Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

6,573 results · page 75 of 132

Jan 16, 2025Yet Another Countdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23891 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Loy Yet Another Countdown yacp allows DOM-Based XSS.This issue affects Yet Another Countdown: from n/a through <= 1.0.1.
Product
Yet Another Countdown
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Yet Another Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Easy Tweet Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23890 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tom Ewer Easy Tweet Embed easy-tweet-embed allows DOM-Based XSS.This issue affects Easy Tweet Embed: from n/a through <= 1.7.
Product
Easy Tweet Embed
Affected
up to 1.7
What to do
Affects up to 1.7. Update Easy Tweet Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Blog Summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23887 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scottwallick Blog Summary blog-summary allows Stored XSS.This issue affects Blog Summary: from n/a through <= 0.1.2 β.
Product
Blog Summary
Affected
up to 0.1.2
What to do
Affects up to 0.1.2. Update Blog Summary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Annie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23886 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Roberts Annie annie allows Stored XSS.This issue affects Annie: from n/a through <= 2.1.1.
Product
Annie
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Annie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Post-to-Post Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23878 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Reilly Post-to-Post Links easy-post-to-post-links allows Stored XSS.This issue affects Post-to-Post Links: from n/a through <= 4.2.
Product
Post-to-Post Links
Affected
up to 4.2
What to do
Affects up to 4.2. Update Post-to-Post Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Nite Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23877 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nitethemes Nite Shortcodes nite-shortcodes allows Stored XSS.This issue affects Nite Shortcodes: from n/a through <= 1.0.
Product
Nite Shortcodes
Affected
up to 1.0
What to do
Affects up to 1.0. Update Nite Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025WP krpano: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23876 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in No-Nonsense WP krpano wp-krpano allows Stored XSS.This issue affects WP krpano: from n/a through <= 1.2.1.
Product
WP krpano
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update WP krpano to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Category D3 Tree: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23873 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anshi Solutions Category D3 Tree category-d3-tree allows Stored XSS.This issue affects Category D3 Tree: from n/a through <= 1.1.
Product
Category D3 Tree
Affected
up to 1.1
What to do
Affects up to 1.1. Update Category D3 Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Chess Tempo Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23868 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mliebelt Chess Tempo Viewer chesstempoviewer allows Stored XSS.This issue affects Chess Tempo Viewer: from n/a through <= 0.9.5.
Product
Chess Tempo Viewer
Affected
up to 0.9.5
What to do
Affects up to 0.9.5. Update Chess Tempo Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Winning Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23865 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pressfore Winning Portfolio winning-portfolio allows Stored XSS.This issue affects Winning Portfolio: from n/a through <= 1.1.
Product
Winning Portfolio
Affected
up to 1.1
What to do
Affects up to 1.1. Update Winning Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025WCS QR Code Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23864 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Luke America WCS QR Code Generator wcs-qr-code-generator allows Stored XSS.This issue affects WCS QR Code Generator: from n/a through <= 1.0.
Product
WCS QR Code Generator
Affected
up to 1.0
What to do
Affects up to 1.0. Update WCS QR Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Rollover Tab: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23863 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sabaoh Rollover Tab rollover-tab allows Stored XSS.This issue affects Rollover Tab: from n/a through <= 1.3.2.
Product
Rollover Tab
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Rollover Tab to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Charity-thermometer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23860 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crea8xion Charity-thermometer charitydonation-thermometer allows Stored XSS.This issue affects Charity-thermometer: from n/a through <= 1.1.2.
Product
Charity-thermometer
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Charity-thermometer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Daily Proverb: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23859 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jd7777 Daily Proverb daily-proverb allows Stored XSS.This issue affects Daily Proverb: from n/a through <= 2.0.3.
Product
Daily Proverb
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Daily Proverb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Simple Vertical Timeline: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23856 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Odyno Simple Vertical Timeline simple-vertical-timeline allows DOM-Based XSS.This issue affects Simple Vertical Timeline: from n/a through <= 0.1.
Product
Simple Vertical Timeline
Affected
up to 0.1
What to do
Affects up to 0.1. Update Simple Vertical Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23854 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yesstreamingdev Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com shoutcast-and-icecast-html5-web-radio-player-by-yesstreaming-com allows Stored XSS.This issue affects Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com: from n/a through <= 3.3.
Product
Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com
Affected
up to 3.3
What to do
Affects up to 3.3. Update Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Top Flash Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23841 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foo123 Top Flash Embed top-flash-embed allows Stored XSS.This issue affects Top Flash Embed: from n/a through <= 0.3.4.
Product
Top Flash Embed
Affected
up to 0.3.4
What to do
Affects up to 0.3.4. Update Top Flash Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Links/Problem Reporter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23833 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RaminMT Links/Problem Reporter report-broken-links allows DOM-Based XSS.This issue affects Links/Problem Reporter: from n/a through <= 2.6.0.
Product
Links/Problem Reporter
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Links/Problem Reporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025QR Code Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23831 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mobstac QR Code Generator qrcode-wprhe allows DOM-Based XSS.This issue affects QR Code Generator: from n/a through <= 1.2.6.
Product
QR Code Generator
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update QR Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025JB Horizontal Scroller News Ticker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23830 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jobair JB Horizontal Scroller News Ticker jb-horizontal-scroller-news-ticker allows DOM-Based XSS.This issue affects JB Horizontal Scroller News Ticker: from n/a through <= 1.0.
Product
JB Horizontal Scroller News Ticker
Affected
up to 1.0
What to do
Affects up to 1.0. Update JB Horizontal Scroller News Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025WordPress Data Guard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23828 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sindhi WordPress Data Guard wordpress-data-guards allows Stored XSS.This issue affects WordPress Data Guard: from n/a through <= 8.
Product
WordPress Data Guard
Affected
up to 8
What to do
Affects up to 8. Update WordPress Data Guard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Strx Magic Floating Sidebar Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23827 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in straps Strx Magic Floating Sidebar Maker strx-magic-floating-sidebar-maker allows Stored XSS.This issue affects Strx Magic Floating Sidebar Maker: from n/a through <= 1.4.1.
Product
Strx Magic Floating Sidebar Maker
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Strx Magic Floating Sidebar Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Stop Comment Spam: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23826 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pedjas Stop Comment Spam stop-comment-spam allows Stored XSS.This issue affects Stop Comment Spam: from n/a through <= 0.5.3.
Product
Stop Comment Spam
Affected
up to 0.5.3
What to do
Affects up to 0.5.3. Update Stop Comment Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Easy Shortcode Buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23825 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osuthorpe Easy Shortcode Buttons easy-shortcode-buttons allows Stored XSS.This issue affects Easy Shortcode Buttons: from n/a through <= 1.2.
Product
Easy Shortcode Buttons
Affected
up to 1.2
What to do
Affects up to 1.2. Update Easy Shortcode Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025FontAwesome.io ShortCodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23824 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alexander Weleczka FontAwesome.io ShortCodes allows Stored XSS.This issue affects FontAwesome.io ShortCodes: from n/a through 1.0.
Product
FontAwesome.io ShortCodes
Affected
up to 1.0
What to do
Affects up to 1.0. Update FontAwesome.io ShortCodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Metaphor Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23816 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Metaphor Widgets allows Stored XSS. This issue affects Metaphor Widgets: from n/a through 2.4.
Product
Metaphor Widgets
Affected
up to 2.4
What to do
Affects up to 2.4. Update Metaphor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Spiderpowa Embed PDF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23807 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jim2212001 Spiderpowa Embed PDF spiderpowa-embed-pdf allows Stored XSS.This issue affects Spiderpowa Embed PDF: from n/a through <= 1.0.
Product
Spiderpowa Embed PDF
Affected
up to 1.0
What to do
Affects up to 1.0. Update Spiderpowa Embed PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025WP-Revive Adserver: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23802 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SteveSoehl WP-Revive Adserver wp-revive-adserver allows Stored XSS.This issue affects WP-Revive Adserver: from n/a through <= 2.2.1.
Product
WP-Revive Adserver
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update WP-Revive Adserver to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Easy Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23796 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tushar Patel Easy Portfolio easy-portfolio allows Stored XSS.This issue affects Easy Portfolio: from n/a through <= 1.3.
Product
Easy Portfolio
Affected
up to 1.3
What to do
Affects up to 1.3. Update Easy Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Easy FAQs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23795 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ghuger Easy FAQs easy-faqs allows Stored XSS.This issue affects Easy FAQs: from n/a through <= 3.2.1.
Product
Easy FAQs
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Easy FAQs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025wp_amaps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23794 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _rccoder_ wp_amaps wp-amaps allows Stored XSS.This issue affects wp_amaps: from n/a through <= 1.7.
Product
wp_amaps
Affected
up to 1.7
What to do
Affects up to 1.7. Update wp_amaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Horizontal Line Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23791 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mikakaltoft Horizontal Line Shortcode horizontal-line-shortcode allows Stored XSS.This issue affects Horizontal Line Shortcode: from n/a through <= 1.0.
Product
Horizontal Line Shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update Horizontal Line Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025GDPR Personal Data Reports: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23777 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in willowsconsulting GDPR Personal Data Reports gdpr-personal-data-reports allows Stored XSS.This issue affects GDPR Personal Data Reports: from n/a through <= 1.0.5.
Product
GDPR Personal Data Reports
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update GDPR Personal Data Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025GMAPS for WPBakery Page Builder Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23775 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WWP GMAPS for WPBakery Page Builder Free gmaps-for-visual-composer-free allows Stored XSS.This issue affects GMAPS for WPBakery Page Builder Free: from n/a through <= 1.2.
Product
GMAPS for WPBakery Page Builder Free
Affected
up to 1.2
What to do
Affects up to 1.2. Update GMAPS for WPBakery Page Builder Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025imaGenius: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23772 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eugenio Petulla’ imaGenius imagenius allows Stored XSS.This issue affects imaGenius: from n/a through <= 1.7.
Product
imaGenius
Affected
up to 1.7
What to do
Affects up to 1.7. Update imaGenius to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Chatter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23760 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Volkov Chatter allows Stored XSS. This issue affects Chatter: from n/a through 1.0.1.
Product
Chatter
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Chatter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Greek Namedays Widget From Eortologio.Net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23783 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in carrotbits Greek Namedays Widget From Eortologio.Net greek-namedays-widget allows Stored XSS.This issue affects Greek Namedays Widget From Eortologio.Net: from n/a through <= 20191113.
Product
Greek Namedays Widget From Eortologio.Net
Affected
up to 20191113
What to do
Affects up to 20191113. Update Greek Namedays Widget From Eortologio.Net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Marmoset Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23767 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revoxis Marmoset Viewer marmoset-viewer allows Stored XSS.This issue affects Marmoset Viewer: from n/a through <= 1.9.3.
Product
Marmoset Viewer
Affected
up to 1.9.3
What to do
Affects up to 1.9.3. Update Marmoset Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Web Push: Cross-Site Request Forgery (CSRF)CVE-2025-23720 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Marco Castelluccio Web Push web-push allows Stored XSS.This issue affects Web Push: from n/a through <= 1.4.0.
Product
Web Push
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Web Push to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Event Countdown Timer Plugin by TechMix: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23699 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techmix Event Countdown Timer Plugin by TechMix event-countdown-timer allows Reflected XSS.This issue affects Event Countdown Timer Plugin by TechMix: from n/a through <= 1.4.
Product
Event Countdown Timer Plugin by TechMix
Affected
up to 1.4
What to do
Affects up to 1.4. Update Event Countdown Timer Plugin by TechMix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Blogger Image Import: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23689 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Poco Blogger Image Import allows Stored XSS.This issue affects Blogger Image Import: from 2.1 through n/a.
Product
Blogger Image Import
What to do
Update Blogger Image Import to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025QuoteMedia Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23644 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in justin.kuepper QuoteMedia Tools quotemedia-tools allows DOM-Based XSS.This issue affects QuoteMedia Tools: from n/a through <= 1.0.
Product
QuoteMedia Tools
Affected
up to 1.0
What to do
Affects up to 1.0. Update QuoteMedia Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Sidebar-Content from Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23642 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pflonk Sidebar-Content from Shortcode sidebar-content-from-shortcode allows DOM-Based XSS.This issue affects Sidebar-Content from Shortcode: from n/a through <= 2.0.
Product
Sidebar-Content from Shortcode
Affected
up to 2.0
What to do
Affects up to 2.0. Update Sidebar-Content from Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Powie's pLinks PagePeeker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23641 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PowieT Powie's pLinks PagePeeker plinks allows DOM-Based XSS.This issue affects Powie's pLinks PagePeeker: from n/a through <= 1.0.2.
Product
Powie's pLinks PagePeeker
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Powie's pLinks PagePeeker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Contact Form 7 – CCAvenue Add-on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23623 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Bisen Contact Form 7 – CCAvenue Add-on cf7-cc-avenue-add-on allows Reflected XSS.This issue affects Contact Form 7 – CCAvenue Add-on: from n/a through <= 1.0.
Product
Contact Form 7 – CCAvenue Add-on
Affected
up to 1.0
What to do
Affects up to 1.0. Update Contact Form 7 – CCAvenue Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Captchelfie – Captcha by Selfie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23620 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trof Captchelfie – Captcha by Selfie captchelfie-captcha-by-selfie allows Reflected XSS.This issue affects Captchelfie – Captcha by Selfie: from n/a through <= 1.0.7.
Product
Captchelfie – Captcha by Selfie
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Captchelfie – Captcha by Selfie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Web Testimonials: Cross-Site Request Forgery (CSRF)CVE-2025-23560 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in plumwd Web Testimonials web-testimonials allows Stored XSS.This issue affects Web Testimonials: from n/a through <= 1.2.
Product
Web Testimonials
Affected
up to 1.2
What to do
Affects up to 1.2. Update Web Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025LH Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23547 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH Login Page lh-login-page allows Reflected XSS.This issue affects LH Login Page: from n/a through <= 2.14.
Product
LH Login Page
Affected
up to 2.14
What to do
Affects up to 2.14. Update LH Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Stars SMTP Mailer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23453 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Myriad Solutionz Stars SMTP Mailer stars-smtp-mailer allows Reflected XSS.This issue affects Stars SMTP Mailer: from n/a through <= 1.7.
Product
Stars SMTP Mailer
Affected
up to 1.7
What to do
Affects up to 1.7. Update Stars SMTP Mailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025EditionGuard for WooCommerce – eBook Sales with DRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23452 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EditionGuard EditionGuard for WooCommerce – eBook Sales with DRM editionguard-for-woocommerce-ebook-sales-with-drm allows Reflected XSS.This issue affects EditionGuard for WooCommerce – eBook Sales with DRM: from n/a through <= 3.4.2.
Product
EditionGuard for WooCommerce – eBook Sales with DRM
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update EditionGuard for WooCommerce – eBook Sales with DRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.