Vulnerability database

6,572 results · page 59 of 132

• Mar 28, 2025RPS Include Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31093 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redpixelstudios RPS Include Content rps-include-content allows DOM-Based XSS.This issue affects RPS Include Content: from n/a through <= 1.2.1.

  Product

  RPS Include Content

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update RPS Include Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Dropdown Multisite selector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31090 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alordiel Dropdown Multisite selector dropdown-multisite-selector allows Stored XSS.This issue affects Dropdown Multisite selector: from n/a through < 0.9.4.

  Product

  Dropdown Multisite selector

  What to do

  Update Dropdown Multisite selector to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Paid Member Subscriptions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31088 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Stored XSS.This issue affects Paid Member Subscriptions: from n/a through <= 2.14.3.

  Product

  Paid Member Subscriptions

  Affected

  up to 2.14.3

  What to do

  Affects up to 2.14.3. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Leaky Paywall: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31083 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Stored XSS.This issue affects Leaky Paywall: from n/a through <= 4.21.7.

  Product

  Leaky Paywall

  Affected

  up to 4.21.7

  What to do

  Affects up to 4.21.7. Update Leaky Paywall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Ultimate Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31077 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows DOM-Based XSS.This issue affects Ultimate Blocks: from n/a through <= 3.2.7.

  Product

  Ultimate Blocks

  Affected

  up to 3.2.7

  What to do

  Affects up to 3.2.7. Update Ultimate Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025MicroPayments: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-31075 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in videowhisper MicroPayments paid-membership allows Stored XSS.This issue affects MicroPayments: from n/a through <= 2.9.29.

  Product

  MicroPayments

  Affected

  up to 2.9.29

  What to do

  Affects up to 2.9.29. Update MicroPayments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Unlimited: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31073 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bensibley Unlimited unlimited allows Stored XSS.This issue affects Unlimited: from n/a through <= 1.45.

  Product

  Unlimited

  Affected

  up to 1.45

  What to do

  Affects up to 1.45. Update Unlimited to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Click to Chat – WP Support All-in-One Floating Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31092 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Floating Widget support-chat allows Stored XSS.This issue affects Click to Chat – WP Support All-in-One Floating Widget: from n/a through <= 2.3.4.

  Product

  Click to Chat – WP Support All-in-One Floating Widget

  Affected

  up to 2.3.4

  What to do

  Affects up to 2.3.4. Update Click to Chat – WP Support All-in-One Floating Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025VaultRE Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31101 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vault Group Pty Ltd VaultRE Contact Form 7 allows Stored XSS.This issue affects VaultRE Contact Form 7: from n/a through 1.0.

  Product

  VaultRE Contact Form 7

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update VaultRE Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Job Colors for WP Job Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31031 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Job Colors for WP Job Manager wp-job-manager-colors allows Stored XSS.This issue affects Job Colors for WP Job Manager: from n/a through <= 1.0.4.

  Product

  Job Colors for WP Job Manager

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Job Colors for WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025MemberSpace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26874 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in memberspace MemberSpace memberspace allows Reflected XSS.This issue affects MemberSpace: from n/a through <= 2.1.13.

  Product

  MemberSpace

  Affected

  up to 2.1.13

  What to do

  Affects up to 2.1.13. Update MemberSpace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26762 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through <= 9.7.0.

  Product

  WooCommerce

  Affected

  up to 9.7.0

  What to do

  Affects up to 9.7.0. Update WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Paytm Payment Donation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22640 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in integrationdevpaytm Paytm Payment Donation paytm-donation allows Stored XSS.This issue affects Paytm Payment Donation: from n/a through <= 2.3.3.

  Product

  Paytm Payment Donation

  Affected

  up to 2.3.3

  What to do

  Affects up to 2.3.3. Update Paytm Payment Donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Product Table For WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22638 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in acowebs Product Table For WooCommerce product-table-for-woocommerce allows Stored XSS.This issue affects Product Table For WooCommerce: from n/a through <= 1.2.3.

  Product

  Product Table For WooCommerce

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Product Table For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025iNET Webkit: Missing AuthorizationCVE-2025-22629 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in iNET iNET Webkit inet-webkit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iNET Webkit: from n/a through <= 1.2.2.

  Product

  iNET Webkit

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update iNET Webkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Filled In: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22628 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision Filled In filled-in allows Stored XSS.This issue affects Filled In: from n/a through <= 1.9.2.

  Product

  Filled In

  Affected

  up to 1.9.2

  What to do

  Affects up to 1.9.2. Update Filled In to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Simple Google Calendar Outlook Events Block Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22497 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bramwaas Simple Google Calendar Outlook Events Block Widget simple-google-icalendar-widget allows Stored XSS.This issue affects Simple Google Calendar Outlook Events Block Widget: from n/a through <= 2.5.0.

  Product

  Simple Google Calendar Outlook Events Block Widget

  Affected

  up to 2.5.0

  What to do

  Affects up to 2.5.0. Update Simple Google Calendar Outlook Events Block Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Notif Bell: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22496 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MarMar8x Notif Bell notif-bell allows Stored XSS.This issue affects Notif Bell: from n/a through <= 0.9.8.

  Product

  Notif Bell

  Affected

  up to 0.9.8

  What to do

  Affects up to 0.9.8. Update Notif Bell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Whitish Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22278 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yudleethemes Whitish Lite allows Stored XSS.This issue affects Whitish Lite: from n/a through 2.1.13.

  Product

  Whitish Lite

  Affected

  up to 2.1.13

  What to do

  Affects up to 2.1.13. Update Whitish Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Include Mastodon Feed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22660 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wolfgang Include Mastodon Feed include-mastodon-feed allows DOM-Based XSS.This issue affects Include Mastodon Feed: from n/a through <= 1.9.9.

  Product

  Include Mastodon Feed

  Affected

  up to 1.9.9

  What to do

  Affects up to 1.9.9. Update Include Mastodon Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Orbit Fox by ThemeIsle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22659 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allows Stored XSS.This issue affects Orbit Fox by ThemeIsle: from n/a through <= 2.10.44.

  Product

  Orbit Fox by ThemeIsle

  Affected

  up to 2.10.44

  What to do

  Affects up to 2.10.44. Update Orbit Fox by ThemeIsle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WP Project Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22649 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager wedevs-project-manager allows Stored XSS.This issue affects WP Project Manager: from n/a through <= 2.6.22.

  Product

  WP Project Manager

  Affected

  up to 2.6.22

  What to do

  Affects up to 2.6.22. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Blog, Posts and Category Filter for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22648 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Devs Blog, Posts and Category Filter for Elementor blog-posts-and-category-for-elementor allows Stored XSS.This issue affects Blog, Posts and Category Filter for Elementor: from n/a through <= 2.0.1.

  Product

  Blog, Posts and Category Filter for Elementor

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Blog, Posts and Category Filter for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025aThemes Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22646 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.0.8.

  Product

  aThemes Addons for Elementor

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update aThemes Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22644 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce vayu-blocks allows Stored XSS.This issue affects Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: from n/a through <= 1.4.7.

  Product

  Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce

  Affected

  up to 1.4.7

  What to do

  Affects up to 1.4.7. Update Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Quick Interest Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26738 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Graham Quick Interest Slider quick-interest-slider allows DOM-Based XSS.This issue affects Quick Interest Slider: from n/a through <= 3.1.5.

  Product

  Quick Interest Slider

  Affected

  up to 3.1.5

  What to do

  Affects up to 3.1.5. Update Quick Interest Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025City Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26737 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yudleethemes City Store allows DOM-Based XSS.This issue affects City Store: from n/a through 1.4.5.

  Product

  City Store

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update City Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025MorningTime Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26736 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in victortihai MorningTime Lite morningtime-lite allows Stored XSS.This issue affects MorningTime Lite: from n/a through <= 1.3.2.

  Product

  MorningTime Lite

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update MorningTime Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Hester: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26734 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in peregrinethemes Hester hester allows Stored XSS.This issue affects Hester: from n/a through <= 1.1.10.

  Product

  Hester

  Affected

  up to 1.1.10

  What to do

  Affects up to 1.1.10. Update Hester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025StoreBiz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26732 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burgersoftware StoreBiz storebiz allows DOM-Based XSS.This issue affects StoreBiz: from n/a through <= 1.0.32.

  Product

  StoreBiz

  Affected

  up to 1.0.32

  What to do

  Affects up to 1.0.32. Update StoreBiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025ARPrice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26731 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARPrice arprice allows Stored XSS.This issue affects ARPrice: from n/a through <= 4.1.3.

  Product

  ARPrice

  Affected

  up to 4.1.3

  What to do

  Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Power Mag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22816 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetrendy Power Mag power-mag allows DOM-Based XSS.This issue affects Power Mag: from n/a through <= 1.1.5.

  Product

  Power Mag

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update Power Mag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025The Pack Elementor addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30925 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through <= 2.1.1.

  Product

  The Pack Elementor addons

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Simplebooklet PDF Viewer and Embedder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30922 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in simplebooklet Simplebooklet PDF Viewer and Embedder simplebooklet allows Stored XSS.This issue affects Simplebooklet PDF Viewer and Embedder: from n/a through <= 1.1.1.

  Product

  Simplebooklet PDF Viewer and Embedder

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Simplebooklet PDF Viewer and Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WP Posts Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30920 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Stored XSS.This issue affects WP Posts Carousel: from n/a through <= 1.3.7.

  Product

  WP Posts Carousel

  Affected

  up to 1.3.7

  What to do

  Affects up to 1.3.7. Update WP Posts Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Structured Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30918 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme Structured Content structured-content allows Stored XSS.This issue affects Structured Content: from n/a through <= 1.6.3.

  Product

  Structured Content

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update Structured Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025SecuPress Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30907 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SecuPress SecuPress Free secupress allows DOM-Based XSS.This issue affects SecuPress Free: from n/a through <= 2.2.5.3.

  Product

  SecuPress Free

  Affected

  up to 2.2.5.3

  What to do

  Affects up to 2.2.5.3. Update SecuPress Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Chartify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30904 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Chartify chart-builder allows Stored XSS.This issue affects Chartify: from n/a through <= 3.1.7.

  Product

  Chartify

  Affected

  up to 3.1.7

  What to do

  Affects up to 3.1.7. Update Chartify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025SyntaxHighlighter Evolved: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30903 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Mills SyntaxHighlighter Evolved syntaxhighlighter allows DOM-Based XSS.This issue affects SyntaxHighlighter Evolved: from n/a through <= 3.7.1.

  Product

  SyntaxHighlighter Evolved

  Affected

  up to 3.7.1

  What to do

  Affects up to 3.7.1. Update SyntaxHighlighter Evolved to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Zoho Billing – Embed Payment Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30900 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Subscriptions Zoho Billing – Embed Payment Form allows Stored XSS. This issue affects Zoho Billing – Embed Payment Form: from n/a through 4.0.

  Product

  Zoho Billing – Embed Payment Form

  Affected

  up to 4.0

  What to do

  Affects up to 4.0. Update Zoho Billing – Embed Payment Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025User Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30899 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through <= 4.0.3.

  Product

  User Registration

  Affected

  up to 4.0.3

  What to do

  Affects up to 4.0.3. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30898 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahdi Yousefi [MahdiY] افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) persian-woocommerce-shipping allows Stored XSS.This issue affects افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری): from n/a through <= 4.2.3.

  Product

  افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری)

  Affected

  up to 4.2.3

  What to do

  Affects up to 4.2.3. Update افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025LeadConnector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30893 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeadConnector LeadConnector leadconnector allows DOM-Based XSS.This issue affects LeadConnector: from n/a through <= 3.0.2.

  Product

  LeadConnector

  Affected

  up to 3.0.2

  What to do

  Affects up to 3.0.2. Update LeadConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Greenshift: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30873 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Stored XSS.This issue affects Greenshift: from n/a through <= 11.0.2.

  Product

  Greenshift

  Affected

  up to 11.0.2

  What to do

  Affects up to 11.0.2. Update Greenshift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025SearchIQ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30867 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SearchIQ SearchIQ searchiq allows Stored XSS.This issue affects SearchIQ: from n/a through <= 4.7.

  Product

  SearchIQ

  Affected

  up to 4.7

  What to do

  Affects up to 4.7. Update SearchIQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Off-Canvas Sidebars & Menus (Slidebars): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30860 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars allows DOM-Based XSS.This issue affects Off-Canvas Sidebars & Menus (Slidebars): from n/a through <= 0.5.8.2.

  Product

  Off-Canvas Sidebars & Menus (Slidebars)

  Affected

  up to 0.5.8.2

  What to do

  Affects up to 0.5.8.2. Update Off-Canvas Sidebars & Menus (Slidebars) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Dr. Flex: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30850 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sfaerber Dr. Flex dr-flex allows Stored XSS.This issue affects Dr. Flex: from n/a through <= 2.0.0.

  Product

  Dr. Flex

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Dr. Flex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Novelist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30847 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashley Novelist novelist allows Stored XSS.This issue affects Novelist: from n/a through <= 1.2.3.

  Product

  Novelist

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Novelist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025bizcalendar-web: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30843 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in setriosoft bizcalendar-web bizcalendar-web allows SQL Injection.This issue affects bizcalendar-web: from n/a through <= 1.1.0.34.

  Product

  bizcalendar-web

  Affected

  up to 1.1.0.34

  What to do

  Affects up to 1.1.0.34. Update bizcalendar-web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Cozy Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30838 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through <= 2.1.6.

  Product

  Cozy Blocks

  Affected

  up to 2.1.6

  What to do

  Affects up to 2.1.6. Update Cozy Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.