Vulnerability database

5,857 results · page 59 of 118

• Mar 3, 2025Wibstats: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23565 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Taylor Wibstats wibstats-statistics-for-wordpress-mu allows Reflected XSS.This issue affects Wibstats: from n/a through <= 0.5.5.

  Product

  Wibstats

  Affected

  up to 0.5.5

  What to do

  Affects up to 0.5.5. Update Wibstats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP FixTag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23564 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mohsenshahbazi WP FixTag wp-fixtag allows Reflected XSS.This issue affects WP FixTag: from n/a through <= v2.0.2.

  Product

  WP FixTag

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update WP FixTag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Explore pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23563 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mbyte Explore pages explore-pages allows Reflected XSS.This issue affects Explore pages: from n/a through <= 1.01.

  Product

  Explore pages

  Affected

  up to 1.01

  What to do

  Affects up to 1.01. Update Explore pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Push Envoy Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23556 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in netbitsolutions Push Envoy Notifications push-envoy allows Reflected XSS.This issue affects Push Envoy Notifications: from n/a through <= 1.0.0.

  Product

  Push Envoy Notifications

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Push Envoy Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Ui Slider Filter By Price: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23555 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chenyenming Ui Slider Filter By Price ui-slider-filter-by-price allows Reflected XSS.This issue affects Ui Slider Filter By Price: from n/a through <= 1.1.

  Product

  Ui Slider Filter By Price

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Ui Slider Filter By Price to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Userbase Access Control: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23553 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Cramer Userbase Access Control userbase-access-control allows Reflected XSS.This issue affects Userbase Access Control: from n/a through <= 1.0.

  Product

  Userbase Access Control

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Userbase Access Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Texteller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23552 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yashar Texteller texteller allows Reflected XSS.This issue affects Texteller: from n/a through <= 1.3.0.

  Product

  Texteller

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Texteller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Maniac SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23549 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in agora32 Maniac SEO maniac-seo allows Reflected XSS.This issue affects Maniac SEO: from n/a through <= 2.0.

  Product

  Maniac SEO

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Maniac SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Awesome Hooks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23539 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in surror Awesome Hooks awesome-hooks allows Reflected XSS.This issue affects Awesome Hooks: from n/a through <= 1.0.1.

  Product

  Awesome Hooks

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Awesome Hooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP Contest: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23538 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sophia M Williams WP Contest wp-contest allows Reflected XSS.This issue affects WP Contest: from n/a through <= 1.0.0.

  Product

  WP Contest

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update WP Contest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Track Page Scroll: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23536 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 Track Page Scroll track-page-scroll allows Reflected XSS.This issue affects Track Page Scroll: from n/a through <= 1.0.2.

  Product

  Track Page Scroll

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Track Page Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Swift Calendar Online Appointment Scheduling: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23526 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SwiftCloud Swift Calendar Online Appointment Scheduling online-appointment-scheduling-software allows Reflected XSS.This issue affects Swift Calendar Online Appointment Scheduling: from n/a through <= 1.3.3.

  Product

  Swift Calendar Online Appointment Scheduling

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update Swift Calendar Online Appointment Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025ClickBank Storefront: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23524 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dactum ClickBank Storefront mycbgenie-clickbank-storefront allows Reflected XSS.This issue affects ClickBank Storefront: from n/a through <= 1.7.

  Product

  ClickBank Storefront

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update ClickBank Storefront to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Goodlayers Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23521 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Blocks goodlayers-blocks allows Reflected XSS.This issue affects Goodlayers Blocks: from n/a through <= 1.0.1.

  Product

  Goodlayers Blocks

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Goodlayers Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Heartland Management Terminal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23520 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SecureSubmit Heartland Management Terminal allows Reflected XSS. This issue affects Heartland Management Terminal: from n/a through 1.3.0.

  Product

  Heartland Management Terminal

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Heartland Management Terminal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025G Web Pro Store Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23519 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jas Saran G Web Pro Store Locator gwebpro-store-locator allows Reflected XSS.This issue affects G Web Pro Store Locator: from n/a through <= 2.0.1.

  Product

  G Web Pro Store Locator

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update G Web Pro Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025GoogleMapper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23518 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mrsaucier GoogleMapper googlemapper-2 allows Reflected XSS.This issue affects GoogleMapper: from n/a through <= 2.0.3.

  Product

  GoogleMapper

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update GoogleMapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Google Map on Post/Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23517 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunil chaulagain Google Map on Post/Page google-map-on-postpage allows Reflected XSS.This issue affects Google Map on Post/Page: from n/a through <= 1.1.

  Product

  Google Map on Post/Page

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Google Map on Post/Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Sale with Razorpay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23516 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainvireinfo Sale with Razorpay sell-with-razorpay allows Reflected XSS.This issue affects Sale with Razorpay: from n/a through <= 1.0.

  Product

  Sale with Razorpay

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Sale with Razorpay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Pit Login Welcome: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23505 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pantho Bihosh Pit Login Welcome pit-login-welcome allows Reflected XSS.This issue affects Pit Login Welcome: from n/a through <= 1.1.5.

  Product

  Pit Login Welcome

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update Pit Login Welcome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025WP FPO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23496 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in husani WP FPO wp-fpo allows Reflected XSS.This issue affects WP FPO: from n/a through <= 1.0.

  Product

  WP FPO

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP FPO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Quizzin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23494 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in binnyva Quizzin quizzin allows Reflected XSS.This issue affects Quizzin: from n/a through <= 1.01.4.

  Product

  Quizzin

  Affected

  up to 1.01.4

  What to do

  Affects up to 1.01.4. Update Quizzin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Google Transliteration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23493 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moallemi Google Transliteration google-transliteration allows Reflected XSS.This issue affects Google Transliteration: from n/a through <= 1.7.2.

  Product

  Google Transliteration

  Affected

  up to 1.7.2

  What to do

  Affects up to 1.7.2. Update Google Transliteration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Browser-Update-Notify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23490 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Stursberg Browser-Update-Notify browser-update-notify allows Reflected XSS.This issue affects Browser-Update-Notify: from n/a through <= 0.2.1.

  Product

  Browser-Update-Notify

  Affected

  up to 0.2.1

  What to do

  Affects up to 0.2.1. Update Browser-Update-Notify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025rng-refresh: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23488 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abolfazl Sabagh rng-refresh rng-refresh allows Reflected XSS.This issue affects rng-refresh: from n/a through <= 1.0.

  Product

  rng-refresh

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update rng-refresh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Easy Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23487 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in odihost Easy Gallery simple-gallery-odihost allows Reflected XSS.This issue affects Easy Gallery: from n/a through <= 1.4.

  Product

  Easy Gallery

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Easy Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025RS Survey: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23485 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in richestsoft RS Survey rs-survey allows Reflected XSS.This issue affects RS Survey: from n/a through <= 1.0.

  Product

  RS Survey

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update RS Survey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Predict When: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23484 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cojecto Predict When predict-when allows Reflected XSS.This issue affects Predict When: from n/a through <= 1.3.

  Product

  Predict When

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Predict When to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025azurecurve Floating Featured Image: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23482 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in azurecurve azurecurve Floating Featured Image azurecurve-floating-featured-image allows Reflected XSS.This issue affects azurecurve Floating Featured Image: from n/a through <= 2.2.0.

  Product

  azurecurve Floating Featured Image

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update azurecurve Floating Featured Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Ni WooCommerce Sales Report Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23481 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Sales Report Email ni-woocommerce-sales-report-email allows Reflected XSS.This issue affects Ni WooCommerce Sales Report Email: from n/a through <= 3.1.4.

  Product

  Ni WooCommerce Sales Report Email

  Affected

  up to 3.1.4

  What to do

  Affects up to 3.1.4. Update Ni WooCommerce Sales Report Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025RSVP ME: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23480 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MicahBlu RSVP ME rsvp-me allows Stored XSS.This issue affects RSVP ME: from n/a through <= 1.9.9.

  Product

  RSVP ME

  Affected

  up to 1.9.9

  What to do

  Affects up to 1.9.9. Update RSVP ME to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025melascrivi: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23479 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in melascrivi melascrivi melascrivi allows Reflected XSS.This issue affects melascrivi: from n/a through <= 1.4.

  Product

  melascrivi

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update melascrivi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Photo Video Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23478 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmsaccount Photo Video Store photo-video-store allows Reflected XSS.This issue affects Photo Video Store: from n/a through <= 21.07.

  Product

  Photo Video Store

  Affected

  up to 21.07

  What to do

  Affects up to 21.07. Update Photo Video Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Killer Theme Options: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23473 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Punit Bhalodiya Killer Theme Options killer-theme-options allows Reflected XSS.This issue affects Killer Theme Options: from n/a through <= 2.0.

  Product

  Killer Theme Options

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Killer Theme Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Flexo Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23472 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexostudio Flexo Slider flexo-slider allows Reflected XSS.This issue affects Flexo Slider: from n/a through <= 1.0013.

  Product

  Flexo Slider

  Affected

  up to 1.0013

  What to do

  Affects up to 1.0013. Update Flexo Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Essay Wizard (wpCRES): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23468 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wrenchpilot Essay Wizard (wpCRES) essay-wizard-wpcres allows Reflected XSS.This issue affects Essay Wizard (wpCRES): from n/a through <= 1.0.6.4.

  Product

  Essay Wizard (wpCRES)

  Affected

  up to 1.0.6.4

  What to do

  Affects up to 1.0.6.4. Update Essay Wizard (wpCRES) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Vampire Character Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23465 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magent Vampire Character Manager vampire-character allows Reflected XSS.This issue affects Vampire Character Manager: from n/a through <= 2.13.

  Product

  Vampire Character Manager

  Affected

  up to 2.13

  What to do

  Affects up to 2.13. Update Vampire Character Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Twitter News Feed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23464 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Keir Whitaker Twitter News Feed twitter-news-feed allows Reflected XSS.This issue affects Twitter News Feed: from n/a through <= 1.1.1.

  Product

  Twitter News Feed

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Twitter News Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Awesome Twitter Feeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23451 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in titodevera Awesome Twitter Feeds awesome-twitter-feeds allows Reflected XSS.This issue affects Awesome Twitter Feeds: from n/a through <= 1.0.

  Product

  Awesome Twitter Feeds

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Awesome Twitter Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025AW WooCommerce Kode Pembayaran: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23450 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in agenwebsite AW WooCommerce Kode Pembayaran aw-woocommerce-kode-pembayaran allows Reflected XSS.This issue affects AW WooCommerce Kode Pembayaran: from n/a through <= 1.1.4.

  Product

  AW WooCommerce Kode Pembayaran

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update AW WooCommerce Kode Pembayaran to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Smooth Dynamic Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23447 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kundan Yevale Smooth Dynamic Slider smooth-dynamic-slider allows Reflected XSS.This issue affects Smooth Dynamic Slider: from n/a through <= 1.0.

  Product

  Smooth Dynamic Slider

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Smooth Dynamic Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Attach Gallery Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23441 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dkukral Attach Gallery Posts attach-gallery-posts allows Reflected XSS.This issue affects Attach Gallery Posts: from n/a through <= 1.6.

  Product

  Attach Gallery Posts

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Attach Gallery Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025TinyMCE Extended Config: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23439 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in willshouse TinyMCE Extended Config tinymce-extended-config allows Reflected XSS.This issue affects TinyMCE Extended Config: from n/a through <= 0.1.0.

  Product

  TinyMCE Extended Config

  Affected

  up to 0.1.0

  What to do

  Affects up to 0.1.0. Update TinyMCE Extended Config to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025ntp-header-images: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23437 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nord_tramper ntp-header-images header-images-rotator allows Reflected XSS.This issue affects ntp-header-images: from n/a through <= 1.2.

  Product

  ntp-header-images

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update ntp-header-images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025vcOS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23433 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jnwry vcOS vcos allows Reflected XSS.This issue affects vcOS: from n/a through <= 1.4.0.

  Product

  vcOS

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update vcOS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 3, 2025Marekkis Watermark: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23425 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in marekki Marekkis Watermark marekkis-watermark allows Reflected XSS.This issue affects Marekkis Watermark: from n/a through <= 0.9.4.

  Product

  Marekkis Watermark

  Affected

  up to 0.9.4

  What to do

  Affects up to 0.9.4. Update Marekkis Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 28, 2025SecuPress Free — WordPress Security: Stored Cross-Site ScriptingCVE-2024-9019 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's secupress_check_ban_ips_form shortcode in all versions up to, and including, 2.2.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  SecuPress Free — WordPress Security

  Affected

  up to 2.2.5.3

  What to do

  Affects up to 2.2.5.3. Update SecuPress Free — WordPress Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 27, 2025Woo Store Mode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23687 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in simonhunter Woo Store Mode woo-store-mode allows Reflected XSS.This issue affects Woo Store Mode: from n/a through <= 1.0.1.

  Product

  Woo Store Mode

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Woo Store Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 25, 2025Atarim: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26993 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Reflected XSS.This issue affects Atarim: from n/a through <= 4.1.0.

  Product

  Atarim

  Affected

  up to 4.1.0

  What to do

  Affects up to 4.1.0. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 25, 2025WPPizza: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26991 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ollybach WPPizza wppizza allows Reflected XSS.This issue affects WPPizza: from n/a through <= 3.19.4.

  Product

  WPPizza

  Affected

  up to 3.19.4

  What to do

  Affects up to 3.19.4. Update WPPizza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.