Updated 7 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

557new WordPress flaws this week

391,528entries in the database

12,390 results · page 57 of 248

Jan 22, 2026Modula Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-23976 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Stored XSS.This issue affects Modula Image Gallery: from n/a through <= 2.13.4.
Product
Modula Image Gallery
Affected
up to 2.13.4
What to do
Affects up to 2.13.4. Update Modula Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026DeepDigital: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-22469 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in mwtemplates DeepDigital deepdigital allows Code Injection.This issue affects DeepDigital: from n/a through <= 1.0.2.
Product
DeepDigital
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update DeepDigital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Form to Chat App: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22463 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Micro.company Form to Chat App form-to-chat allows Stored XSS.This issue affects Form to Chat App: from n/a through <= 1.2.5.
Product
Form to Chat App
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Form to Chat App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Owl Carousel WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22388 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu Owl Carousel WP owl-carousel-wp allows Stored XSS.This issue affects Owl Carousel WP: from n/a through <= 2.2.2.
Product
Owl Carousel WP
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Owl Carousel WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026teachPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22353 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in winkm89 teachPress teachpress allows Stored XSS.This issue affects teachPress: from n/a through <= 9.0.12.
Product
teachPress
Affected
up to 9.0.12
What to do
Affects up to 9.0.12. Update teachPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Menu In Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22349 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in linux4me2 Menu In Post menu-in-post allows DOM-Based XSS.This issue affects Menu In Post: from n/a through <= 1.4.1.
Product
Menu In Post
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Menu In Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Carousel Horizontal Posts Content Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22347 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in subhansanjaya Carousel Horizontal Posts Content Slider carousel-horizontal-posts-content-slider allows DOM-Based XSS.This issue affects Carousel Horizontal Posts Content Slider: from n/a through <= 3.3.2.
Product
Carousel Horizontal Posts Content Slider
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Carousel Horizontal Posts Content Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Grand Spa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69321 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Spa grandspa allows Reflected XSS.This issue affects Grand Spa: from n/a through <= 3.5.5.
Product
Grand Spa
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update Grand Spa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Grand Magazine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69320 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Magazine grandmagazine allows Reflected XSS.This issue affects Grand Magazine: from n/a through <= 3.5.7.
Product
Grand Magazine
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update Grand Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026JobWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69318 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hossni Mubarak JobWP jobwp allows Stored XSS.This issue affects JobWP: from n/a through <= 2.4.5.
Product
JobWP
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026CarSpot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69317 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scriptsbundle CarSpot carspot allows Reflected XSS.This issue affects CarSpot: from n/a through < 2.4.6.
Product
CarSpot
What to do
Update CarSpot to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026TableOn: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69316 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 TableOn posts-table-filterable allows Reflected XSS.This issue affects TableOn: from n/a through <= 1.0.4.2.
Product
TableOn
Affected
up to 1.0.4.2
What to do
Affects up to 1.0.4.2. Update TableOn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026WP Test Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69102 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boopathi Rajan WP Test Email wp-test-email allows Reflected XSS.This issue affects WP Test Email: from n/a through <= 1.1.7.
Product
WP Test Email
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update WP Test Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Hide My WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69098 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWave Hide My WP hide_my_wp allows Reflected XSS.This issue affects Hide My WP: from n/a through <= 6.2.12.
Product
Hide My WP
Affected
up to 6.2.12
What to do
Affects up to 6.2.12. Update Hide My WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Hotel Listing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69056 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Hotel Listing hotel-listing allows Reflected XSS.This issue affects Hotel Listing: from n/a through <= 1.4.0.
Product
Hotel Listing
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Hotel Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Super Logos Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69054 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Logos Showcase superlogoshowcase-wp allows Reflected XSS.This issue affects Super Logos Showcase: from n/a through <= 2.8.
Product
Super Logos Showcase
Affected
up to 2.8
What to do
Affects up to 2.8. Update Super Logos Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Universal Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69053 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player universal-video-player allows Reflected XSS.This issue affects Universal Video Player: from n/a through <= 3.8.4.
Product
Universal Video Player
Affected
up to 3.8.4
What to do
Affects up to 3.8.4. Update Universal Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026ListingPro Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69051 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Reflected XSS.This issue affects ListingPro Reviews: from n/a through < 2.9.11.
Product
ListingPro Reviews
What to do
Update ListingPro Reviews to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Universal Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69048 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player universal-video-player allows Reflected XSS.This issue affects Universal Video Player: from n/a through <= 3.8.4.
Product
Universal Video Player
Affected
up to 3.8.4
What to do
Affects up to 3.8.4. Update Universal Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026KenthaRadio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69003 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QantumThemes KenthaRadio qt-kentharadio allows Reflected XSS.This issue affects KenthaRadio: from n/a through <= 2.2.0.
Product
KenthaRadio
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update KenthaRadio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026JNews - Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68906 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme JNews - Video jnews-video allows Reflected XSS.This issue affects JNews - Video: from n/a through <= 11.0.2.
Product
JNews - Video
Affected
up to 11.0.2
What to do
Affects up to 11.0.2. Update JNews - Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026JNews - Frontend Submit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68904 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme JNews - Frontend Submit jnews-frontend-submit allows Reflected XSS.This issue affects JNews - Frontend Submit: from n/a through <= 11.0.0.
Product
JNews - Frontend Submit
Affected
up to 11.0.0
What to do
Affects up to 11.0.0. Update JNews - Frontend Submit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Enfold: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68900 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows DOM-Based XSS. This issue affects Enfold: from n/a through 7.1.3.
Product
Enfold
Affected
up to 7.1.3
What to do
Affects up to 7.1.3. Update Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Synergy Project Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68898 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cjjparadoxmax Synergy Project Manager synergy-project-manager allows Stored XSS.This issue affects Synergy Project Manager: from n/a through <= 1.5.
Product
Synergy Project Manager
Affected
up to 1.5
What to do
Affects up to 1.5. Update Synergy Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026ShoutOut: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68894 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shoutoutglobal ShoutOut shoutout allows Reflected XSS.This issue affects ShoutOut: from n/a through <= 4.0.2.
Product
ShoutOut
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update ShoutOut to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026WP Simple Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68884 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arevico WP Simple Redirect wp-simple-redirect allows Reflected XSS.This issue affects WP Simple Redirect: from n/a through <= 1.1.
Product
WP Simple Redirect
Affected
up to 1.1
What to do
Affects up to 1.1. Update WP Simple Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026bidorbuy Store Integrator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68883 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extremeidea bidorbuy Store Integrator bidorbuystoreintegrator allows Reflected XSS.This issue affects bidorbuy Store Integrator: from n/a through <= 2.12.0.
Product
bidorbuy Store Integrator
Affected
up to 2.12.0
What to do
Affects up to 2.12.0. Update bidorbuy Store Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Dooodl: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68871 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in noCreativity Dooodl dooodl allows Reflected XSS.This issue affects Dooodl: from n/a through <= 2.3.0.
Product
Dooodl
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Dooodl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Dinatur: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68866 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woofer696 Dinatur dinatur allows Stored XSS.This issue affects Dinatur: from n/a through <= 1.18.
Product
Dinatur
Affected
up to 1.18
What to do
Affects up to 1.18. Update Dinatur to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Infility Global: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68864 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Stored XSS.This issue affects Infility Global: from n/a through <= 2.15.11.
Product
Infility Global
Affected
up to 2.15.11
What to do
Affects up to 2.15.11. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Syntax Highlighter Compress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68859 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in agmorpheus Syntax Highlighter Compress syntax-highlighter-compress allows Reflected XSS.This issue affects Syntax Highlighter Compress: from n/a through <= 3.0.83.3.
Product
Syntax Highlighter Compress
Affected
up to 3.0.83.3
What to do
Affects up to 3.0.83.3. Update Syntax Highlighter Compress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026wpCAS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68858 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Casey Bisson wpCAS wpcas allows Reflected XSS.This issue affects wpCAS: from n/a through <= 1.07.
Product
wpCAS
Affected
up to 1.07
What to do
Affects up to 1.07. Update wpCAS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Quote Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68849 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frank Corso Quote Master quote-master allows Reflected XSS.This issue affects Quote Master: from n/a through <= 7.1.1.
Product
Quote Master
Affected
up to 7.1.1
What to do
Affects up to 7.1.1. Update Quote Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Easy Theme Options: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68839 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Remi Corson Easy Theme Options easy-theme-options allows Reflected XSS.This issue affects Easy Theme Options: from n/a through <= 1.0.
Product
Easy Theme Options
Affected
up to 1.0
What to do
Affects up to 1.0. Update Easy Theme Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026MemberPress Discord Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68838 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in expresstechsoftware MemberPress Discord Addon expresstechsoftwares-memberpress-discord-add-on allows Reflected XSS.This issue affects MemberPress Discord Addon: from n/a through <= 1.1.4.
Product
MemberPress Discord Addon
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update MemberPress Discord Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Ravpage: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68835 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matiskiba Ravpage ravpage allows Reflected XSS.This issue affects Ravpage: from n/a through <= 2.33.
Product
Ravpage
Affected
up to 2.33
What to do
Affects up to 2.33. Update Ravpage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Craft: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68538 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Craft craftcoffee allows DOM-Based XSS.This issue affects Craft: from n/a through <= 2.3.6.
Product
Craft
Affected
up to 2.3.6
What to do
Affects up to 2.3.6. Update Craft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026DotLife: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68520 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods DotLife dotlife allows Reflected XSS.This issue affects DotLife: from n/a through < 4.9.5.
Product
DotLife
What to do
Update DotLife to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Hoteller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68518 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Hoteller hoteller allows Reflected XSS.This issue affects Hoteller: from n/a through < 6.8.9.
Product
Hoteller
What to do
Update Hoteller to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Omnichannel for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68041 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codisto Omnichannel for WooCommerce codistoconnect allows Stored XSS.This issue affects Omnichannel for WooCommerce: from n/a through <= 1.3.65.
Product
Omnichannel for WooCommerce
Affected
up to 1.3.65
What to do
Affects up to 1.3.65. Update Omnichannel for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026CodeColorer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68012 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmytro Shteflyuk CodeColorer codecolorer allows Stored XSS.This issue affects CodeColorer: from n/a through <= 0.10.1.
Product
CodeColorer
Affected
up to 0.10.1
What to do
Affects up to 0.10.1. Update CodeColorer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026GLS Shipping for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68011 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GLS GLS Shipping for WooCommerce gls-shipping-for-woocommerce allows Reflected XSS.This issue affects GLS Shipping for WooCommerce: from n/a through <= 1.4.0.
Product
GLS Shipping for WooCommerce
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update GLS Shipping for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Netgsm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68010 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in netgsm Netgsm netgsm allows Reflected XSS.This issue affects Netgsm: from n/a through <= 2.9.63.
Product
Netgsm
Affected
up to 2.9.63
What to do
Affects up to 2.9.63. Update Netgsm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026WP Mail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68008 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 WP Mail wp-mail allows Reflected XSS.This issue affects WP Mail: from n/a through <= 1.3.
Product
WP Mail
Affected
up to 1.3
What to do
Affects up to 1.3. Update WP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026My Post Order: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68004 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kapil Chugh My Post Order my-posts-order allows Reflected XSS.This issue affects My Post Order: from n/a through <= 1.2.1.1.
Product
My Post Order
Affected
up to 1.2.1.1
What to do
Affects up to 1.2.1.1. Update My Post Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Homey Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67964 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey Core homey-core allows Reflected XSS.This issue affects Homey Core: from n/a through <= 2.4.3.
Product
Homey Core
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update Homey Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026WorkScout-Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67960 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affects WorkScout-Core: from n/a through <= 1.7.06.
Product
WorkScout-Core
Affected
up to 1.7.06
What to do
Affects up to 1.7.06. Update WorkScout-Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026WorkScout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67959 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout workscout allows Reflected XSS.This issue affects WorkScout: from n/a through <= 4.1.07.
Product
WorkScout
Affected
up to 4.1.07
What to do
Affects up to 4.1.07. Update WorkScout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Grand Tour: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67952 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Tour grandtour allows Reflected XSS.This issue affects Grand Tour: from n/a through < 5.6.2.
Product
Grand Tour
What to do
Update Grand Tour to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Hostiko: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67949 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designingmedia Hostiko hostiko allows Reflected XSS.This issue affects Hostiko: from n/a through < 94.3.6.
Product
Hostiko
What to do
Update Hostiko to the newest version.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.