Updated 28 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

578new WordPress flaws this week

391,397entries in the database

6,572 results · page 57 of 132

Apr 1, 2025News, Magazine and Blog Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31740 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aThemeArt News, Magazine and Blog Elements news-magazine-and-blog-elements allows Stored XSS.This issue affects News, Magazine and Blog Elements: from n/a through <= 1.3.
Product
News, Magazine and Blog Elements
Affected
up to 1.3
What to do
Affects up to 1.3. Update News, Magazine and Blog Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025LeadQuizzes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31738 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yazamodeveloper LeadQuizzes leadquizzes allows Stored XSS.This issue affects LeadQuizzes: from n/a through <= 1.1.0.
Product
LeadQuizzes
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update LeadQuizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Client Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31737 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dxladner Client Showcase client-showcase allows Stored XSS.This issue affects Client Showcase: from n/a through <= 1.2.0.
Product
Client Showcase
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Client Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Footnotes for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31735 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in C. Johnson Footnotes for WordPress footnotes-for-wordpress allows Stored XSS.This issue affects Footnotes for WordPress: from n/a through <= 2016.1230.
Product
Footnotes for
Affected
up to 2016.1230
What to do
Affects up to 2016.1230. Update Footnotes for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Simple Post Expiration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31734 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Simple Post Expiration simple-post-expiration allows DOM-Based XSS.This issue affects Simple Post Expiration: from n/a through <= 1.0.1.
Product
Simple Post Expiration
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Simple Post Expiration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025WP Sitemap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31733 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boot Div WP Sitemap wpsitemap allows Stored XSS.This issue affects WP Sitemap: from n/a through <= 1.0.0.
Product
WP Sitemap
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Author Bio Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31731 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Philip John Author Bio Shortcode author-bio-shortcode allows Stored XSS.This issue affects Author Bio Shortcode: from n/a through <= 2.5.3.
Product
Author Bio Shortcode
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Author Bio Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Marketer Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31730 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DigitalCourt Marketer Addons marketer-addons allows Stored XSS.This issue affects Marketer Addons: from n/a through <= 1.0.1.
Product
Marketer Addons
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Marketer Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Bridge Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31409 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Bridge Core allows Stored XSS. This issue affects Bridge Core: from n/a through n/a.
Product
Bridge Core
What to do
Update Bridge Core to the newest version.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Primer MyData for Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30924 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in primersoftware Primer MyData for Woocommerce primer-mydata allows Reflected XSS.This issue affects Primer MyData for Woocommerce: from n/a through < 4.2.4.
Product
Primer MyData for Woocommerce
What to do
Update Primer MyData for Woocommerce to the newest version.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025SKU Generator for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30917 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham SKU Generator for WooCommerce sku-for-woocommerce allows Reflected XSS.This issue affects SKU Generator for WooCommerce: from n/a through <= 1.6.2.
Product
SKU Generator for WooCommerce
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update SKU Generator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025AEC Kiosque: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30902 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ATL Software SRL AEC Kiosque aec-kiosque allows Reflected XSS.This issue affects AEC Kiosque: from n/a through <= 1.9.3.
Product
AEC Kiosque
Affected
up to 1.9.3
What to do
Affects up to 1.9.3. Update AEC Kiosque to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Image Wall: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30869 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Parakoos Image Wall image-wall allows Reflected XSS.This issue affects Image Wall: from n/a through <= 3.0.
Product
Image Wall
Affected
up to 3.0
What to do
Affects up to 3.0. Update Image Wall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Hostel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30848 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects Hostel: from n/a through <= 1.1.5.
Product
Hostel
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Hostel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025xili-dictionary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30840 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-dictionary xili-dictionary allows Reflected XSS.This issue affects xili-dictionary: from n/a through <= 2.12.5.
Product
xili-dictionary
Affected
up to 2.12.5
What to do
Affects up to 2.12.5. Update xili-dictionary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025WooCommerce Fattureincloud: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30837 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristiano Zanca WooCommerce Fattureincloud woo-fattureincloud allows Reflected XSS.This issue affects WooCommerce Fattureincloud: from n/a through <= 2.6.7.
Product
WooCommerce Fattureincloud
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update WooCommerce Fattureincloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025WP2LEADS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30827 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through <= 3.4.5.
Product
WP2LEADS
Affected
up to 3.4.5
What to do
Affects up to 3.4.5. Update WP2LEADS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025About Author: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30808 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weblizar - WordPress Themes & Plugin About Author about-author allows Reflected XSS.This issue affects About Author: from n/a through <= 1.6.2.
Product
About Author
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update About Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Better WishList API: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30798 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rickonline_nl Better WishList API better-wlm-api allows Reflected XSS.This issue affects Better WishList API: from n/a through <= 1.1.4.
Product
Better WishList API
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Better WishList API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025The Ultimate WordPress Toolkit – WP Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30796 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Reflected XSS.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through <= 3.0.14.
Product
The Ultimate WordPress Toolkit – WP Extended
Affected
up to 3.0.14
What to do
Affects up to 3.0.14. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Event Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30794 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP Event Tickets event-tickets allows Reflected XSS.This issue affects Event Tickets: from n/a through <= 5.20.0.
Product
Event Tickets
Affected
up to 5.20.0
What to do
Affects up to 5.20.0. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Google Font Fix: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30614 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Haozhe Xie Google Font Fix google-font-fix allows Reflected XSS.This issue affects Google Font Fix: from n/a through <= 2.3.1.
Product
Google Font Fix
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Google Font Fix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Nmedia MailChimp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30613 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N-Media Nmedia MailChimp nmedia-mailchimp-widget allows Stored XSS.This issue affects Nmedia MailChimp: from n/a through <= 5.4.
Product
Nmedia MailChimp
Affected
up to 5.4
What to do
Affects up to 5.4. Update Nmedia MailChimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Quick Localization: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30607 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Name.ly Quick Localization quick-localization allows Reflected XSS.This issue affects Quick Localization: from n/a through <= 0.1.0.
Product
Quick Localization
Affected
up to 0.1.0
What to do
Affects up to 0.1.0. Update Quick Localization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Pesapal Gateway for Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30579 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jakeii Pesapal Gateway for Woocommerce pesapal-for-woocommerce allows Reflected XSS.This issue affects Pesapal Gateway for Woocommerce: from n/a through <= 2.1.0.
Product
Pesapal Gateway for Woocommerce
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Pesapal Gateway for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Tidekey: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30563 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in makong Tidekey tidekey allows Reflected XSS.This issue affects Tidekey: from n/a through <= 1.1.
Product
Tidekey
Affected
up to 1.1
What to do
Affects up to 1.1. Update Tidekey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Kento WordPress Stats: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30559 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Kento WordPress Stats kento-wp-stats allows Stored XSS.This issue affects Kento WordPress Stats: from n/a through <= 1.1.
Product
Kento WordPress Stats
Affected
up to 1.1
What to do
Affects up to 1.1. Update Kento WordPress Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Advanced Post Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30548 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VarDump s.r.l. Advanced Post Search advanced-post-search allows Reflected XSS.This issue affects Advanced Post Search: from n/a through <= 1.1.0.
Product
Advanced Post Search
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Advanced Post Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025WP Cards: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30547 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Tufts WP Cards wp-cards allows Reflected XSS.This issue affects WP Cards: from n/a through <= 1.5.1.
Product
WP Cards
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update WP Cards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025OK Poster Group: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30544 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in svmidi OK Poster Group ok-poster-group allows Reflected XSS.This issue affects OK Poster Group: from n/a through <= 1.1.
Product
OK Poster Group
Affected
up to 1.1
What to do
Affects up to 1.1. Update OK Poster Group to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Breezing Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30520 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crosstec Breezing Forms breezing-forms allows Reflected XSS.This issue affects Breezing Forms: from n/a through <= 1.2.8.11.
Product
Breezing Forms
Affected
up to 1.2.8.11
What to do
Affects up to 1.2.8.11. Update Breezing Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Infusionsoft Web Form JavaScript: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31629 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob Allred Infusionsoft Web Form JavaScript infusionsoft-web-form-javascript allows Stored XSS.This issue affects Infusionsoft Web Form JavaScript: from n/a through <= 1.1.1.
Product
Infusionsoft Web Form JavaScript
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Infusionsoft Web Form JavaScript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Media LIbrary Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31627 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through <= 3.24.
Product
Media LIbrary Assistant
Affected
up to 3.24
What to do
Affects up to 3.24. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Useinfluence: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31625 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ramanparashar Useinfluence useinfluence allows Stored XSS.This issue affects Useinfluence: from n/a through <= 1.0.8.
Product
Useinfluence
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Useinfluence to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Processing Projects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31624 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LABCAT Processing Projects processing-projects allows DOM-Based XSS.This issue affects Processing Projects: from n/a through <= 1.0.2.
Product
Processing Projects
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Processing Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025byBrick Accordion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31621 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davidpaulsson byBrick Accordion bybrick-accordion allows Stored XSS.This issue affects byBrick Accordion: from n/a through <= 1.0.
Product
byBrick Accordion
Affected
up to 1.0
What to do
Affects up to 1.0. Update byBrick Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025CoverManager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31620 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in carperfer CoverManager covermanager allows Stored XSS.This issue affects CoverManager: from n/a through <= 0.0.1.
Product
CoverManager
Affected
up to 0.0.1
What to do
Affects up to 0.0.1. Update CoverManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Simple Contact Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31615 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in owenr88 Simple Contact Forms simple-contact-forms allows Stored XSS.This issue affects Simple Contact Forms: from n/a through <= 1.6.4.
Product
Simple Contact Forms
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Simple Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Terms Before Download: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31614 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hiroprot Terms Before Download terms-before-download allows Stored XSS.This issue affects Terms Before Download: from n/a through <= 1.0.5.
Product
Terms Before Download
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Terms Before Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31610 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gingerplugins Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme gp-notification-bar allows Stored XSS.This issue affects Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme: from n/a through <= 1.1.
Product
Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any
Affected
up to 1.1
What to do
Affects up to 1.1. Update Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025CookieHint WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31608 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reDim GmbH CookieHint WP cookiehint-wp allows Stored XSS.This issue affects CookieHint WP: from n/a through <= 1.0.0.
Product
CookieHint WP
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update CookieHint WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Simple-Audioplayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31607 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flomei Simple-Audioplayer simple-audioplayer allows Stored XSS.This issue affects Simple-Audioplayer: from n/a through <= 1.1.
Product
Simple-Audioplayer
Affected
up to 1.1
What to do
Affects up to 1.1. Update Simple-Audioplayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Welcome Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31605 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WeblineIndia Welcome Popup welcome-popup allows Stored XSS.This issue affects Welcome Popup: from n/a through <= 1.0.10.
Product
Welcome Popup
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update Welcome Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Cal.com: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-31604 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cal.com Cal.com cal-com allows Stored XSS.This issue affects Cal.com: from n/a through <= 1.0.0.
Product
Cal.com
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Cal.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Quantity Dynamic Pricing & Bulk Discounts for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31598 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Quantity Dynamic Pricing & Bulk Discounts for WooCommerce wholesale-pricing-woocommerce allows Stored XSS.This issue affects Quantity Dynamic Pricing & Bulk Discounts for WooCommerce: from n/a through <= 4.0.3.
Product
Quantity Dynamic Pricing & Bulk Discounts for WooCommerce
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update Quantity Dynamic Pricing & Bulk Discounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Ultimate Live Cricket WordPress Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31597 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crazycric Ultimate Live Cricket WordPress Lite ultimate-live-cricket-lite allows Stored XSS.This issue affects Ultimate Live Cricket WordPress Lite: from n/a through <= 1.4.2.
Product
Ultimate Live Cricket WordPress Lite
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Ultimate Live Cricket WordPress Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Timeline Event History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31595 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Timeline Event History timeline-event-history allows Stored XSS.This issue affects Timeline Event History: from n/a through <= 3.2.
Product
Timeline Event History
Affected
up to 3.2
What to do
Affects up to 3.2. Update Timeline Event History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025OpenMenu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31593 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OpenMenu OpenMenu allows Stored XSS. This issue affects OpenMenu: from n/a through 3.5.
Product
OpenMenu
Affected
up to 3.5
What to do
Affects up to 3.5. Update OpenMenu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Send E-mail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31592 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo Melchiorre Send E-mail send-e-mail allows Stored XSS.This issue affects Send E-mail: from n/a through <= 1.3.
Product
Send E-mail
Affected
up to 1.3
What to do
Affects up to 1.3. Update Send E-mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Exit Popup Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31591 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in promoz73 Exit Popup Free exit-popup-free allows Stored XSS.This issue affects Exit Popup Free: from n/a through <= 1.0.
Product
Exit Popup Free
Affected
up to 1.0
What to do
Affects up to 1.0. Update Exit Popup Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.