Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

5,818 results · page 62 of 117

Feb 7, 2025Breaking News Ticker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25094 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amitythemes.com Breaking News Ticker breaking-news-ticker allows Stored XSS.This issue affects Breaking News Ticker: from n/a through <= 2.4.4.
Product
Breaking News Ticker
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Breaking News Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025NextGen Cooliris Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25091 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zackdesign NextGen Cooliris Gallery nextgen-cooliris-gallery allows Stored XSS.This issue affects NextGen Cooliris Gallery: from n/a through <= 0.7.
Product
NextGen Cooliris Gallery
Affected
up to 0.7
What to do
Affects up to 0.7. Update NextGen Cooliris Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025WP SimpleWeather: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25085 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matt_mcbrien WP SimpleWeather wp-simpleweather allows Stored XSS.This issue affects WP SimpleWeather: from n/a through <= 0.2.5.
Product
WP SimpleWeather
Affected
up to 0.2.5
What to do
Affects up to 0.2.5. Update WP SimpleWeather to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025FlexIDX Home Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25082 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Chirkov FlexIDX Home Search flexidx-home-search allows Stored XSS.This issue affects FlexIDX Home Search: from n/a through <= 2.1.2.
Product
FlexIDX Home Search
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update FlexIDX Home Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Kona Gallery Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25080 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gubbigubbi Kona Gallery Block kona-instagram-feed-for-gutenberg allows Stored XSS.This issue affects Kona Gallery Block: from n/a through <= 1.7.
Product
Kona Gallery Block
Affected
up to 1.7
What to do
Affects up to 1.7. Update Kona Gallery Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Simple Select All Text Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25079 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Garrett Grimm Simple Select All Text Box simple-select-all-text-box allows Stored XSS.This issue affects Simple Select All Text Box: from n/a through <= 3.2.
Product
Simple Select All Text Box
Affected
up to 3.2
What to do
Affects up to 3.2. Update Simple Select All Text Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Google Earth Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25078 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrew Norcross Google Earth Embed google-earth-tours allows Stored XSS.This issue affects Google Earth Embed: from n/a through <= 1.0.
Product
Google Earth Embed
Affected
up to 1.0
What to do
Affects up to 1.0. Update Google Earth Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Easy Chart Builder for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25077 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dugbug Easy Chart Builder for WordPress easy-chart-builder allows Stored XSS.This issue affects Easy Chart Builder for WordPress: from n/a through <= 1.3.
Product
Easy Chart Builder for
Affected
up to 1.3
What to do
Affects up to 1.3. Update Easy Chart Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Graceful Email Obfuscation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25076 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicholaswilson Graceful Email Obfuscation graceful-email-obfuscation allows Stored XSS.This issue affects Graceful Email Obfuscation: from n/a through <= 0.2.2.
Product
Graceful Email Obfuscation
Affected
up to 0.2.2
What to do
Affects up to 0.2.2. Update Graceful Email Obfuscation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Easy WP Tiles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25073 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vasilis Triantafyllou Easy WP Tiles easy-wp-tiles allows Stored XSS.This issue affects Easy WP Tiles: from n/a through <= 1.
Product
Easy WP Tiles
Affected
up to 1
What to do
Affects up to 1. Update Easy WP Tiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025WP24 Domain Check: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24602 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP24 WP24 Domain Check wp24-domain-check allows Reflected XSS.This issue affects WP24 Domain Check: from n/a through <= 1.10.14.
Product
WP24 Domain Check
Affected
up to 1.10.14
What to do
Affects up to 1.10.14. Update WP24 Domain Check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Newsletters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24599 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through <= 4.9.9.6.
Product
Newsletters
Affected
up to 4.9.9.6
What to do
Affects up to 4.9.9.6. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025WP Mailster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24598 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.This issue affects WP Mailster: from n/a through <= 1.8.17.0.
Product
WP Mailster
Affected
up to 1.8.17.0
What to do
Affects up to 1.8.17.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Find Content IDs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23645 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Optimize Worldwide Find Content IDs find-content-ids allows Reflected XSS.This issue affects Find Content IDs: from n/a through <= 1.0.
Product
Find Content IDs
Affected
up to 1.0
What to do
Affects up to 1.0. Update Find Content IDs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025World Cup Predictor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22794 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ianhaycox World Cup Predictor world-cup-predictor allows Reflected XSS.This issue affects World Cup Predictor: from n/a through <= 1.9.8.
Product
World Cup Predictor
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update World Cup Predictor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Responsive Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22697 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Reflected XSS.This issue affects Responsive Blocks: from n/a through <= 1.9.9.
Product
Responsive Blocks
Affected
up to 1.9.9
What to do
Affects up to 1.9.9. Update Responsive Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Alert Box Block – Display notice/alerts in the front end: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22675 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Alert Box Block – Display notice/alerts in the front end alert-box-block allows Stored XSS.This issue affects Alert Box Block – Display notice/alerts in the front end: from n/a through <= 1.1.0.
Product
Alert Box Block – Display notice/alerts in the front end
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Alert Box Block – Display notice/alerts in the front end to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Product Blocks for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22674 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Product Blocks for WooCommerce product-blocks-for-woocommerce allows Stored XSS.This issue affects Product Blocks for WooCommerce: from n/a through <= 1.9.1.
Product
Product Blocks for WooCommerce
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Product Blocks for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Survey Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22664 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.3.5.
Product
Survey Maker
Affected
up to 5.1.3.5
What to do
Affects up to 5.1.3.5. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025SendPulse Email Marketing Newsletter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22662 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Stored XSS.This issue affects SendPulse Email Marketing Newsletter: from n/a through <= 2.1.5.
Product
SendPulse Email Marketing Newsletter
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update SendPulse Email Marketing Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Music Press Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22653 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tuyennv Music Press Pro music-press-pro allows Stored XSS.This issue affects Music Press Pro: from n/a through <= 1.4.6.
Product
Music Press Pro
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Music Press Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Dynamic Conditions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22642 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtowebsites Dynamic Conditions dynamicconditions allows Stored XSS.This issue affects Dynamic Conditions: from n/a through <= 1.7.4.
Product
Dynamic Conditions
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update Dynamic Conditions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025FM Notification Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22641 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prem Tiwari FM Notification Bar fm-notification-bar allows Stored XSS.This issue affects FM Notification Bar: from n/a through <= 1.0.4.
Product
FM Notification Bar
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update FM Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025WPJobBoard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24781 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WPJobBoard allows Reflected XSS. This issue affects WPJobBoard: from n/a through 5.10.1.
Product
WPJobBoard
Affected
up to 5.10.1
What to do
Affects up to 5.10.1. Update WPJobBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24707 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Reflected XSS.This issue affects Photo Gallery: from n/a through <= 2.7.7.24.
Product
Photo Gallery
Affected
up to 2.7.7.24
What to do
Affects up to 2.7.7.24. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Media Downloader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24684 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ederson Peka Media Downloader media-downloader allows Reflected XSS.This issue affects Media Downloader: from n/a through <= 0.4.7.5.
Product
Media Downloader
Affected
up to 0.4.7.5
What to do
Affects up to 0.4.7.5. Update Media Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Custom WP Store Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24676 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in umangmetatagg Custom WP Store Locator custom-store-locator allows Reflected XSS.This issue affects Custom WP Store Locator: from n/a through <= 1.4.7.
Product
Custom WP Store Locator
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Custom WP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Simple Membership Custom Messages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24660 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership Custom Messages simple-membership-custom-messages allows Reflected XSS.This issue affects Simple Membership Custom Messages: from n/a through <= 2.4.
Product
Simple Membership Custom Messages
Affected
up to 2.4
What to do
Affects up to 2.4. Update Simple Membership Custom Messages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Realtyna Provisioning: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24656 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Realtyna Realtyna Provisioning realtyna-provisioning allows Reflected XSS.This issue affects Realtyna Provisioning: from n/a through <= 1.2.2.
Product
Realtyna Provisioning
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Realtyna Provisioning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025XML for Avito: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24646 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc XML for Avito xml-for-avito allows Reflected XSS.This issue affects XML for Avito: from n/a through <= 2.5.2.
Product
XML for Avito
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update XML for Avito to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025BP Email Assign Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24631 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Reflected XSS.This issue affects BP Email Assign Templates: from n/a through <= 1.5.
Product
BP Email Assign Templates
Affected
up to 1.5
What to do
Affects up to 1.5. Update BP Email Assign Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Sikshya LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24630 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MantraBrain Sikshya LMS sikshya allows Reflected XSS.This issue affects Sikshya LMS: from n/a through <= 0.0.21.
Product
Sikshya LMS
Affected
up to 0.0.21
What to do
Affects up to 0.0.21. Update Sikshya LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Import Excel to Gravity Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24629 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpgear Import Excel to Gravity Forms gf-excel-import allows Reflected XSS.This issue affects Import Excel to Gravity Forms: from n/a through <= 1.18.
Product
Import Excel to Gravity Forms
Affected
up to 1.18
What to do
Affects up to 1.18. Update Import Excel to Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025AIO Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24620 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hkharpreetkumar1 AIO Shortcodes aio-shortcodes allows Stored XSS.This issue affects AIO Shortcodes: from n/a through <= 1.3.
Product
AIO Shortcodes
Affected
up to 1.3
What to do
Affects up to 1.3. Update AIO Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Landing Page Cat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24576 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Landing Page Cat landing-page-cat allows Reflected XSS.This issue affects Landing Page Cat: from n/a through <= 1.7.7.
Product
Landing Page Cat
Affected
up to 1.7.7
What to do
Affects up to 1.7.7. Update Landing Page Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025PeproDev WooCommerce Receipt Uploader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24574 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev WooCommerce Receipt Uploader pepro-bacs-receipt-upload-for-woocommerce allows Reflected XSS.This issue affects PeproDev WooCommerce Receipt Uploader: from n/a through <= 2.6.9.
Product
PeproDev WooCommerce Receipt Uploader
Affected
up to 2.6.9
What to do
Affects up to 2.6.9. Update PeproDev WooCommerce Receipt Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025WP Mailster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24559 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.This issue affects WP Mailster: from n/a through <= 1.8.15.0.
Product
WP Mailster
Affected
up to 1.8.15.0
What to do
Affects up to 1.8.15.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025PlainInventory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24557 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware PlainInventory z-inventory-manager allows Reflected XSS.This issue affects PlainInventory: from n/a through <= 3.1.5.
Product
PlainInventory
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update PlainInventory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025BSK Forms Validation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24545 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK Forms Validation bsk-gravity-forms-custom-validation allows Reflected XSS.This issue affects BSK Forms Validation: from n/a through <= 1.7.
Product
BSK Forms Validation
Affected
up to 1.7
What to do
Affects up to 1.7. Update BSK Forms Validation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Bitcoin and Altcoin Wallets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24544 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashed-slug.net Bitcoin and Altcoin Wallets wallets allows Reflected XSS.This issue affects Bitcoin and Altcoin Wallets: from n/a through <= 6.3.1.
Product
Bitcoin and Altcoin Wallets
Affected
up to 6.3.1
What to do
Affects up to 6.3.1. Update Bitcoin and Altcoin Wallets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025DK White Label: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24541 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dinamiko DK White Label dk-white-label allows Reflected XSS.This issue affects DK White Label: from n/a through <= 1.0.
Product
DK White Label
Affected
up to 1.0
What to do
Affects up to 1.0. Update DK White Label to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025ThriveDesk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24536 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThriveDesk ThriveDesk thrivedesk allows Reflected XSS.This issue affects ThriveDesk: from n/a through <= 2.0.6.
Product
ThriveDesk
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update ThriveDesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Dynamic URL SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23984 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainvireinfo Dynamic URL SEO dynamic-url-seo allows Reflected XSS.This issue affects Dynamic URL SEO: from n/a through <= 1.0.
Product
Dynamic URL SEO
Affected
up to 1.0
What to do
Affects up to 1.0. Update Dynamic URL SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Lockets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23923 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wackey Lockets lockets allows Reflected XSS.This issue affects Lockets: from n/a through <= 0.999.
Product
Lockets
Affected
up to 0.999
What to do
Affects up to 0.999. Update Lockets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025ApplicantPro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23920 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sourcing Team ApplicantPro applicantpro allows Reflected XSS.This issue affects ApplicantPro: from n/a through <= 1.3.9.
Product
ApplicantPro
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update ApplicantPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025.TUBE Video Curator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23799 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tubegtld .TUBE Video Curator tube-video-curator allows Reflected XSS.This issue affects .TUBE Video Curator: from n/a through <= 1.1.9.
Product
.TUBE Video Curator
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update .TUBE Video Curator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025PAFacile: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23755 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tosend.it PAFacile pafacile allows Reflected XSS.This issue affects PAFacile: from n/a through <= 2.6.1.
Product
PAFacile
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update PAFacile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Awesome Timeline: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23747 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nitesh Awesome Timeline awesome-timeline allows Stored XSS.This issue affects Awesome Timeline: from n/a through <= 1.0.1.
Product
Awesome Timeline
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Awesome Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025RomanCart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23685 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebTechGlobal RomanCart romancart-on-wordpress allows Reflected XSS.This issue affects RomanCart: from n/a through <= 0.0.2.
Product
RomanCart
Affected
up to 0.0.2
What to do
Affects up to 0.0.2. Update RomanCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025WordPress Additional Logins: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23614 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in niksudan WordPress Additional Logins wp-additional-logins allows Reflected XSS.This issue affects WordPress Additional Logins: from n/a through <= 1.0.0.
Product
WordPress Additional Logins
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WordPress Additional Logins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.