Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

570new WordPress flaws this week

391,397entries in the database

5,858 results · page 66 of 118

Jan 23, 2025FLX Dashboard Groups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23730 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flx0 FLX Dashboard Groups flx-dashboard-groups allows Reflected XSS.This issue affects FLX Dashboard Groups: from n/a through <= 0.0.7.
Product
FLX Dashboard Groups
Affected
up to 0.0.7
What to do
Affects up to 0.0.7. Update FLX Dashboard Groups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025XTRA Settings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23729 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fures XTRA Settings xtra-settings allows Reflected XSS.This issue affects XTRA Settings: from n/a through <= 2.1.8.
Product
XTRA Settings
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update XTRA Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025AZ Content Finder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23727 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antonzaroutski AZ Content Finder az-content-finder allows Reflected XSS.This issue affects AZ Content Finder: from n/a through <= 0.1.
Product
AZ Content Finder
Affected
up to 0.1
What to do
Affects up to 0.1. Update AZ Content Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025Accessibility Task Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23725 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pshikli Accessibility Task Manager accessibility-task-manager allows Reflected XSS.This issue affects Accessibility Task Manager: from n/a through <= 1.2.1.
Product
Accessibility Task Manager
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Accessibility Task Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025University Quizzes Online: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23724 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oleksandr87 University Quizzes Online university-quizzes-online allows Reflected XSS.This issue affects University Quizzes Online: from n/a through <= 1.4.
Product
University Quizzes Online
Affected
up to 1.4
What to do
Affects up to 1.4. Update University Quizzes Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025Plestar Directory Listing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23723 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hdw player Plestar Directory Listing plestar-directory-listing allows Reflected XSS.This issue affects Plestar Directory Listing: from n/a through <= 1.0.
Product
Plestar Directory Listing
Affected
up to 1.0
What to do
Affects up to 1.0. Update Plestar Directory Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025Mind3doM RyeBread Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23722 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mind3dom Mind3doM RyeBread Widgets mind3dom-ryebread-widgets allows Reflected XSS.This issue affects Mind3doM RyeBread Widgets: from n/a through <= 1.0.
Product
Mind3doM RyeBread Widgets
Affected
up to 1.0
What to do
Affects up to 1.0. Update Mind3doM RyeBread Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025My Favorite Car: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23636 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitar A. My Favorite Car my-favorite-cars allows Reflected XSS.This issue affects My Favorite Car: from n/a through <= 1.0.
Product
My Favorite Car
Affected
up to 1.0
What to do
Affects up to 1.0. Update My Favorite Car to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025Youtube Video Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23634 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codehandling Youtube Video Grid youmax-channel-embeds-for-youtube-businesses allows Reflected XSS.This issue affects Youtube Video Grid: from n/a through <= 1.9.
Product
Youtube Video Grid
Affected
up to 1.9
What to do
Affects up to 1.9. Update Youtube Video Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025Gallerio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23629 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Subhasis Laha Gallerio gallerio allows Reflected XSS.This issue affects Gallerio: from n/a through <= 1.0.1.
Product
Gallerio
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Gallerio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025GeoDigs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23628 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NewMediaOne GeoDigs geodigs allows Reflected XSS.This issue affects GeoDigs: from n/a through <= 3.4.1.
Product
GeoDigs
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update GeoDigs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025Kumihimo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23626 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fukushima Kumihimo kumihimo allows Reflected XSS.This issue affects Kumihimo: from n/a through <= 1.0.2.
Product
Kumihimo
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Kumihimo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025WpDevTool: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23624 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alessandro Benoit WpDevTool wpdevtool allows Reflected XSS.This issue affects WpDevTool: from n/a through <= 0.1.1.
Product
WpDevTool
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update WpDevTool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025WP Social Broadcast: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23545 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Navnish Bhardwaj WP Social Broadcast wp-social-broadcast allows Reflected XSS.This issue affects WP Social Broadcast: from n/a through <= 1.0.0.
Product
WP Social Broadcast
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Social Broadcast to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025StatPressCN: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23544 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in heart5 StatPressCN statpresscn allows Reflected XSS.This issue affects StatPressCN: from n/a through <= 1.9.1.
Product
StatPressCN
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update StatPressCN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025Download, Downloads: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23541 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in edmon.parker Download, Downloads ydn-download allows Reflected XSS.This issue affects Download, Downloads : from n/a through <= 1.4.2.
Product
Download, Downloads
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Download, Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025WP Front-end login and register: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23540 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mohsin Khan WP Front-end login and register wp-front-end-login-and-register allows Reflected XSS.This issue affects WP Front-end login and register: from n/a through <= 2.1.0.
Product
WP Front-end login and register
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WP Front-end login and register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025WP Query Creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22264 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Patel WP Query Creator wp-query-creator allows Reflected XSS.This issue affects WP Query Creator: from n/a through <= 1.0.
Product
WP Query Creator
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Query Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Toocheke Companion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23992 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in toocheke Toocheke Companion toocheke-companion allows Stored XSS.This issue affects Toocheke Companion: from n/a through <= 1.166.
Product
Toocheke Companion
Affected
up to 1.166
What to do
Affects up to 1.166. Update Toocheke Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Blue Wrench Video Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23809 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sunil Nanda Blue Wrench Video Widget blue-wrench-videos-widget allows Reflected XSS.This issue affects Blue Wrench Video Widget: from n/a through <= 2.1.0.
Product
Blue Wrench Video Widget
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Blue Wrench Video Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025a Gateway for Pasargad Bank on WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23966 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ala Falaki a Gateway for Pasargad Bank on WooCommerce a-gateway-for-pasargad-bank-on-woocommerce allows Reflected XSS.This issue affects a Gateway for Pasargad Bank on WooCommerce: from n/a through <= 2.5.2.
Product
a Gateway for Pasargad Bank on WooCommerce
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update a Gateway for Pasargad Bank on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Good Old Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23959 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linus Lundahl Good Old Gallery good-old-gallery allows Reflected XSS.This issue affects Good Old Gallery: from n/a through <= 2.1.2.
Product
Good Old Gallery
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Good Old Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WP Download Codes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23882 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in misanthrop WP Download Codes wp-download-codes allows Reflected XSS.This issue affects WP Download Codes: from n/a through <= 2.5.4.
Product
WP Download Codes
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update WP Download Codes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WP Block Pack: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23874 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FalconTheme Team WP Block Pack wp-block-pack allows Reflected XSS.This issue affects WP Block Pack: from n/a through <= 1.1.6.
Product
WP Block Pack
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update WP Block Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WordPress File Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23867 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markcoker WordPress File Search wpfilesearch allows Reflected XSS.This issue affects WordPress File Search: from n/a through <= 1.2.
Product
WordPress File Search
Affected
up to 1.2
What to do
Affects up to 1.2. Update WordPress File Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025EU DSGVO Helper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23866 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E. Marten EU DSGVO Helper dsgvo allows Reflected XSS.This issue affects EU DSGVO Helper: from n/a through <= 1.0.6.1.
Product
EU DSGVO Helper
Affected
up to 1.0.6.1
What to do
Affects up to 1.0.6.1. Update EU DSGVO Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Flexible Blogtitle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23846 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thaikolja Flexible Blogtitle flexible-blogtitle allows Reflected XSS.This issue affects Flexible Blogtitle: from n/a through <= 0.1.
Product
Flexible Blogtitle
Affected
up to 0.1
What to do
Affects up to 0.1. Update Flexible Blogtitle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Contact Form 7 Round Robin Lead Distribution: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23812 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Jeffrey Contact Form 7 Round Robin Lead Distribution contact-form-7-round-robin-lead-distribution allows Reflected XSS.This issue affects Contact Form 7 Round Robin Lead Distribution: from n/a through <= 1.2.1.
Product
Contact Form 7 Round Robin Lead Distribution
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Contact Form 7 Round Robin Lead Distribution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WP2APP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23811 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ghasemy14 WP2APP wp2appir allows Reflected XSS.This issue affects WP2APP: from n/a through <= 2.6.2.
Product
WP2APP
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update WP2APP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Mass Messaging in BuddyPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23798 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ElbowRobo Mass Messaging in BuddyPress mass-messaging-in-buddypress allows Reflected XSS.This issue affects Mass Messaging in BuddyPress: from n/a through <= 2.2.1.
Product
Mass Messaging in BuddyPress
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Mass Messaging in BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Fast Tube: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23770 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caspie Fast Tube fast-tube allows Reflected XSS.This issue affects Fast Tube: from n/a through <= 2.3.1.
Product
Fast Tube
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Fast Tube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Content Mirror: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23769 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dreamsofmatter Content Mirror content-mirror allows Reflected XSS.This issue affects Content Mirror: from n/a through <= 1.2.
Product
Content Mirror
Affected
up to 1.2
What to do
Affects up to 1.2. Update Content Mirror to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025InFunding: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23768 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in inwavethemes InFunding infunding allows Reflected XSS.This issue affects InFunding: from n/a through <= 1.0.
Product
InFunding
Affected
up to 1.0
What to do
Affects up to 1.0. Update InFunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Pootle button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23758 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pootlepress Pootle button pootle-button allows Reflected XSS.This issue affects Pootle button: from n/a through <= 1.2.0.
Product
Pootle button
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Pootle button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025CMC MIGRATE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23746 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edem CMC MIGRATE cmc-migrate allows Reflected XSS.This issue affects CMC MIGRATE: from n/a through <= 0.0.3.
Product
CMC MIGRATE
Affected
up to 0.0.3
What to do
Affects up to 0.0.3. Update CMC MIGRATE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Easy Filtering: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23732 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in franciscopalacios Easy Filtering easy-filtering allows Reflected XSS.This issue affects Easy Filtering: from n/a through <= 2.5.0.
Product
Easy Filtering
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Easy Filtering to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Formatted post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23709 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kiroro Formatted post formatted-post allows Reflected XSS.This issue affects Formatted post: from n/a through <= 1.01.
Product
Formatted post
Affected
up to 1.01
What to do
Affects up to 1.01. Update Formatted post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Jet Skinner for BuddyPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23706 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in milordk Jet Skinner for BuddyPress jet-skinner-for-buddypress allows Reflected XSS.This issue affects Jet Skinner for BuddyPress: from n/a through <= 1.2.5.
Product
Jet Skinner for BuddyPress
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Jet Skinner for BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Lime Developer Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23701 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in limesquare Lime Developer Login lime-developer-login allows Reflected XSS.This issue affects Lime Developer Login: from n/a through <= 1.4.0.
Product
Lime Developer Login
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Lime Developer Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025yCyclista: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23700 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonisink yCyclista ycyclista allows Reflected XSS.This issue affects yCyclista: from n/a through <= 1.2.3.
Product
yCyclista
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update yCyclista to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Podčlánková inzerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23697 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webdeal Podčlánková inzerce podclankova-inzerce allows Reflected XSS.This issue affects Podčlánková inzerce: from n/a through <= 2.4.0.
Product
Podčlánková inzerce
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update Podčlánková inzerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Staging CDN: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23696 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronan Mockett Staging CDN staging-cdn allows Reflected XSS.This issue affects Staging CDN: from n/a through <= 1.0.0.
Product
Staging CDN
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Staging CDN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025CtyGrid Hyp3rL0cal Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23695 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kinlane CtyGrid Hyp3rL0cal Search hyp3rl0cal-city-search allows Reflected XSS.This issue affects CtyGrid Hyp3rL0cal Search: from n/a through <= 0.1.1.1.
Product
CtyGrid Hyp3rL0cal Search
Affected
up to 0.1.1.1
What to do
Affects up to 0.1.1.1. Update CtyGrid Hyp3rL0cal Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Admin Menu Organizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23686 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phpdevca Admin Menu Organizer admin-menu-organizer allows Reflected XSS.This issue affects Admin Menu Organizer: from n/a through <= 1.0.1.
Product
Admin Menu Organizer
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Admin Menu Organizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025MACME: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23683 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xdxdVSxdxd MACME macme allows Reflected XSS.This issue affects MACME: from n/a through <= 1.2.
Product
MACME
Affected
up to 1.2
What to do
Affects up to 1.2. Update MACME to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Preloader Quotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23682 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bhuvnesh Gupta Preloader Quotes preloader-quotes allows Reflected XSS.This issue affects Preloader Quotes: from n/a through <= 1.0.0.
Product
Preloader Quotes
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Preloader Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025REDIRECTION PLUS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23681 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat REDIRECTION PLUS redirection-plus allows Reflected XSS.This issue affects REDIRECTION PLUS: from n/a through <= 2.0.0.
Product
REDIRECTION PLUS
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update REDIRECTION PLUS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025FP RSS Category Excluder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23679 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flourish Pixel FP RSS Category Excluder fp-rss-category-excluder allows Reflected XSS.This issue affects FP RSS Category Excluder: from n/a through <= 1.0.0.
Product
FP RSS Category Excluder
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update FP RSS Category Excluder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025LocalGrid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23678 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Imranur Rahman LocalGrid localgrid allows Reflected XSS.This issue affects LocalGrid: from n/a through <= 1.0.1.
Product
LocalGrid
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update LocalGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025LH Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23676 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH Email lh-email allows Reflected XSS.This issue affects LH Email: from n/a through <= 1.12.
Product
LH Email
Affected
up to 1.12
What to do
Affects up to 1.12. Update LH Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.