Vulnerability database

9,243 results · page 74 of 185

• May 23, 2025WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31056 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce WhatsCart-for-WooCommerce allows SQL Injection.This issue affects WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce: from n/a through <= 1.1.0.

  Product

  WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025KBx Pro Ultimate: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31053 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Path Traversal.This issue affects KBx Pro Ultimate: from n/a through < 8.0.5.

  Product

  KBx Pro Ultimate

  What to do

  Update KBx Pro Ultimate to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• May 20, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in varioCVE-2024-5878 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2025WPAMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39395 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).

  Product

  WPAMS

  Affected

  up to 44.0

  What to do

  Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Hospital Management System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39393 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla Hospital Management System hospital-management allows Reflected XSS.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-2023).

  Product

  Hospital Management System

  Affected

  up to 47.0

  What to do

  Affects up to 47.0. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WPAMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39392 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPAMS apartment-management allows Reflected XSS.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).

  Product

  WPAMS

  Affected

  up to 44.0

  What to do

  Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025AnalyticsWP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39389 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solid Plugins AnalyticsWP allows SQL Injection.This issue affects AnalyticsWP: from n/a through 2.1.2.

  Product

  AnalyticsWP

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update AnalyticsWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Hospital Management System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39386 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla Hospital Management System hospital-management allows SQL Injection.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-2023).

  Product

  Hospital Management System

  Affected

  up to 47.0

  What to do

  Affects up to 47.0. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WordPress Events Calendar Registration & Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39372 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Reflected XSS.This issue affects WordPress Events Calendar Registration & Tickets: from n/a through <= 2.6.0.

  Product

  WordPress Events Calendar Registration & Tickets

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update WordPress Events Calendar Registration & Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025wProject: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39365 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rocket Apps wProject allows Reflected XSS.This issue affects wProject: from n/a before 5.8.0.

  Product

  wProject

  Fixed in

  5.8.0

  What to do

  Update wProject to 5.8.0 or newer.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Hospital Management System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39357 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla Hospital Management System hospital-management allows SQL Injection.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-2023).

  Product

  Hospital Management System

  Affected

  up to 47.0

  What to do

  Affects up to 47.0. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025FAT Services Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39355 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp FAT Services Booking fat-services-booking allows SQL Injection.This issue affects FAT Services Booking: from n/a through <= 5.6.

  Product

  FAT Services Booking

  Affected

  up to 5.6

  What to do

  Affects up to 5.6. Update FAT Services Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Grand Restaurant: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32926 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Path Traversal.This issue affects Grand Restaurant: from n/a through <= 7.0.

  Product

  Grand Restaurant

  Affected

  up to 7.0

  What to do

  Affects up to 7.0. Update Grand Restaurant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025SUMO Reward Points: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32925 · WordPress plugins & themes · reported by PatchstackHigh 8.3

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FantasticPlugins SUMO Reward Points rewardsystem allows PHP Local File Inclusion.This issue affects SUMO Reward Points: from n/a through <= 30.7.0.

  Product

  SUMO Reward Points

  Affected

  up to 30.7.0

  What to do

  Affects up to 30.7.0. Update SUMO Reward Points to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Revy: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32924 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp Revy revy allows SQL Injection.This issue affects Revy: from n/a through <= 2.1.

  Product

  Revy

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Revy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Tiger: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31027 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jocoxdesign Tiger tiger allows Reflected XSS.This issue affects Tiger: from n/a through 2.0.

  Product

  Tiger

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Tiger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025BP Messages Tool: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43839 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Messages Tool bp-messages-tool allows Reflected XSS.This issue affects BP Messages Tool: from n/a through <= 2.2.

  Product

  BP Messages Tool

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update BP Messages Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Total Donations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43837 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in binti76 Total Donations total-donations allows Reflected XSS.This issue affects Total Donations: from n/a through <= 3.0.8.

  Product

  Total Donations

  Affected

  up to 3.0.8

  What to do

  Affects up to 3.0.8. Update Total Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Syndicate Out: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43836 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in confuzzledduck Syndicate Out syndicate-out allows Reflected XSS.This issue affects Syndicate Out: from n/a through <= 0.9.

  Product

  Syndicate Out

  Affected

  up to 0.9

  What to do

  Affects up to 0.9. Update Syndicate Out to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Remote Images Grabber: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43832 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andreyk Remote Images Grabber remote-images-grabber allows Reflected XSS.This issue affects Remote Images Grabber: from n/a through <= 0.6.

  Product

  Remote Images Grabber

  Affected

  up to 0.6

  What to do

  Affects up to 0.6. Update Remote Images Grabber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Foton: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39458 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Foton foton allows PHP Local File Inclusion.This issue affects Foton: from n/a through <= 2.5.2.

  Product

  Foton

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update Foton to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Booster Plus for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39446 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl LLC Booster Plus for WooCommerce allows Reflected XSS.This issue affects Booster Plus for WooCommerce: from n/a through 7.2.4.

  Product

  Booster Plus for WooCommerce

  Affected

  up to 7.2.4

  What to do

  Affects up to 7.2.4. Update Booster Plus for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Super Store Finder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39445 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through <= 7.2.

  Product

  Super Store Finder

  Affected

  up to 7.2

  What to do

  Affects up to 7.2. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WhatsApp Click to Chat Plugin for: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39411 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Indie_Plugins WhatsApp Click to Chat Plugin for WordPress wpt-whatsapp.This issue affects WhatsApp Click to Chat Plugin for WordPress: from n/a through <= 2.2.12.

  Product

  WhatsApp Click to Chat Plugin for

  Affected

  up to 2.2.12

  What to do

  Affects up to 2.2.12. Update WhatsApp Click to Chat Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WordPress Video Robot - The Ultimate Video Importer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39409 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pressaholic WordPress Video Robot - The Ultimate Video Importer.This issue affects WordPress Video Robot - The Ultimate Video Importer: from n/a through 1.20.0.

  Product

  WordPress Video Robot - The Ultimate Video Importer

  Affected

  up to 1.20.0

  What to do

  Affects up to 1.20.0. Update WordPress Video Robot - The Ultimate Video Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Memberpress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39407 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caseproof, LLC Memberpress allows Reflected XSS.This issue affects Memberpress: from n/a before 1.12.0.

  Product

  Memberpress

  Fixed in

  1.12.0

  What to do

  Update Memberpress to 1.12.0 or newer.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WPAMS: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39406 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPAMS apartment-management allows PHP Local File Inclusion.This issue affects WPAMS: from n/a through <= 44.0.

  Product

  WPAMS

  Affected

  up to 44.0

  What to do

  Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WPAMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39403 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).

  Product

  WPAMS

  Affected

  up to 44.0

  What to do

  Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WP Vegas: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43841 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jamesdbruner WP Vegas vegas-fullscreen-background-slider allows Stored XSS.This issue affects WP Vegas: from n/a through <= 2.2.

  Product

  WP Vegas

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update WP Vegas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025cookieBAR: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43834 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tox82 cookieBAR cookiebar allows Stored XSS.This issue affects cookieBAR: from n/a through <= 1.7.0.

  Product

  cookieBAR

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update cookieBAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Absolute Links: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-43833 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amir Helzer Absolute Links absolute-links allows Blind SQL Injection.This issue affects Absolute Links: from n/a through <= 1.1.1.

  Product

  Absolute Links

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Absolute Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025JetTabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39450 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.7.

  Product

  JetTabs

  Affected

  up to 2.2.7

  What to do

  Affects up to 2.2.7. Update JetTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39448 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.4.1.

  Product

  JetElements For Elementor

  Affected

  up to 2.7.4.1

  What to do

  Affects up to 2.7.4.1. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025JetReviews: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39396 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through <= 2.3.6.

  Product

  JetReviews

  Affected

  up to 2.3.6

  What to do

  Affects up to 2.3.6. Update JetReviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Wireless Butler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26997 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in validas Wireless Butler wireless-butler allows Reflected XSS.This issue affects Wireless Butler: from n/a through <= 1.0.11.

  Product

  Wireless Butler

  Affected

  up to 1.0.11

  What to do

  Affects up to 1.0.11. Update Wireless Butler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Grip: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26735 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Candid themes Grip.This issue affects Grip: from n/a through 1.0.9.

  Product

  Grip

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Grip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Bimber - Viral Magazine: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47576 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Bringthepixel Bimber - Viral Magazine WordPress Theme.This issue affects Bimber - Viral Magazine WordPress Theme: from n/a through 9.2.5.

  Product

  Bimber - Viral Magazine

  Affected

  up to 9.2.5

  What to do

  Affects up to 9.2.5. Update Bimber - Viral Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Enhanced Paypal Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46543 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CharlyLeetham Enhanced Paypal Shortcodes enhanced-paypal-shortcodes allows Stored XSS.This issue affects Enhanced Paypal Shortcodes: from n/a through <= 0.5a.

  Product

  Enhanced Paypal Shortcodes

  Affected

  up to 0.5a

  What to do

  Affects up to 0.5a. Update Enhanced Paypal Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Author Box After Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46263 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lloyd Saunders Author Box After Posts author-box-after-posts allows Stored XSS.This issue affects Author Box After Posts: from n/a through <= 1.6.

  Product

  Author Box After Posts

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Author Box After Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Mad Mimi for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46262 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz Mad Mimi for WordPress mad-mimi allows Stored XSS.This issue affects Mad Mimi for WordPress: from n/a through <= 1.5.1.

  Product

  Mad Mimi for

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update Mad Mimi for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025iCafe Library: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39370 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cnilsson iCafe Library icafe-library allows SQL Injection.This issue affects iCafe Library: from n/a through <= 1.8.3.

  Product

  iCafe Library

  Affected

  up to 1.8.3

  What to do

  Affects up to 1.8.3. Update iCafe Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Posts for Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39369 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sihibbs Posts for Page posts-for-page allows DOM-Based XSS.This issue affects Posts for Page: from n/a through <= 2.1.

  Product

  Posts for Page

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Posts for Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Product Category Slider for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39364 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PluginEver Product Category Slider for WooCommerce woo-category-slider-by-pluginever allows PHP Local File Inclusion.This issue affects Product Category Slider for WooCommerce: from n/a through <= 4.3.4.

  Product

  Product Category Slider for WooCommerce

  Affected

  up to 4.3.4

  What to do

  Affects up to 4.3.4. Update Product Category Slider for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025TI WooCommerce Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32920 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.

  Product

  TI WooCommerce Wishlist

  Affected

  up to 2.10.0

  What to do

  Affects up to 2.10.0. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Ghostwriter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23988 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruno Cavalcante Ghostwriter allows Reflected XSS.This issue affects Ghostwriter: from n/a through 1.4.

  Product

  Ghostwriter

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Ghostwriter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Tiki Time: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23986 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fyrewurks Tiki Time allows Reflected XSS.This issue affects Tiki Time: from n/a through 1.3.

  Product

  Tiki Time

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Tiki Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Tijaji: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23983 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tijaji Tijaji tijaji allows Reflected XSS.This issue affects Tijaji: from n/a through <= 1.43.

  Product

  Tijaji

  Affected

  up to 1.43

  What to do

  Affects up to 1.43. Update Tijaji to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025CarZine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23981 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takimi Themes CarZine allows Reflected XSS.This issue affects CarZine: from n/a through 1.4.6.

  Product

  CarZine

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update CarZine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Flashy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23979 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in duwasai Flashy allows Reflected XSS.This issue affects Flashy: from n/a through 1.2.1.

  Product

  Flashy

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Flashy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Js O3 Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22792 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jinwen Js O3 Lite allows Reflected XSS.This issue affects Js O3 Lite: from n/a through 1.5.8.2.

  Product

  Js O3 Lite

  Affected

  up to 1.5.8.2

  What to do

  Affects up to 1.5.8.2. Update Js O3 Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.