Vulnerability database

15,364 results · page 60 of 308

• Mar 20, 2026Image Alt Text Manager: Stored Cross-Site ScriptingCVE-2026-3350 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Image Alt Text Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.8.2. This is due to insufficient input sanitization and output escaping when dynamically generating image alt and title attributes using a DOM parser. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Image Alt Text Manager

  Affected

  up to 1.8.2

  What to do

  Affects up to 1.8.2. Update Image Alt Text Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 20, 2026Autoptimize: Stored Cross-Site ScriptingCVE-2026-2430 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14. This is due to the use of an overly permissive regular expression in the `add_lazyload` function that replaces all occurrences of `\ssrc=` in image tags without limiting to the actual attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page by crafting an image tag where the `src` URL contains a space followed by `src=`, causing the regex to break the HTML structure and promote text inside attribute values into executable HTML attributes.

  Product

  Autoptimize

  Affected

  up to 3.1.14

  What to do

  Affects up to 3.1.14. Update Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Mar 20, 2026Autoptimize: Stored Cross-Site ScriptingCVE-2026-2352 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `<link>` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the "Image optimization" or "Lazy-load images" setting is enabled in the plugin configuration.

  Product

  Autoptimize

  Affected

  up to 3.1.14

  What to do

  Affects up to 3.1.14. Update Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Mar 20, 2026Special Box for Content: Improper neutralization of input during web page generation ('cross-site scripting')CVE-2024-31119 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Vasilis Triantafyllou Special Box for Content allows DOM-Based XSS.This issue affects Special Box for Content: from n/a through 1.

  Product

  Special Box for Content

  Affected

  up to 1

  What to do

  Affects up to 1. Update Special Box for Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 20, 2026CM Custom Reports – Flexible reporting to track what matters most: Stored Cross-Site ScriptingCVE-2026-2432 · WordPress plugins & themes · reported by WordfenceMedium 4.4

  The CM Custom Reports – Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

  Product

  CM Custom Reports – Flexible reporting to track what matters most

  Affected

  up to 1.2.7

  What to do

  Affects up to 1.2.7. Update CM Custom Reports – Flexible reporting to track what matters most to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 19, 2026Everest Forms Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27070 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPEverest Everest Forms Pro allows Stored XSS.This issue affects Everest Forms Pro: from n/a through 1.9.10.

  Product

  Everest Forms Pro

  Affected

  up to 1.9.10

  What to do

  Affects up to 1.9.10. Update Everest Forms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 19, 2026Website LLMs.txt: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27068 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Howard Website LLMs.txt website-llms-txt allows Reflected XSS.This issue affects Website LLMs.txt: from n/a through <= 8.2.6.

  Product

  Website LLMs.txt

  Affected

  up to 8.2.6

  What to do

  Affects up to 8.2.6. Update Website LLMs.txt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 19, 2026Kentha: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25442 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QantumThemes Kentha kentha allows Reflected XSS.This issue affects Kentha: from n/a through <= 4.7.2.

  Product

  Kentha

  Affected

  up to 4.7.2

  What to do

  Affects up to 4.7.2. Update Kentha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 19, 2026Gutenberg Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25438 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Gutenberg Blocks unlimited-blocks allows Reflected XSS.This issue affects Gutenberg Blocks: from n/a through <= 1.2.8.

  Product

  Gutenberg Blocks

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 19, 2026Table of Contents Creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68836 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Markbeljaars Table of Contents Creator allows Reflected XSS.This issue affects Table of Contents Creator: from n/a through 1.6.4.1.

  Product

  Table of Contents Creator

  Affected

  up to 1.6.4.1

  What to do

  Affects up to 1.6.4.1. Update Table of Contents Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 19, 2026Brookside: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67618 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ArtstudioWorks Brookside allows Reflected XSS.This issue affects Brookside: from n/a through 1.4.

  Product

  Brookside

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Brookside to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 19, 2026WPCasa: Improper neutralization of input during web page generation ('cross-site scripting')CVE-2025-62043 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPSight WPCasa allows DOM-Based XSS.This issue affects WPCasa: from n/a through 1.4.1.

  Product

  WPCasa

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update WPCasa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 19, 2026tagDiv Opt-In Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53222 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Reflected XSS.This issue affects tagDiv Opt-In Builder: from n/a through <= 1.7.3.

  Product

  tagDiv Opt-In Builder

  Affected

  up to 1.7.3

  What to do

  Affects up to 1.7.3. Update tagDiv Opt-In Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 19, 2026tagDiv Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50001 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.2.

  Product

  tagDiv Composer

  Affected

  up to 5.4.2

  What to do

  Affects up to 5.4.2. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 19, 2026Info Cards – Add Text and Media in Card Layouts: Stored Cross-Site ScriptingCVE-2026-4120 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Info Cards – Add Text and Media in Card Layouts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnUrl' parameter within the Info Cards block in all versions up to, and including, 2.0.7. This is due to insufficient input validation on URL schemes, specifically the lack of javascript: protocol filtering. The block's render.php passes all attributes as JSON to the frontend via a data-attributes HTML attribute using esc_attr(wp_json_encode()), which prevents HTML attribute injection but does not validate URL protocols within the JSON data. The client-side view.js then renders the btnUrl value directly as an href attribute on anchor elements without any protocol sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject javascript: URLs that execute arbitrary web scripts when a user clicks the rendered button link.

  Product

  Info Cards – Add Text and Media in Card Layouts

  Affected

  up to 2.0.7

  What to do

  Affects up to 2.0.7. Update Info Cards – Add Text and Media in Card Layouts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 19, 2026Simple Draft List: Stored Cross-Site ScriptingCVE-2026-4006 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Simple Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' post meta (Custom Field) in all versions up to and including 2.6.2. This is due to insufficient input sanitization and output escaping on the author display name when no author URL is present. The plugin accesses `$draft_data->display_name` which, because `display_name` is not a native WP_Post property, triggers WP_Post::__get() and resolves to `get_post_meta($post_id, 'display_name', true)`. When the `user_url` meta field is empty, the `$author` value is assigned to `$author_link` on line 383 without any escaping (unlike line 378 which uses `esc_html()` for the `{{author}}` tag, and line 381 which uses `esc_html()` when a URL is present). This unescaped value is then inserted into the shortcode output via `str_replace()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page containing the `[drafts]` shortcode with the `{{author+link}}` template tag.

  Product

  Simple Draft List

  Affected

  up to 2.6.2

  What to do

  Affects up to 2.6.2. Update Simple Draft List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 19, 2026WP eMember: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28073 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tips and Tricks HQ WP eMember allows Reflected XSS.This issue affects WP eMember: from n/a through v10.2.2.

  Product

  WP eMember

  Affected

  up to v10.2.2

  What to do

  Affects up to v10.2.2. Update WP eMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 19, 2026WP Rocket: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28044 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media WP Rocket allows Stored XSS.This issue affects WP Rocket: from n/a through 3.19.4.

  Product

  WP Rocket

  Affected

  up to 3.19.4

  What to do

  Affects up to 3.19.4. Update WP Rocket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 19, 2026SlimStat Analytics: Stored Cross-Site ScriptingCVE-2026-1238 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fh' (fingerprint) parameter in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  SlimStat Analytics

  Affected

  up to 5.3.5

  What to do

  Affects up to 5.3.5. Update SlimStat Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 18, 2026Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Stored Cross-Site ScriptingCVE-2026-3090 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘event_type’ parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when the Post SMTP Pro plugin is also installed and its Reporting and Tracking extension is enabled.

  Product

  Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App

  Affected

  up to 3.8.0

  What to do

  Affects up to 3.8.0. Update Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 18, 2026Code Embed: Stored Cross-Site ScriptingCVE-2026-2512 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field meta values in all versions up to, and including, 2.5.1. This is due to the plugin's sanitization function `sec_check_post_fields()` only running on the `save_post` hook, while WordPress allows custom fields to be added via the `wp_ajax_add_meta` AJAX endpoint without triggering `save_post`. The `ce_filter()` function then outputs these unsanitized meta values directly into page content without escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Code Embed

  Affected

  up to 2.5.1

  What to do

  Affects up to 2.5.1. Update Code Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 18, 2026Writeprint Stylometry: Reflected Cross-Site ScriptingCVE-2026-3512 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Writeprint Stylometry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'p' GET parameter in all versions up to and including 0.1. This is due to insufficient input sanitization and output escaping in the bjl_wprintstylo_comments_nav() function. The function directly outputs the $_GET['p'] parameter into an HTML href attribute without any escaping. This makes it possible for authenticated attackers with Contributor-level permissions or higher to inject arbitrary web scripts in pages that execute if they can successfully trick another user into performing an action such as clicking on a link.

  Product

  Writeprint Stylometry

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Writeprint Stylometry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 18, 2026[CR]Paid Link Manager: Reflected Cross-Site ScriptingCVE-2026-1780 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The [CR]Paid Link Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL path in all versions up to, and including, 0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  [CR]Paid Link Manager

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update [CR]Paid Link Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Mar 17, 2026WP Go Maps (formerly WP Google Maps): Stored Cross-Site ScriptingCVE-2026-4268 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpgmza_custom_js’ parameter in all versions up to, and including, 10.0.05 due to insufficient input sanitization and output escaping and missing capability check in the 'admin_post_wpgmza_save_settings' hook anonymous function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  WP Go Maps (formerly WP Google Maps)

  Affected

  up to 10.0.05

  What to do

  Affects up to 10.0.05. Update WP Go Maps (formerly WP Google Maps) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Mar 16, 2026Flexmls® IDX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25369 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexmls Flexmls® IDX flexmls-idx allows Reflected XSS.This issue affects Flexmls® IDX: from n/a through <= 3.15.9.

  Product

  Flexmls® IDX

  Affected

  up to 3.15.9

  What to do

  Affects up to 3.15.9. Update Flexmls® IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 16, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Unauthorized modification of dataCVE-2026-2233 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the draft_post() function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to modify arbitrary posts (e.g. unpublish published posts and overwrite the contents) via the 'post_id' parameter.

  Product

  User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration

  Affected

  up to 4.2.8

  What to do

  Affects up to 4.2.8. Update User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Mar 13, 2026Calculated Fields Form: Stored Cross-Site ScriptingCVE-2026-3986 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form settings in all versions up to, and including, 5.4.5.0. This is due to insufficient capability checks on the form settings save handler and insufficient input sanitization of the `fcontent` field in `fhtml` field types. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Calculated Fields Form

  Affected

  up to 5.4.5.0

  What to do

  Affects up to 5.4.5.0. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 13, 2026Master Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32462 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows DOM-Based XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.1.3.

  Product

  Master Addons for Elementor

  Affected

  up to 2.1.3

  What to do

  Affects up to 2.1.3. Update Master Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026Ultimate Addons for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32460 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a through <= 3.5.36.

  Product

  Ultimate Addons for Contact Form 7

  Affected

  up to 3.5.36

  What to do

  Affects up to 3.5.36. Update Ultimate Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026MDTF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32455 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows DOM-Based XSS.This issue affects MDTF: from n/a through <= 1.3.5.

  Product

  MDTF

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update MDTF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026Avada Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32454 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Avada Core fusion-core allows DOM-Based XSS.This issue affects Avada Core: from n/a through < 5.15.0.

  Product

  Avada Core

  What to do

  Update Avada Core to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026Active Products Tables for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32450 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows DOM-Based XSS.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.7.

  Product

  Active Products Tables for WooCommerce

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026Themify Event Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32449 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Event Post themify-event-post allows Stored XSS.This issue affects Themify Event Post: from n/a through <= 1.3.4.

  Product

  Themify Event Post

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update Themify Event Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026Podlove Podcast Publisher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32448 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress allows Stored XSS.This issue affects Podlove Podcast Publisher: from n/a through <= 4.3.3.

  Product

  Podlove Podcast Publisher

  Affected

  up to 4.3.3

  What to do

  Affects up to 4.3.3. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026Astra Bulk Edit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32431 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Bulk Edit astra-bulk-edit allows DOM-Based XSS.This issue affects Astra Bulk Edit: from n/a through <= 1.2.10.

  Product

  Astra Bulk Edit

  Affected

  up to 1.2.10

  What to do

  Affects up to 1.2.10. Update Astra Bulk Edit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026PowerPack Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32430 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through <= 2.9.9.

  Product

  PowerPack Addons for Elementor

  Affected

  up to 2.9.9

  What to do

  Affects up to 2.9.9. Update PowerPack Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026Magical Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32429 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through <= 1.4.1.

  Product

  Magical Addons For Elementor

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Magical Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026Sprout Clients: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32424 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Stored XSS.This issue affects Sprout Clients: from n/a through <= 3.2.2.

  Product

  Sprout Clients

  Affected

  up to 3.2.2

  What to do

  Affects up to 3.2.2. Update Sprout Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026List category posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32419 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fernando Briano List category posts list-category-posts allows DOM-Based XSS.This issue affects List category posts: from n/a through <= 0.93.1.

  Product

  List category posts

  Affected

  up to 0.93.1

  What to do

  Affects up to 0.93.1. Update List category posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026Embed Calendly: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32411 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simpma Embed Calendly embed-calendly-scheduling allows Stored XSS.This issue affects Embed Calendly: from n/a through <= 4.4.

  Product

  Embed Calendly

  Affected

  up to 4.4

  What to do

  Affects up to 4.4. Update Embed Calendly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026Toocheke Companion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32403 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in toocheke Toocheke Companion toocheke-companion allows DOM-Based XSS.This issue affects Toocheke Companion: from n/a through <= 1.194.

  Product

  Toocheke Companion

  Affected

  up to 1.194

  What to do

  Affects up to 1.194. Update Toocheke Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026Editorial Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32361 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marketing Fire Editorial Calendar editorial-calendar allows DOM-Based XSS.This issue affects Editorial Calendar: from n/a through <= 3.9.0.

  Product

  Editorial Calendar

  Affected

  up to 3.9.0

  What to do

  Affects up to 3.9.0. Update Editorial Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026Rich Showcase for Google Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32360 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in richplugins Rich Showcase for Google Reviews widget-google-reviews allows Stored XSS.This issue affects Rich Showcase for Google Reviews: from n/a through <= 6.9.4.3.

  Product

  Rich Showcase for Google Reviews

  Affected

  up to 6.9.4.3

  What to do

  Affects up to 6.9.4.3. Update Rich Showcase for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026Icon List Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32359 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XSS.This issue affects Icon List Block: from n/a through <= 1.2.3.

  Product

  Icon List Block

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Icon List Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026Robo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32356 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robosoft Robo Gallery robo-gallery allows DOM-Based XSS.This issue affects Robo Gallery: from n/a through <= 5.1.2.

  Product

  Robo Gallery

  Affected

  up to 5.1.2

  What to do

  Affects up to 5.1.2. Update Robo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026Elementor Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32352 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows DOM-Based XSS.This issue affects Elementor Website Builder: from n/a through <= 3.35.5.

  Product

  Elementor Website Builder

  Affected

  up to 3.35.5

  What to do

  Affects up to 3.35.5. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026PowerPress Podcasting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32351 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blubrry PowerPress Podcasting powerpress allows Stored XSS.This issue affects PowerPress Podcasting: from n/a through <= 11.15.13.

  Product

  PowerPress Podcasting

  Affected

  up to 11.15.13

  What to do

  Affects up to 11.15.13. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026immonex Kickstart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-31918 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in immonex immonex Kickstart immonex-kickstart allows Stored XSS.This issue affects immonex Kickstart: from n/a through <= 1.13.0.

  Product

  immonex Kickstart

  Affected

  up to 1.13.0

  What to do

  Affects up to 1.13.0. Update immonex Kickstart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 13, 2026wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifCVE-2026-22216 · WordPress plugins & themes · reported by VulnCheckMedium 6.9

  wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notification emails to victim accounts.

  Fixed in

  7.6.47

  What to do

  Update the plugin to 7.6.47 or newer.

  Full record and what to do →NVD recordwordpress.orgwordpress.org

• Mar 13, 2026wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML ouCVE-2026-22210 · WordPress plugins & themes · reported by VulnCheckLow 2.1

  wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary JavaScript into img and anchor tag attributes, executing code in the context of WordPress users viewing comments.

  Fixed in

  7.6.47

  What to do

  Update the plugin to 7.6.47 or newer.

  Full record and what to do →NVD recordwordpress.orgwordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.