 2.2.5.3. Update SecuPress Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Chartify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30904 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Chartify chart-builder allows Stored XSS.This issue affects Chartify: from n/a through <= 3.1.7.
Product
Chartify
Affected
up to 3.1.7
What to do
Affects up to 3.1.7. Update Chartify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025SyntaxHighlighter Evolved: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30903 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Mills SyntaxHighlighter Evolved syntaxhighlighter allows DOM-Based XSS.This issue affects SyntaxHighlighter Evolved: from n/a through <= 3.7.1.
Product
SyntaxHighlighter Evolved
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update SyntaxHighlighter Evolved to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Zoho Billing – Embed Payment Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30900 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Subscriptions Zoho Billing – Embed Payment Form allows Stored XSS. This issue affects Zoho Billing – Embed Payment Form: from n/a through 4.0.
Product
Zoho Billing – Embed Payment Form
Affected
up to 4.0
What to do
Affects up to 4.0. Update Zoho Billing – Embed Payment Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025User Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30899 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through <= 4.0.3.
Product
User Registration
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30898 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahdi Yousefi [MahdiY] افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) persian-woocommerce-shipping allows Stored XSS.This issue affects افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری): from n/a through <= 4.2.3.
Product
افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری)
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025LeadConnector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30893 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeadConnector LeadConnector leadconnector allows DOM-Based XSS.This issue affects LeadConnector: from n/a through <= 3.0.2.
Product
LeadConnector
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update LeadConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Greenshift: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30873 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Stored XSS.This issue affects Greenshift: from n/a through <= 11.0.2.
Product
Greenshift
Affected
up to 11.0.2
What to do
Affects up to 11.0.2. Update Greenshift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025SearchIQ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30867 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SearchIQ SearchIQ searchiq allows Stored XSS.This issue affects SearchIQ: from n/a through <= 4.7.
Product
SearchIQ
Affected
up to 4.7
What to do
Affects up to 4.7. Update SearchIQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Off-Canvas Sidebars & Menus (Slidebars): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30860 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars allows DOM-Based XSS.This issue affects Off-Canvas Sidebars & Menus (Slidebars): from n/a through <= 0.5.8.2.
Product
Off-Canvas Sidebars & Menus (Slidebars)
Affected
up to 0.5.8.2
What to do
Affects up to 0.5.8.2. Update Off-Canvas Sidebars & Menus (Slidebars) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Dr. Flex: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30850 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sfaerber Dr. Flex dr-flex allows Stored XSS.This issue affects Dr. Flex: from n/a through <= 2.0.0.
Product
Dr. Flex
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Dr. Flex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Novelist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30847 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashley Novelist novelist allows Stored XSS.This issue affects Novelist: from n/a through <= 1.2.3.
Product
Novelist
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Novelist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Cozy Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30838 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through <= 2.1.6.
Product
Cozy Blocks
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update Cozy Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025LatePoint: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30836 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LatePoint LatePoint latepoint allows Stored XSS.This issue affects LatePoint: from n/a through <= 5.1.6.
Product
LatePoint
Affected
up to 5.1.6
What to do
Affects up to 5.1.6. Update LatePoint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Themify Event Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30832 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Event Post themify-event-post allows DOM-Based XSS.This issue affects Themify Event Post: from n/a through <= 1.3.2.
Product
Themify Event Post
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Themify Event Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025IP Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30826 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy IP Locator ip-locator allows DOM-Based XSS.This issue affects IP Locator: from n/a through <= 4.1.0.
Product
IP Locator
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update IP Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025jAlbum Bridge: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30818 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mlaza jAlbum Bridge jalbum-bridge allows DOM-Based XSS.This issue affects jAlbum Bridge: from n/a through <= 2.0.17.
Product
jAlbum Bridge
Affected
up to 2.0.17
What to do
Affects up to 2.0.17. Update jAlbum Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Listamester: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30813 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in listamester Listamester listamester allows Stored XSS.This issue affects Listamester: from n/a through <= 2.3.5.
Product
Listamester
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Listamester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025SKT Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30812 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Addons for Elementor skt-addons-for-elementor allows Stored XSS.This issue affects SKT Addons for Elementor: from n/a through <= 3.5.
Product
SKT Addons for Elementor
Affected
up to 3.5
What to do
Affects up to 3.5. Update SKT Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Gum Elementor Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30800 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atawai Gum Elementor Addon gum-elementor-addon allows Stored XSS.This issue affects Gum Elementor Addon: from n/a through <= 1.3.10.
Product
Gum Elementor Addon
Affected
up to 1.3.10
What to do
Affects up to 1.3.10. Update Gum Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025WP Google Street View: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30799 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup WP Google Street View wp-google-street-view allows Stored XSS.This issue affects WP Google Street View: from n/a through <= 1.1.5.
Product
WP Google Street View
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update WP Google Street View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Comment Approved Notifier Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30792 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ufukart Comment Approved Notifier Extended comment-approved-notifier-extended allows Stored XSS.This issue affects Comment Approved Notifier Extended: from n/a through <= 5.2.
Product
Comment Approved Notifier Extended
Affected
up to 5.2
What to do
Affects up to 5.2. Update Comment Approved Notifier Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Clearout Email Validator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30789 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in clearoutio Clearout Email Validator clearout-email-validator allows Stored XSS.This issue affects Clearout Email Validator: from n/a through <= 3.2.0.
Product
Clearout Email Validator
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Clearout Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Quotes llama: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30786 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oooorgle Quotes llama quotes-llama allows DOM-Based XSS.This issue affects Quotes llama: from n/a through <= 3.1.0.
Product
Quotes llama
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Quotes llama to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Audio Album: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30780 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cubecolour Audio Album audio-album allows Stored XSS.This issue affects Audio Album: from n/a through <= 1.5.0.
Product
Audio Album
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Audio Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Doneren met Mollie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30779 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick van Wobbie Doneren met Mollie doneren-met-mollie allows Stored XSS.This issue affects Doneren met Mollie: from n/a through <= 2.10.7.
Product
Doneren met Mollie
Affected
up to 2.10.7
What to do
Affects up to 2.10.7. Update Doneren met Mollie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Sitekit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30776 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue affects Sitekit: from n/a through <= 1.8.
Product
Sitekit
Affected
up to 1.8
What to do
Affects up to 1.8. Update Sitekit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025WP Cassify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30771 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alain-Aymerick FRANCOIS WP Cassify wp-cassify allows DOM-Based XSS.This issue affects WP Cassify: from n/a through <= 2.3.5.
Product
WP Cassify
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update WP Cassify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Charitable: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30770 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Charitable charitable allows DOM-Based XSS.This issue affects Charitable: from n/a through <= 1.8.4.7.
Product
Charitable
Affected
up to 1.8.4.7
What to do
Affects up to 1.8.4.7. Update Charitable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025jAlbum Bridge: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30768 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mlaza jAlbum Bridge jalbum-bridge allows Stored XSS.This issue affects jAlbum Bridge: from n/a through <= 2.0.18.
Product
jAlbum Bridge
Affected
up to 2.0.18
What to do
Affects up to 2.0.18. Update jAlbum Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30766 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows DOM-Based XSS.This issue affects Happy Addons for Elementor: from n/a through <= 3.16.2.
Product
Happy Addons for Elementor
Affected
up to 3.16.2
What to do
Affects up to 3.16.2. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025EO4WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30763 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer EO4WP fw-integration-for-emailoctopus allows Stored XSS.This issue affects EO4WP: from n/a through <= 1.0.8.4.
Product
EO4WP
Affected
up to 1.0.8.4
What to do
Affects up to 1.0.8.4. Update EO4WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Fancybox Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28935 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in puzich Fancybox Plus fancybox-plus allows Reflected XSS.This issue affects Fancybox Plus: from n/a through <= 1.0.1.
Product
Fancybox Plus
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Fancybox Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Simple Post Series: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28934 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chaozh Simple Post Series simple-post-series allows Reflected XSS.This issue affects Simple Post Series: from n/a through <= 2.4.4.
Product
Simple Post Series
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Simple Post Series to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Are you robot google recaptcha for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28928 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sureshdsk Are you robot google recaptcha for wordpress are-you-robot-recaptcha allows Reflected XSS.This issue affects Are you robot google recaptcha for wordpress: from n/a through <= 2.2.
Product
Are you robot google recaptcha for
Affected
up to 2.2
What to do
Affects up to 2.2. Update Are you robot google recaptcha for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025ZenphotoPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28924 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simbul ZenphotoPress zenphotopress allows Reflected XSS.This issue affects ZenphotoPress: from n/a through <= 1.8.
Product
ZenphotoPress
Affected
up to 1.8
What to do
Affects up to 1.8. Update ZenphotoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025SpatialMatch IDX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28921 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in homejunction SpatialMatch IDX spatialmatch-free-lifestyle-search allows Reflected XSS.This issue affects SpatialMatch IDX: from n/a through <= 3.0.9.
Product
SpatialMatch IDX
Affected
up to 3.0.9
What to do
Affects up to 3.0.9. Update SpatialMatch IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Custom Smilies: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28917 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crazyloong Custom Smilies custom-smilies-se allows Stored XSS.This issue affects Custom Smilies: from n/a through <= 2.9.2.
Product
Custom Smilies
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update Custom Smilies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Gravity 2 PDF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28911 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gravity2pdf Gravity 2 PDF gf2pdf allows Reflected XSS.This issue affects Gravity 2 PDF: from n/a through <= 3.1.3.
Product
Gravity 2 PDF
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Gravity 2 PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Driving Directions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28903 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hectorgarrofe Driving Directions ddirections allows Reflected XSS.This issue affects Driving Directions: from n/a through <= 1.4.4.
Product
Driving Directions
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Driving Directions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025WP Event Ticketing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28899 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in toddhuish WP Event Ticketing wpeventticketing allows Reflected XSS.This issue affects WP Event Ticketing: from n/a through <= 1.3.4.
Product
WP Event Ticketing
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update WP Event Ticketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Lightview Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28890 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in puzich Lightview Plus lightview-plus allows Reflected XSS.This issue affects Lightview Plus: from n/a through <= 3.1.3.
Product
Lightview Plus
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Lightview Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Custom Product Stickers for Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28889 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in starblank Custom Product Stickers for Woocommerce custom-product-stickers-for-woocommerce allows Reflected XSS.This issue affects Custom Product Stickers for Woocommerce: from n/a through <= 1.9.0.
Product
Custom Product Stickers for Woocommerce
Affected
up to 1.9.0
What to do
Affects up to 1.9.0. Update Custom Product Stickers for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.