Vulnerability database

8,915 results · page 55 of 179

• Sep 22, 2025immonex Kickstart Team: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-57925 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in immonex immonex Kickstart Team immonex-kickstart-team allows PHP Local File Inclusion.This issue affects immonex Kickstart Team: from n/a through <= 1.6.9.

  Product

  immonex Kickstart Team

  Affected

  up to 1.6.9

  What to do

  Affects up to 1.6.9. Update immonex Kickstart Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Category Featured Images Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57920 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CK MacLeod Category Featured Images Extended category-featured-images-extended allows Stored XSS.This issue affects Category Featured Images Extended: from n/a through <= 1.52.

  Product

  Category Featured Images Extended

  Affected

  up to 1.52

  What to do

  Affects up to 1.52. Update Category Featured Images Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Behance Portfolio Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57913 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.

  Product

  Behance Portfolio Manager

  Affected

  up to 1.7.5

  What to do

  Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Dialogity Free Live Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57912 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dialogity Dialogity Free Live Chat dialogity-website-chat allows Stored XSS.This issue affects Dialogity Free Live Chat: from n/a through <= 1.0.3.

  Product

  Dialogity Free Live Chat

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Dialogity Free Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Adverts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57911 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Adverts adverts-click-tracker allows DOM-Based XSS.This issue affects Adverts: from n/a through <= 1.4.

  Product

  Adverts

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Adverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025AnyClip Luminous Studio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57910 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AnyClip Video Platform AnyClip Luminous Studio anyclip-media allows Stored XSS.This issue affects AnyClip Luminous Studio: from n/a through <= 1.3.3.

  Product

  AnyClip Luminous Studio

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update AnyClip Luminous Studio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Product Time Countdown for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57908 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProWCPlugins Product Time Countdown for WooCommerce product-countdown-for-woocommerce allows Stored XSS.This issue affects Product Time Countdown for WooCommerce: from n/a through <= 1.6.5.

  Product

  Product Time Countdown for WooCommerce

  Affected

  up to 1.6.5

  What to do

  Affects up to 1.6.5. Update Product Time Countdown for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Epeken All Kurir: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57906 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in epeken Epeken All Kurir epeken-all-kurir allows Stored XSS.This issue affects Epeken All Kurir: from n/a through <= 2.0.6.

  Product

  Epeken All Kurir

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update Epeken All Kurir to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Sales Count Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57904 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-EXPERTS.IN Sales Count Manager for WooCommerce wc-sales-count-manager allows Stored XSS.This issue affects Sales Count Manager for WooCommerce: from n/a through <= 2.6.

  Product

  Sales Count Manager for WooCommerce

  Affected

  up to 2.6

  What to do

  Affects up to 2.6. Update Sales Count Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WooCommerce Additional Fees On Checkout (Free): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57903 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPSuperiors Developer WooCommerce Additional Fees On Checkout (Free) woo-additional-fees-on-checkout-wordpress allows Stored XSS.This issue affects WooCommerce Additional Fees On Checkout (Free): from n/a through <= 1.5.2.

  Product

  WooCommerce Additional Fees On Checkout (Free)

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update WooCommerce Additional Fees On Checkout (Free) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025GutenKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57900 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ataur R GutenKit gutenkit-blocks-addon allows Stored XSS.This issue affects GutenKit: from n/a through <= 2.4.2.

  Product

  GutenKit

  Affected

  up to 2.4.2

  What to do

  Affects up to 2.4.2. Update GutenKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Frontend Admin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57898 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Vega WP Frontend Admin display-admin-page-on-frontend allows Stored XSS.This issue affects WP Frontend Admin: from n/a through <= 1.22.7.

  Product

  WP Frontend Admin

  Affected

  up to 1.22.7

  What to do

  Affects up to 1.22.7. Update WP Frontend Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025DELUCKS SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53570 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Stored XSS.This issue affects DELUCKS SEO: from n/a through <= 2.7.0.

  Product

  DELUCKS SEO

  Affected

  up to 2.7.0

  What to do

  Affects up to 2.7.0. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025BMI Adult & Kid Calculator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53469 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mortgage Calculator BMI Adult & Kid Calculator bmi-adultkid-calculator allows Stored XSS.This issue affects BMI Adult & Kid Calculator: from n/a through <= 1.2.2.

  Product

  BMI Adult & Kid Calculator

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update BMI Adult & Kid Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Wp tabber widget: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-53468 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus@hotmail.com Wp tabber widget wp-tabber-widget allows SQL Injection.This issue affects Wp tabber widget: from n/a through <= 4.0.

  Product

  Wp tabber widget

  Affected

  up to 4.0

  What to do

  Affects up to 4.0. Update Wp tabber widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Login-Logout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53467 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Login-Logout login-logout allows Stored XSS.This issue affects Login-Logout: from n/a through <= 3.8.

  Product

  Login-Logout

  Affected

  up to 3.8

  What to do

  Affects up to 3.8. Update Login-Logout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Better Find and Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53466 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Better Find and Replace real-time-auto-find-and-replace allows Stored XSS.This issue affects Better Find and Replace: from n/a through <= 1.7.6.

  Product

  Better Find and Replace

  Affected

  up to 1.7.6

  What to do

  Affects up to 1.7.6. Update Better Find and Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025WP Mailto Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53464 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Online Optimisation WP Mailto Links wp-mailto-links allows Stored XSS.This issue affects WP Mailto Links: from n/a through <= 3.1.4.

  Product

  WP Mailto Links

  Affected

  up to 3.1.4

  What to do

  Affects up to 3.1.4. Update WP Mailto Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025HT Mega – Absolute Addons for WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53463 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Mega – Absolute Addons for WPBakery Page Builder ht-mega-for-wpbakery allows DOM-Based XSS.This issue affects HT Mega – Absolute Addons for WPBakery Page Builder: from n/a through <= 1.0.9.

  Product

  HT Mega – Absolute Addons for WPBakery Page Builder

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update HT Mega – Absolute Addons for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025SAPO Feed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53462 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SAPO SAPO Feed sapo-feed allows Stored XSS.This issue affects SAPO Feed: from n/a through <= 2.4.2.

  Product

  SAPO Feed

  Affected

  up to 2.4.2

  What to do

  Affects up to 2.4.2. Update SAPO Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025AffiliateWP – External Referral Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53460 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi AffiliateWP – External Referral Links affiliatewp-external-referral-links allows Stored XSS.This issue affects AffiliateWP – External Referral Links: from n/a through <= 1.2.0.

  Product

  AffiliateWP – External Referral Links

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update AffiliateWP – External Referral Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Goracash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53458 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davaxi Goracash goracash allows Stored XSS.This issue affects Goracash: from n/a through <= 1.1.

  Product

  Goracash

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Goracash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025CashBill.pl – Płatności WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53455 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CashBill CashBill.pl – Płatności WooCommerce cashbill-payment-method allows Stored XSS.This issue affects CashBill.pl – Płatności WooCommerce: from n/a through <= 3.2.1.

  Product

  CashBill.pl – Płatności WooCommerce

  Affected

  up to 3.2.1

  What to do

  Affects up to 3.2.1. Update CashBill.pl – Płatności WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Ultimate WP Mail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53454 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Stored XSS.This issue affects Ultimate WP Mail: from n/a through <= 1.3.8.

  Product

  Ultimate WP Mail

  Affected

  up to 1.3.8

  What to do

  Affects up to 1.3.8. Update Ultimate WP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Easy Pricing Table WP: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53450 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Pluginwale Easy Pricing Table WP easy-pricing-table-wp allows PHP Local File Inclusion.This issue affects Easy Pricing Table WP: from n/a through <= 1.1.3.

  Product

  Easy Pricing Table WP

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Easy Pricing Table WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 18, 2025WP Hotel Booking: Lacks proper server-side validation for review ratingsCVE-2025-8942 · WordPress plugins & themes · reported by WPScanCritical 9.1

  The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value (e.g., sending negative or out-of-range values) by intercepting and modifying requests.

  Product

  WP Hotel Booking

  Fixed in

  2.2.3

  What to do

  Update WP Hotel Booking to 2.2.3 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Sep 9, 2025ZIP Code Based Content Protection: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-59008 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PressTigers ZIP Code Based Content Protection zip-code-based-content-protection allows SQL Injection.This issue affects ZIP Code Based Content Protection: from n/a through <= 1.0.0.

  Product

  ZIP Code Based Content Protection

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update ZIP Code Based Content Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58993 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS tutor allows SQL Injection.This issue affects Tutor LMS: from n/a through <= 3.7.4.

  Product

  Tutor LMS

  Affected

  up to 3.7.4

  What to do

  Affects up to 3.7.4. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025ShopLentor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58990 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Stored XSS.This issue affects ShopLentor: from n/a through <= 3.2.0.

  Product

  ShopLentor

  Affected

  up to 3.2.0

  What to do

  Affects up to 3.2.0. Update ShopLentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Dynamic Text Field For Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58989 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silverplugins217 Dynamic Text Field For Contact Form 7 dynamic-text-field-for-contact-form-7 allows Stored XSS.This issue affects Dynamic Text Field For Contact Form 7: from n/a through <= 1.0.

  Product

  Dynamic Text Field For Contact Form 7

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Dynamic Text Field For Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025My Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58988 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Dolson My Tickets my-tickets allows Stored XSS.This issue affects My Tickets: from n/a through <= 2.0.22.

  Product

  My Tickets

  Affected

  up to 2.0.22

  What to do

  Affects up to 2.0.22. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Football Pool: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58987 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.This issue affects Football Pool: from n/a through <= 2.12.6.

  Product

  Football Pool

  Affected

  up to 2.12.6

  What to do

  Affects up to 2.12.6. Update Football Pool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Additional Custom Product Tabs for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58985 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce product-tabs-for-woocommerce allows Stored XSS.This issue affects Additional Custom Product Tabs for WooCommerce: from n/a through <= 1.7.3.

  Product

  Additional Custom Product Tabs for WooCommerce

  Affected

  up to 1.7.3

  What to do

  Affects up to 1.7.3. Update Additional Custom Product Tabs for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58984 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through <= 2.11.20.

  Product

  Welcart e-Commerce

  Affected

  up to 2.11.20

  What to do

  Affects up to 2.11.20. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Include Me: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58983 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefano Lissa Include Me include-me allows Stored XSS.This issue affects Include Me: from n/a through <= 1.3.2.

  Product

  Include Me

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update Include Me to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Pixeline's Email Protector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58982 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline Pixeline's Email Protector pixelines-email-protector allows Stored XSS.This issue affects Pixeline's Email Protector: from n/a through <= 1.3.8.

  Product

  Pixeline's Email Protector

  Affected

  up to 1.3.8

  What to do

  Affects up to 1.3.8. Update Pixeline's Email Protector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Ziston: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58215 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Ziston ziston allows PHP Local File Inclusion.This issue affects Ziston: from n/a through < 1.4.5.

  Product

  Ziston

  What to do

  Update Ziston to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Sala: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-54709 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Sala. This issue affects Sala: from n/a through 1.1.6.

  Product

  Sala

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Sala to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Blog Designer PRO: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47695 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.

  Product

  Blog Designer PRO

  Affected

  up to 3.4.7

  What to do

  Affects up to 3.4.7. Update Blog Designer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Blog Designer PRO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47694 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.

  Product

  Blog Designer PRO

  Affected

  up to 3.4.7

  What to do

  Affects up to 3.4.7. Update Blog Designer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Super Store Finder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47571 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in highwarden Super Store Finder superstorefinder-wp allows PHP Local File Inclusion.This issue affects Super Store Finder: from n/a through < 7.8.

  Product

  Super Store Finder

  What to do

  Update Super Store Finder to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025WooCommerce Photo Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47570 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews.This issue affects WooCommerce Photo Reviews: from n/a through <= 1.3.13.

  Product

  WooCommerce Photo Reviews

  Affected

  up to 1.3.13

  What to do

  Affects up to 1.3.13. Update WooCommerce Photo Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025WooCommerce Ultimate Gift Card: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47569 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPSwings WooCommerce Ultimate Gift Card woocommerce-ultimate-gift-card allows Blind SQL Injection.This issue affects WooCommerce Ultimate Gift Card: from n/a through <= 2.9.6.

  Product

  WooCommerce Ultimate Gift Card

  Affected

  up to 2.9.6

  What to do

  Affects up to 2.9.6. Update WooCommerce Ultimate Gift Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025WP SmartPay: Improper Validation of Specified Quantity in InputCVE-2025-32689 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Validation of Specified Quantity in Input vulnerability in Convers Lab WP SmartPay smartpay.This issue affects WP SmartPay: from n/a through <= 2.8.2.

  Product

  WP SmartPay

  Affected

  up to 2.8.2

  What to do

  Affects up to 2.8.2. Update WP SmartPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025WP Weixin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30875 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alexandre Froger WP Weixin wp-weixin allows Stored XSS.This issue affects WP Weixin: from n/a through <= 1.3.16.

  Product

  WP Weixin

  Affected

  up to 1.3.16

  What to do

  Affects up to 1.3.16. Update WP Weixin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2025Compress & Upload: Does not properly validate uploaded filesCVE-2025-8889 · WordPress plugins & themes · reported by WPScanLow 3.8

  The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

  Product

  Compress & Upload

  Fixed in

  1.0.5

  What to do

  Update Compress & Upload to 1.0.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 5, 2025Miraculous: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58628 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Miraculous miraculous allows Blind SQL Injection.This issue affects Miraculous: from n/a through < 2.0.9.

  Product

  Miraculous

  What to do

  Update Miraculous to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Indutri: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58214 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Indutri indutri allows PHP Local File Inclusion.This issue affects Indutri: from n/a through < 1.3.0.

  Product

  Indutri

  What to do

  Update Indutri to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025MaxCoach: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58206 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MaxCoach maxcoach allows PHP Local File Inclusion.This issue affects MaxCoach: from n/a through <= 3.2.5.

  Product

  MaxCoach

  Affected

  up to 3.2.5

  What to do

  Affects up to 3.2.5. Update MaxCoach to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025InPost Gallery: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-57889 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 InPost Gallery inpost-gallery allows PHP Local File Inclusion.This issue affects InPost Gallery: from n/a through <= 2.1.4.5.

  Product

  InPost Gallery

  Affected

  up to 2.1.4.5

  What to do

  Affects up to 2.1.4.5. Update InPost Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.