Vulnerability database

5,853 results · page 57 of 118

• Mar 26, 2025Theme Demo Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25134 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zenverse Theme Demo Bar wordpress-theme-demo-bar allows Reflected XSS.This issue affects Theme Demo Bar: from n/a through <= 1.6.3.

  Product

  Theme Demo Bar

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update Theme Demo Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Google Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23964 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ajitae Google Plus google-plus-google allows Reflected XSS.This issue affects Google Plus: from n/a through <= 1.0.2.

  Product

  Google Plus

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Google Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Infugrator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23735 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cosmin Schiopu Infugrator infugrator allows Reflected XSS.This issue affects Infugrator: from n/a through <= 1.0.3.

  Product

  Infugrator

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Infugrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025AuMenu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23728 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in atelierhyper AuMenu aumenu allows Reflected XSS.This issue affects AuMenu: from n/a through <= 1.1.5.

  Product

  AuMenu

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update AuMenu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025AppReview: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23714 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in podspod AppReview appreview allows Reflected XSS.This issue affects AppReview: from n/a through <= 0.2.9.

  Product

  AppReview

  Affected

  up to 0.2.9

  What to do

  Affects up to 0.2.9. Update AppReview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Your Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23704 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Reuven Karasik Your Lightbox your-lightbox allows Reflected XSS.This issue affects Your Lightbox: from n/a through <= 1.0.

  Product

  Your Lightbox

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Your Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Narnoo Operator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23680 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Narnoo Narnoo Operator narnoo-shortcodes allows Reflected XSS.This issue affects Narnoo Operator: from n/a through <= 2.0.0.

  Product

  Narnoo Operator

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Narnoo Operator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Management-screen-droptiles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23666 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cxc-sawa Management-screen-droptiles cxc-sawa allows Reflected XSS.This issue affects Management-screen-droptiles: from n/a through <= 1.0.

  Product

  Management-screen-droptiles

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Management-screen-droptiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Frontend Post Submission: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23638 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Umesh Ghimire Frontend Post Submission frontend-post-submission allows Reflected XSS.This issue affects Frontend Post Submission: from n/a through <= 1.0.

  Product

  Frontend Post Submission

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Frontend Post Submission to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025WP Database Audit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23633 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khanhtruong WP Database Audit database-audit allows Reflected XSS.This issue affects WP Database Audit: from n/a through <= 1.0.

  Product

  WP Database Audit

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP Database Audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025CG Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23632 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rhizome Networks CG Button content-glass-button allows Reflected XSS.This issue affects CG Button: from n/a through <= 1.0.5.6.

  Product

  CG Button

  Affected

  up to 1.0.5.6

  What to do

  Affects up to 1.0.5.6. Update CG Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Pixobe Cartography: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23612 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixobe Pixobe Cartography pixobe-cartography allows Reflected XSS.This issue affects Pixobe Cartography: from n/a through <= 1.0.1.

  Product

  Pixobe Cartography

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Pixobe Cartography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025RDP inGroups+: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23546 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert D Payne RDP inGroups+ rdp-ingroups allows Reflected XSS.This issue affects RDP inGroups+: from n/a through <= 1.0.6.

  Product

  RDP inGroups+

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update RDP inGroups+ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025FOMO Pay Chinese Payment Solution: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23543 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fomopay FOMO Pay Chinese Payment Solution fomo-payment-gateway-for-woocommerce allows Reflected XSS.This issue affects FOMO Pay Chinese Payment Solution: from n/a through <= 2.0.4.

  Product

  FOMO Pay Chinese Payment Solution

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update FOMO Pay Chinese Payment Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025RDP Linkedin Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23542 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert D Payne RDP Linkedin Login rdp-linkedin-login allows Reflected XSS.This issue affects RDP Linkedin Login: from n/a through <= 1.7.0.

  Product

  RDP Linkedin Login

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update RDP Linkedin Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Site Editor Google Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23466 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsiteeditor Site Editor Google Map site-editor-google-map allows Reflected XSS.This issue affects Site Editor Google Map: from n/a through <= 1.0.1.

  Product

  Site Editor Google Map

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Site Editor Google Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025RWS Enquiry And Lead Follow-up: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23460 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rhizomaticweb RWS Enquiry And Lead Follow-up rws-enquiry allows Reflected XSS.This issue affects RWS Enquiry And Lead Follow-up: from n/a through <= 1.0.

  Product

  RWS Enquiry And Lead Follow-up

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update RWS Enquiry And Lead Follow-up to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025NS Simple Intro Loader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23459 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NsThemes NS Simple Intro Loader ns-simple-intro-loader allows Reflected XSS.This issue affects NS Simple Intro Loader: from n/a through <= 2.2.3.

  Product

  NS Simple Intro Loader

  Affected

  up to 2.2.3

  What to do

  Affects up to 2.2.3. Update NS Simple Intro Loader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025GetSocial: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22283 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Riyaz GetSocial getsocial allows Reflected XSS.This issue affects GetSocial: from n/a through <= 2.0.1.

  Product

  GetSocial

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update GetSocial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 25, 2025Gallery for Social Photo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26742 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery for Social Photo feed-instagram-lite allows Stored XSS.This issue affects Gallery for Social Photo: from n/a through <= 1.0.0.35.

  Product

  Gallery for Social Photo

  Affected

  up to 1.0.0.35

  What to do

  Affects up to 1.0.0.35. Update Gallery for Social Photo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025wA11y – The Web Accessibility Toolbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30623 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry wA11y – The Web Accessibility Toolbox wa11y allows Stored XSS.This issue affects wA11y – The Web Accessibility Toolbox: from n/a through <= 1.0.3.

  Product

  wA11y – The Web Accessibility Toolbox

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update wA11y – The Web Accessibility Toolbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WP Social Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30610 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through <= 2.2.7.

  Product

  WP Social Widget

  Affected

  up to 2.2.7

  What to do

  Affects up to 2.2.7. Update WP Social Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Easy Page Transition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30606 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Logan Carlile Easy Page Transition easy-page-transition allows Stored XSS.This issue affects Easy Page Transition: from n/a through <= 1.0.1.

  Product

  Easy Page Transition

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Easy Page Transition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Related Posts via Categories: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30602 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alphasis Related Posts via Categories related-posts-via-categories allows Stored XSS.This issue affects Related Posts via Categories: from n/a through <= 2.1.2.

  Product

  Related Posts via Categories

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Related Posts via Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Flipdish Ordering System: Cross-Site Request Forgery (CSRF)CVE-2025-30601 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in flipdish Flipdish Ordering System flipdish-ordering-system allows Cross Site Request Forgery.This issue affects Flipdish Ordering System: from n/a through <= 1.5.2.

  Product

  Flipdish Ordering System

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update Flipdish Ordering System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WP Hotjar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30600 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thiagogsrwp WP Hotjar wp-hotjar allows Stored XSS.This issue affects WP Hotjar: from n/a through <= 0.0.3.

  Product

  WP Hotjar

  Affected

  up to 0.0.3

  What to do

  Affects up to 0.0.3. Update WP Hotjar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WP Parallax Content Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30599 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp-maverick WP Parallax Content Slider wp-parallax-content-slider allows Stored XSS.This issue affects WP Parallax Content Slider: from n/a through <= 0.9.8.

  Product

  WP Parallax Content Slider

  Affected

  up to 0.9.8

  What to do

  Affects up to 0.9.8. Update WP Parallax Content Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025IG Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30597 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iografica IG Shortcodes ig-shortcodes allows DOM-Based XSS.This issue affects IG Shortcodes: from n/a through <= 3.1.

  Product

  IG Shortcodes

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update IG Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025include-file: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30595 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tstafford include-file include-file allows Stored XSS.This issue affects include-file: from n/a through <= 1.

  Product

  include-file

  Affected

  up to 1

  What to do

  Affects up to 1. Update include-file to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Include URL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30593 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in samsk Include URL include-url allows Stored XSS.This issue affects Include URL: from n/a through <= 0.3.5.

  Product

  Include URL

  Affected

  up to 0.3.5

  What to do

  Affects up to 0.3.5. Update Include URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Login Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30575 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly Login Redirect login-redirect allows Stored XSS.This issue affects Login Redirect: from n/a through <= 1.0.5.

  Product

  Login Redirect

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Mobile Navigation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30574 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jenst Mobile Navigation mobile-navigation allows Stored XSS.This issue affects Mobile Navigation: from n/a through <= 1.5.

  Product

  Mobile Navigation

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Mobile Navigation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025My Default Post Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30573 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mrdenny My Default Post Content my-default-post-content allows Stored XSS.This issue affects My Default Post Content: from n/a through <= 0.7.3.

  Product

  My Default Post Content

  Affected

  up to 0.7.3

  What to do

  Affects up to 0.7.3. Update My Default Post Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Clink: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30566 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aryan Themes Clink clink allows DOM-Based XSS.This issue affects Clink: from n/a through <= 1.2.2.

  Product

  Clink

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Clink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025GMO Font Agent: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30553 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Z.com byGMO GMO Font Agent gmo-font-agent allows Stored XSS.This issue affects GMO Font Agent: from n/a through <= 1.6.

  Product

  GMO Font Agent

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update GMO Font Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Pretty file links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30551 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartredfox Pretty file links pretty-file-links allows Stored XSS.This issue affects Pretty file links: from n/a through <= 0.9.

  Product

  Pretty file links

  Affected

  up to 0.9

  What to do

  Affects up to 0.9. Update Pretty file links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025issuuPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30545 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline issuuPress issuupress allows Stored XSS.This issue affects issuuPress: from n/a through <= 1.3.2.

  Product

  issuuPress

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update issuuPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025AvaiBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30540 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in avaibook AvaiBook avaibook allows Stored XSS.This issue affects AvaiBook: from n/a through <= 1.2.

  Product

  AvaiBook

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update AvaiBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025BMo Expo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30539 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benedikt Mo BMo Expo bmo-expo allows Stored XSS.This issue affects BMo Expo: from n/a through <= 1.0.15.

  Product

  BMo Expo

  Affected

  up to 1.0.15

  What to do

  Affects up to 1.0.15. Update BMo Expo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Upload Quota per User: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30537 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristian Sarov Upload Quota per User upload-quota-per-user allows Stored XSS.This issue affects Upload Quota per User: from n/a through <= 1.3.

  Product

  Upload Quota per User

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Upload Quota per User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Beautiful Link Preview: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30536 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zeitwesentech Beautiful Link Preview beautiful-link-preview allows Stored XSS.This issue affects Beautiful Link Preview: from n/a through <= 1.5.0.

  Product

  Beautiful Link Preview

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update Beautiful Link Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Message ticker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30533 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Message ticker message-ticker allows Stored XSS.This issue affects Message ticker: from n/a through <= 9.3.

  Product

  Message ticker

  Affected

  up to 9.3

  What to do

  Affects up to 9.3. Update Message ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Weather Layer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30532 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MorganF Weather Layer weather-layer allows Stored XSS.This issue affects Weather Layer: from n/a through <= 4.2.1.

  Product

  Weather Layer

  Affected

  up to 4.2.1

  What to do

  Affects up to 4.2.1. Update Weather Layer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025AI Preloader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30530 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atikul AI Preloader ai-preloader allows Stored XSS.This issue affects AI Preloader: from n/a through <= 1.0.2.

  Product

  AI Preloader

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update AI Preloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025My Bootstrap Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30527 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetoolbox My Bootstrap Menu my-bootstrap-menu allows Stored XSS.This issue affects My Bootstrap Menu: from n/a through <= 1.2.1.

  Product

  My Bootstrap Menu

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update My Bootstrap Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025PrivateContent: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26972 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5.

  Product

  PrivateContent

  Affected

  up to 8.11.5

  What to do

  Affects up to 8.11.5. Update PrivateContent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025m1.DownloadList: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26895 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maennchen1.de m1.DownloadList m1downloadlist allows DOM-Based XSS.This issue affects m1.DownloadList: from n/a through <= 0.19.

  Product

  m1.DownloadList

  Affected

  up to 0.19

  What to do

  Affects up to 0.19. Update m1.DownloadList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025WP AntiDDOS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26556 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zzmaster WP AntiDDOS wpantiddos allows Reflected XSS.This issue affects WP AntiDDOS: from n/a through <= 2.0.

  Product

  WP AntiDDOS

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update WP AntiDDOS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025Debug-Bar-Extender: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26555 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thorsten Ott Debug-Bar-Extender debug-bar-extender allows Reflected XSS.This issue affects Debug-Bar-Extender: from n/a through <= 0.5.

  Product

  Debug-Bar-Extender

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update Debug-Bar-Extender to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 15, 2025WP Discord Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26554 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicola Mustone WP Discord Post wp-discord-post allows Reflected XSS.This issue affects WP Discord Post: from n/a through <= 2.1.0.

  Product

  WP Discord Post

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update WP Discord Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.