Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

5,857 results · page 58 of 118

Mar 3, 2025Image Rotator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25089 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in appten Image Rotator appten-image-rotator allows Reflected XSS.This issue affects Image Rotator: from n/a through <= 2.0.
Product
Image Rotator
Affected
up to 2.0
What to do
Affects up to 2.0. Update Image Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025seekXL Snapr: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25087 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim seekXL Snapr seekxl-snapr allows Reflected XSS.This issue affects seekXL Snapr: from n/a through <= 2.0.6.
Product
seekXL Snapr
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update seekXL Snapr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025UniTimetable: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25084 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antrouss UniTimetable unitimetable allows Stored XSS.This issue affects UniTimetable: from n/a through <= 1.1.
Product
UniTimetable
Affected
up to 1.1
What to do
Affects up to 1.1. Update UniTimetable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025EP4 More Embeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25083 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dave Lavoie EP4 More Embeds ep4-more-embeds allows Stored XSS.This issue affects EP4 More Embeds: from n/a through <= 1.0.0.
Product
EP4 More Embeds
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update EP4 More Embeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Album Reviewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25070 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ed atrero Album Reviewer albumreviewer allows Stored XSS.This issue affects Album Reviewer: from n/a through <= 2.0.2.
Product
Album Reviewer
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Album Reviewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025CM Map Locations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24758 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations cm-map-locations allows Reflected XSS.This issue affects CM Map Locations: from n/a through <= 2.0.8.
Product
CM Map Locations
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update CM Map Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025CM Pop-Up banners: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24694 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Pop-Up banners cm-pop-up-banners allows Reflected XSS.This issue affects CM Pop-Up banners: from n/a through <= 1.7.6.
Product
CM Pop-Up banners
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update CM Pop-Up banners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025WP Easy Post Mailer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23956 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Leishman WP Easy Post Mailer wp-mailer allows Reflected XSS.This issue affects WP Easy Post Mailer: from n/a through <= 0.64.
Product
WP Easy Post Mailer
Affected
up to 0.64
What to do
Affects up to 0.64. Update WP Easy Post Mailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Rebrand Fluent Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23904 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rebrandpress Rebrand Fluent Forms rebrand-fluent-forms allows Reflected XSS.This issue affects Rebrand Fluent Forms: from n/a through <= 1.0.
Product
Rebrand Fluent Forms
Affected
up to 1.0
What to do
Affects up to 1.0. Update Rebrand Fluent Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Local Shipping Labels for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23903 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woofx Local Shipping Labels for WooCommerce local-shipping-labels-for-woocommerce allows Reflected XSS.This issue affects Local Shipping Labels for WooCommerce: from n/a through <= 1.0.0.
Product
Local Shipping Labels for WooCommerce
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Local Shipping Labels for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Stray Random Quotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23883 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in unalignedcoder Stray Random Quotes stray-quotes allows Reflected XSS.This issue affects Stray Random Quotes: from n/a through <= 1.9.9.
Product
Stray Random Quotes
Affected
up to 1.9.9
What to do
Affects up to 1.9.9. Update Stray Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025LJ Custom Menu Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23881 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in littlejon LJ Custom Menu Links lj-custom-menu-links allows Reflected XSS.This issue affects LJ Custom Menu Links: from n/a through <= 2.5.
Product
LJ Custom Menu Links
Affected
up to 2.5
What to do
Affects up to 2.5. Update LJ Custom Menu Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Easy Automatic Newsletter Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23879 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PillarDev Easy Automatic Newsletter Lite easy-automatic-newsletter allows Reflected XSS.This issue affects Easy Automatic Newsletter Lite: from n/a through <= 3.2.0.
Product
Easy Automatic Newsletter Lite
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Easy Automatic Newsletter Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025First Comment Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23852 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robin90 First Comment Redirect first-comment-redirect allows Reflected XSS.This issue affects First Comment Redirect: from n/a through <= 1.0.3.
Product
First Comment Redirect
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update First Comment Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Mojo Under Construction: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23850 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojowill Mojo Under Construction mojo-under-construction allows Reflected XSS.This issue affects Mojo Under Construction: from n/a through <= 1.1.2.
Product
Mojo Under Construction
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Mojo Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Site Launcher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23847 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in saill Site Launcher site-launcher allows Reflected XSS.This issue affects Site Launcher: from n/a through <= 0.9.4.
Product
Site Launcher
Affected
up to 0.9.4
What to do
Affects up to 0.9.4. Update Site Launcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025WP-HR Manager: The Human Resources Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23843 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphrmanager WP-HR Manager: The Human Resources Plugin for WordPress wp-hr-manager allows Reflected XSS.This issue affects WP-HR Manager: The Human Resources Plugin for WordPress: from n/a through <= 3.1.0.
Product
WP-HR Manager: The Human Resources Plugin for
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update WP-HR Manager: The Human Resources Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Woo Update Variations In Cart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23829 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codingkart Woo Update Variations In Cart woo-update-variations-in-cart allows Stored XSS.This issue affects Woo Update Variations In Cart: from n/a through <= 0.0.9.
Product
Woo Update Variations In Cart
Affected
up to 0.0.9
What to do
Affects up to 0.0.9. Update Woo Update Variations In Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025CRUDLab Like Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23814 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRUDLab CRUDLab Like Box crudlab-facebook-like-box allows Reflected XSS.This issue affects CRUDLab Like Box: from n/a through <= 2.0.9.
Product
CRUDLab Like Box
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update CRUDLab Like Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Guten Free Options: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23813 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tony Hayes Guten Free Options guten-free-options allows Reflected XSS.This issue affects Guten Free Options: from n/a through <= 0.9.7.
Product
Guten Free Options
Affected
up to 0.9.7
What to do
Affects up to 0.9.7. Update Guten Free Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025DsgnWrks Twitter Importer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23762 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Sternberg DsgnWrks Twitter Importer dsgnwrks-twitter-importer allows Reflected XSS.This issue affects DsgnWrks Twitter Importer: from n/a through <= 1.1.4.
Product
DsgnWrks Twitter Importer
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update DsgnWrks Twitter Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025DN Sitemap Control: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23753 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digireturn DN Sitemap Control dn-sitemap-control allows Reflected XSS.This issue affects DN Sitemap Control: from n/a through <= 1.0.6.
Product
DN Sitemap Control
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update DN Sitemap Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Notifications Center: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23741 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Florian Chaillou Notifications Center notifications-center allows Reflected XSS.This issue affects Notifications Center: from n/a through <= 1.5.2.
Product
Notifications Center
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Notifications Center to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Easy School Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23740 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zbynek Nedoma Easy School Registration easy-school-registration allows Reflected XSS.This issue affects Easy School Registration: from n/a through <= 3.9.8.
Product
Easy School Registration
Affected
up to 3.9.8
What to do
Affects up to 3.9.8. Update Easy School Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025WP Ultimate Reviews FREE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23739 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jtibbles WP Ultimate Reviews FREE wp-ultimate-reviews-free allows Reflected XSS.This issue affects WP Ultimate Reviews FREE: from n/a through <= 1.0.2.
Product
WP Ultimate Reviews FREE
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP Ultimate Reviews FREE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Ps Ads Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23738 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Padam Shankhadev Ps Ads Pro ps-ads-pro allows Reflected XSS.This issue affects Ps Ads Pro: from n/a through <= 1.0.0.
Product
Ps Ads Pro
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Ps Ads Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Form To JSON: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23736 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webgdawg Form To JSON form-to-json allows Reflected XSS.This issue affects Form To JSON: from n/a through <= 1.0.
Product
Form To JSON
Affected
up to 1.0
What to do
Affects up to 1.0. Update Form To JSON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Tax Report for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23731 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in infosoftplugin Tax Report for WooCommerce tax-report-for-woocommerce allows Reflected XSS.This issue affects Tax Report for WooCommerce: from n/a through <= 2.2.
Product
Tax Report for WooCommerce
Affected
up to 2.2
What to do
Affects up to 2.2. Update Tax Report for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025ComparePress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23726 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thebloghouse ComparePress comparepress allows Reflected XSS.This issue affects ComparePress: from n/a through <= 2.0.8.
Product
ComparePress
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update ComparePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Mobigate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23721 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cloudvn Mobigate mobigatevn allows Reflected XSS.This issue affects Mobigate: from n/a through <= 1.0.3.
Product
Mobigate
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Mobigate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Mancx AskMe Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23718 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mancx Mancx AskMe Widget mancx-askme-widget allows Reflected XSS.This issue affects Mancx AskMe Widget: from n/a through <= 0.3.
Product
Mancx AskMe Widget
Affected
up to 0.3
What to do
Affects up to 0.3. Update Mancx AskMe Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Login Watchdog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23716 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JkmAS Login Watchdog login-watchdog allows Stored XSS.This issue affects Login Watchdog: from n/a through <= 1.0.4.
Product
Login Watchdog
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Login Watchdog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Cobwebo URL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23688 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in editionskezzal Cobwebo URL Plugin cobwebo-url allows Reflected XSS.This issue affects Cobwebo URL Plugin: from n/a through <= 1.0.
Product
Cobwebo URL
Affected
up to 1.0
What to do
Affects up to 1.0. Update Cobwebo URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 20254 author cheer up donate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23670 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in montashov 4 author cheer up donate 4-author-cheer-up-donate allows Reflected XSS.This issue affects 4 author cheer up donate: from n/a through <= 1.3.
Product
4 author cheer up donate
Affected
up to 1.3
What to do
Affects up to 1.3. Update 4 author cheer up donate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025ChatGPT Open AI Images & Content for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23668 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mauricio Urrego ChatGPT Open AI Images & Content for WooCommerce glasses-for-woocommerce allows Reflected XSS.This issue affects ChatGPT Open AI Images & Content for WooCommerce: from n/a through <= 2.2.0.
Product
ChatGPT Open AI Images & Content for WooCommerce
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update ChatGPT Open AI Images & Content for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Contexto: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23663 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Vaquez Contexto contexto allows Reflected XSS.This issue affects Contexto: from n/a through <= 1.0.
Product
Contexto
Affected
up to 1.0
What to do
Affects up to 1.0. Update Contexto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025新淘客WordPress插件: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23637 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fxy060608 新淘客WordPress插件 wp-xintaoke allows Reflected XSS.This issue affects 新淘客WordPress插件: from n/a through <= 1.1.2.
Product
新淘客WordPress插件
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update 新淘客WordPress插件 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025ePermissions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23635 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mobde3net ePermissions epermissions allows Reflected XSS.This issue affects ePermissions: from n/a through <= 1.2.
Product
ePermissions
Affected
up to 1.2
What to do
Affects up to 1.2. Update ePermissions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Catch Duplicate Switcher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23619 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Catch Themes Catch Duplicate Switcher catch-duplicate-switcher allows Reflected XSS.This issue affects Catch Duplicate Switcher: from n/a through <= 2.0.
Product
Catch Duplicate Switcher
Affected
up to 2.0
What to do
Affects up to 2.0. Update Catch Duplicate Switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Canalplan: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23616 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Canalplan canalplan-ac allows Reflected XSS.This issue affects Canalplan: from n/a through <= 5.31.
Product
Canalplan
Affected
up to 5.31
What to do
Affects up to 5.31. Update Canalplan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Send to a Friend Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23600 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pinal.shah Send to a Friend Addon send-booking-invites-to-friends allows Reflected XSS.This issue affects Send to a Friend Addon: from n/a through <= 1.4.1.
Product
Send to a Friend Addon
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Send to a Friend Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Page Health-O-Meter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23595 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainpulse Page Health-O-Meter page-health-o-meter allows Reflected XSS.This issue affects Page Health-O-Meter: from n/a through <= 2.0.
Product
Page Health-O-Meter
Affected
up to 2.0
What to do
Affects up to 2.0. Update Page Health-O-Meter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025all-in-one-box-login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23587 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashek Al Mahmud all-in-one-box-login all-in-one-login allows Reflected XSS.This issue affects all-in-one-box-login: from n/a through <= 2.0.1.
Product
all-in-one-box-login
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update all-in-one-box-login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025WP Post Category Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23586 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MAL73049 WP Post Category Notifications wp-post-category-notifications allows Reflected XSS.This issue affects WP Post Category Notifications: from n/a through <= 1.0.
Product
WP Post Category Notifications
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Post Category Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Goo.gl Url Shorter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23585 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CantonBolo Goo.gl Url Shorter googl-url-shorter allows Reflected XSS.This issue affects Goo.gl Url Shorter: from n/a through <= 1.0.1.
Product
Goo.gl Url Shorter
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Goo.gl Url Shorter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Pin Locations on Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23584 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arsh91 Pin Locations on Map pin-locations-on-map allows Reflected XSS.This issue affects Pin Locations on Map: from n/a through <= 1.0.
Product
Pin Locations on Map
Affected
up to 1.0
What to do
Affects up to 1.0. Update Pin Locations on Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025DZS Ajaxer Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23579 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalzoomstudio DZS Ajaxer Lite dzs-ajaxer-lite-dynamic-page-load allows Stored XSS.This issue affects DZS Ajaxer Lite: from n/a through <= 1.04.
Product
DZS Ajaxer Lite
Affected
up to 1.04
What to do
Affects up to 1.04. Update DZS Ajaxer Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025WP Intro.JS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23576 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cfuze WP Intro.JS wp-intro-js-tours allows Reflected XSS.This issue affects WP Intro.JS: from n/a through <= 1.1.
Product
WP Intro.JS
Affected
up to 1.1
What to do
Affects up to 1.1. Update WP Intro.JS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025DX Sales CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23575 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevriX DX Sales CRM dx-sales-crm allows Reflected XSS.This issue affects DX Sales CRM: from n/a through <= 1.1.
Product
DX Sales CRM
Affected
up to 1.1
What to do
Affects up to 1.1. Update DX Sales CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025WP Social Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23570 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mitchell Bundy WP Social Links wp-social-links allows Reflected XSS.This issue affects WP Social Links: from n/a through <= 0.3.1.
Product
WP Social Links
Affected
up to 0.3.1
What to do
Affects up to 0.3.1. Update WP Social Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.