Vulnerability database

5,857 results · page 57 of 118

• Mar 11, 2025Custom top bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28895 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suman Biswas Custom top bar custom-top-bar allows Stored XSS.This issue affects Custom top bar: from n/a through <= 2.1.

  Product

  Custom top bar

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Custom top bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025Bee Layer Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28879 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aumsrini Bee Layer Slider bee-layer-slider allows Stored XSS.This issue affects Bee Layer Slider: from n/a through <= 1.1.

  Product

  Bee Layer Slider

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Bee Layer Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025Awesome Surveys: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28878 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Will Brubaker Awesome Surveys awesome-surveys allows Stored XSS.This issue affects Awesome Surveys: from n/a through <= 2.0.10.

  Product

  Awesome Surveys

  Affected

  up to 2.0.10

  What to do

  Affects up to 2.0.10. Update Awesome Surveys to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025BP Email Assign Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28875 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Stored XSS.This issue affects BP Email Assign Templates: from n/a through <= 1.6.

  Product

  BP Email Assign Templates

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update BP Email Assign Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025Block Spam By Math Reloaded: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28871 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Stored XSS.This issue affects Block Spam By Math Reloaded: from n/a through <= 2.2.4.

  Product

  Block Spam By Math Reloaded

  Affected

  up to 2.2.4

  What to do

  Affects up to 2.2.4. Update Block Spam By Math Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 11, 2025amoCRM WebForm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28870 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in amocrm amoCRM WebForm amocrm-webform allows DOM-Based XSS.This issue affects amoCRM WebForm: from n/a through <= 1.1.

  Product

  amoCRM WebForm

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update amoCRM WebForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Flashfader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27279 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lynk Flashfader flashfader allows Reflected XSS.This issue affects Flashfader: from n/a through <= 1.1.1.

  Product

  Flashfader

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Flashfader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025AcuGIS Leaflet Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27278 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Ghedini AcuGIS Leaflet Maps mapfig-premium-leaflet-map-maker allows Reflected XSS.This issue affects AcuGIS Leaflet Maps: from n/a through <= 5.1.1.0.

  Product

  AcuGIS Leaflet Maps

  Affected

  up to 5.1.1.0

  What to do

  Affects up to 5.1.1.0. Update AcuGIS Leaflet Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WOO Codice Fiscale: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27275 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andrew_fisher WOO Codice Fiscale woo-codice-fiscale allows Reflected XSS.This issue affects WOO Codice Fiscale: from n/a through <= 1.6.3.

  Product

  WOO Codice Fiscale

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update WOO Codice Fiscale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Affiliate Links Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27273 · WordPress plugins & themes · reported by PatchstackMedium 5.8

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in winking Affiliate Links Manager affiliate-links-manager allows Reflected XSS.This issue affects Affiliate Links Manager: from n/a through <= 1.0.

  Product

  Affiliate Links Manager

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Affiliate Links Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025DB Tables Import/Export: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27271 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alberto Cocchiara DB Tables Import/Export db-tables-importexport allows Reflected XSS.This issue affects DB Tables Import/Export: from n/a through <= 1.0.1.

  Product

  DB Tables Import/Export

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update DB Tables Import/Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025.htaccess Login block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27269 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anton Aleksandrov .htaccess Login block htaccess-login-block allows Reflected XSS.This issue affects .htaccess Login block: from n/a through <= 0.9a.

  Product

  .htaccess Login block

  Affected

  up to 0.9a

  What to do

  Affects up to 0.9a. Update .htaccess Login block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Zigaform – Price Calculator & Cost Estimation Form Builder Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26994 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in softdiscover Zigaform – Price Calculator & Cost Estimation Form Builder Lite zigaform-calculator-cost-estimation-form-builder-lite allows Stored XSS.This issue affects Zigaform – Price Calculator & Cost Estimation Form Builder Lite: from n/a through <= 7.4.2.

  Product

  Zigaform – Price Calculator & Cost Estimation Form Builder Lite

  Affected

  up to 7.4.2

  What to do

  Affects up to 7.4.2. Update Zigaform – Price Calculator & Cost Estimation Form Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Zigaform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26989 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in softdiscover Zigaform zigaform-form-builder-lite allows Stored XSS.This issue affects Zigaform: from n/a through <= 7.4.2.

  Product

  Zigaform

  Affected

  up to 7.4.2

  What to do

  Affects up to 7.4.2. Update Zigaform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025SMS Alert Order Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26984 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Reflected XSS.This issue affects SMS Alert Order Notifications: from n/a through <= 3.7.8.

  Product

  SMS Alert Order Notifications

  Affected

  up to 3.7.8

  What to do

  Affects up to 3.7.8. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Small Package Quotes – Unishippers Edition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26918 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows Reflected XSS.This issue affects Small Package Quotes – Unishippers Edition: from n/a through <= 2.4.9.

  Product

  Small Package Quotes – Unishippers Edition

  Affected

  up to 2.4.9

  What to do

  Affects up to 2.4.9. Update Small Package Quotes – Unishippers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Templata: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26917 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes WP Templata wptemplata allows Reflected XSS.This issue affects WP Templata: from n/a through <= 1.0.7.

  Product

  WP Templata

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update WP Templata to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Variable Inspector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26914 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bowo Variable Inspector variable-inspector allows Reflected XSS.This issue affects Variable Inspector: from n/a through <= 2.6.2.

  Product

  Variable Inspector

  Affected

  up to 2.6.2

  What to do

  Affects up to 2.6.2. Update Variable Inspector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025s2Member: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26879 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristián Lávaque s2Member s2member allows Reflected XSS.This issue affects s2Member: from n/a through <= 241216.

  Product

  s2Member

  Affected

  up to 241216

  What to do

  Affects up to 241216. Update s2Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025IE CSS3 Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26589 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristopher Dino IE CSS3 Support ie-css3-support allows Reflected XSS.This issue affects IE CSS3 Support: from n/a through <= 2.0.1.

  Product

  IE CSS3 Support

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update IE CSS3 Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025TTT Crop: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26588 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gabrielperezs TTT Crop ttt-crop allows Reflected XSS.This issue affects TTT Crop: from n/a through <= 1.0.

  Product

  TTT Crop

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update TTT Crop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025sidebarTabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26587 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nghorta sidebarTabs sidebartabs allows Reflected XSS.This issue affects sidebarTabs: from n/a through <= 3.1.

  Product

  sidebarTabs

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update sidebarTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Events Planner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26586 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in abelony Events Planner events-planner allows Reflected XSS.This issue affects Events Planner: from n/a through <= 1.3.10.

  Product

  Events Planner

  Affected

  up to 1.3.10

  What to do

  Affects up to 1.3.10. Update Events Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025DL Leadback: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26585 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DyadyaLesha DL Leadback dl-leadback allows Reflected XSS.This issue affects DL Leadback: from n/a through <= 1.2.1.

  Product

  DL Leadback

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update DL Leadback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Mobile: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26563 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muneeb Mobile rocket-wp-mobile allows Reflected XSS.This issue affects Mobile: from n/a through <= 1.3.3.

  Product

  Mobile

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update Mobile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025ViperBar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26557 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in viperchill ViperBar viperbar allows Reflected XSS.This issue affects ViperBar: from n/a through <= 2.0.

  Product

  ViperBar

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update ViperBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Migrate Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25170 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DotsquaresLtd Migrate Posts migrate-post allows Reflected XSS.This issue affects Migrate Posts: from n/a through <= 1.0.

  Product

  Migrate Posts

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Migrate Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Authors Autocomplete Meta Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25169 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry Authors Autocomplete Meta Box authors-autocomplete-meta-box allows Reflected XSS.This issue affects Authors Autocomplete Meta Box: from n/a through <= 1.2.

  Product

  Authors Autocomplete Meta Box

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Authors Autocomplete Meta Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Staff Directory Plugin: Company Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25165 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in richardgabriel Staff Directory Plugin: Company Directory staff-directory-pro allows Stored XSS.This issue affects Staff Directory Plugin: Company Directory: from n/a through <= 4.3.

  Product

  Staff Directory Plugin: Company Directory

  Affected

  up to 4.3

  What to do

  Affects up to 4.3. Update Staff Directory Plugin: Company Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Meta Accelerator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25164 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yuichiro ABE Meta Accelerator meta-accelerator allows Reflected XSS.This issue affects Meta Accelerator: from n/a through <= 1.0.4.

  Product

  Meta Accelerator

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Meta Accelerator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Find Your Nearest: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25161 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SocialEvolution WP Find Your Nearest wp-find-your-nearest allows Reflected XSS.This issue affects WP Find Your Nearest: from n/a through <= 0.3.1.

  Product

  WP Find Your Nearest

  Affected

  up to 0.3.1

  What to do

  Affects up to 0.3.1. Update WP Find Your Nearest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Uncomplicated SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25158 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Antonio Sanchez Uncomplicated SEO uncomplicated-seo allows Reflected XSS.This issue affects Uncomplicated SEO: from n/a through <= 1.2.

  Product

  Uncomplicated SEO

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Uncomplicated SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Church Center: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25157 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpchurchteam WP Church Center wp-church-center allows Reflected XSS.This issue affects WP Church Center: from n/a through <= 1.3.3.

  Product

  WP Church Center

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update WP Church Center to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Less Compiler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25142 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Jake Group WP Less Compiler wp-less-compiler allows Stored XSS.This issue affects WP Less Compiler: from n/a through <= 1.3.0.

  Product

  WP Less Compiler

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update WP Less Compiler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Frontend Submit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25133 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in newbiesup WP Frontend Submit wp-frontend-submit allows Reflected XSS.This issue affects WP Frontend Submit: from n/a through <= 1.1.0.

  Product

  WP Frontend Submit

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update WP Frontend Submit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Visitor Details: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25132 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ravi Singh Visitor Details visitors-details allows Stored XSS.This issue affects Visitor Details: from n/a through <= 1.0.1.

  Product

  Visitor Details

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Visitor Details to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025RJ Quickcharts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25131 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in randyjensen RJ Quickcharts rj-quickcharts allows Stored XSS.This issue affects RJ Quickcharts: from n/a through <= 0.6.1.

  Product

  RJ Quickcharts

  Affected

  up to 0.6.1

  What to do

  Affects up to 0.6.1. Update RJ Quickcharts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Callback Request: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25129 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Callback Request allows Reflected XSS. This issue affects Callback Request: from n/a through 1.4.

  Product

  Callback Request

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Callback Request to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Contact Us By Lord Linus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25127 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rohitashv Singhal Contact Us By Lord Linus contact-us-by-lord-linus allows Reflected XSS.This issue affects Contact Us By Lord Linus: from n/a through <= 2.6.

  Product

  Contact Us By Lord Linus

  Affected

  up to 2.6

  What to do

  Affects up to 2.6. Update Contact Us By Lord Linus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Status Updater: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25124 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devu Status Updater fb-status-updater allows Reflected XSS.This issue affects Status Updater: from n/a through <= 1.9.2.

  Product

  Status Updater

  Affected

  up to 1.9.2

  What to do

  Affects up to 1.9.2. Update Status Updater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Woocommerce osCommerce Sync: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25119 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alejandro Aranda Woocommerce osCommerce Sync woo-oscommerce-sync allows Reflected XSS.This issue affects Woocommerce osCommerce Sync: from n/a through <= 2.0.20.

  Product

  Woocommerce osCommerce Sync

  Affected

  up to 2.0.20

  What to do

  Affects up to 2.0.20. Update Woocommerce osCommerce Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Top Bar – PopUps – by WPOptin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25118 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Danish Ali Malik Top Bar – PopUps – by WPOptin wpoptin allows Reflected XSS.This issue affects Top Bar – PopUps – by WPOptin: from n/a through <= 2.0.8.

  Product

  Top Bar – PopUps – by WPOptin

  Affected

  up to 2.0.8

  What to do

  Affects up to 2.0.8. Update Top Bar – PopUps – by WPOptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Like dislike plus counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25115 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zeshan Abdullah Like dislike plus counter like-dislike-plus-counter allows Stored XSS.This issue affects Like dislike plus counter: from n/a through <= 1.0.

  Product

  Like dislike plus counter

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Like dislike plus counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025User Role: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25114 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ehabstar User Role user-roles allows Reflected XSS.This issue affects User Role: from n/a through <= 1.0.

  Product

  User Role

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update User Role to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Implied Cookie Consent: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25113 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Senktec Implied Cookie Consent implied-cookie-consent allows Reflected XSS.This issue affects Implied Cookie Consent: from n/a through <= 1.3.

  Product

  Implied Cookie Consent

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Implied Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025SW Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25108 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shalomworld SW Plus shalom-world-media-gallery allows Reflected XSS.This issue affects SW Plus: from n/a through <= 2.1.

  Product

  SW Plus

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update SW Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Yahoo BOSS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25102 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Harrison Yahoo BOSS yahoo-boss allows Reflected XSS.This issue affects Yahoo BOSS: from n/a through <= 0.7.

  Product

  Yahoo BOSS

  Affected

  up to 0.7

  What to do

  Affects up to 0.7. Update Yahoo BOSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Appointment Buddy Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25099 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in accreteinfosolution Appointment Buddy Widget appointment-buddy-online-appointment-booking-by-accrete allows Cross-Site Scripting (XSS).This issue affects Appointment Buddy Widget: from n/a through <= 1.2.

  Product

  Appointment Buddy Widget

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Appointment Buddy Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025All push notification for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25092 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gtlwpdev All push notification for WP all-push-notification allows Reflected XSS.This issue affects All push notification for WP: from n/a through <= 1.5.3.

  Product

  All push notification for WP

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update All push notification for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Dreamstime Stock Photos: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25090 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dreamstime Dreamstime Stock Photos dreamstime-stock-photos allows Reflected XSS.This issue affects Dreamstime Stock Photos: from n/a through <= 4.1.

  Product

  Dreamstime Stock Photos

  Affected

  up to 4.1

  What to do

  Affects up to 4.1. Update Dreamstime Stock Photos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.