Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

12,186 results · page 76 of 244

Sep 26, 2025SEO Search Permalink: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60184 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. SEO Search Permalink seo-search-permalink allows Stored XSS.This issue affects SEO Search Permalink: from n/a through <= 1.0.3.
Product
SEO Search Permalink
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update SEO Search Permalink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Click & Tweet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60179 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Space Studio Click & Tweet allows Stored XSS. This issue affects Click & Tweet: from n/a through 0.8.9.
Product
Click & Tweet
Affected
up to 0.8.9
What to do
Affects up to 0.8.9. Update Click & Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Recaptcha – wp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60177 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rozx Recaptcha – wp recaptcha-wp allows Stored XSS.This issue affects Recaptcha – wp: from n/a through <= 0.2.6.
Product
Recaptcha – wp
Affected
up to 0.2.6
What to do
Affects up to 0.2.6. Update Recaptcha – wp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025WP Subscription Forms PRO: Missing AuthorizationCVE-2025-60166 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpshuffle WP Subscription Forms PRO wp-subscription-forms-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Subscription Forms PRO: from n/a through <= 2.0.5.
Product
WP Subscription Forms PRO
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update WP Subscription Forms PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025bbp topic count: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60163 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robin W bbp topic count bbp-topic-count allows DOM-Based XSS.This issue affects bbp topic count: from n/a through <= 3.2.
Product
bbp topic count
Affected
up to 3.2
What to do
Affects up to 3.2. Update bbp topic count to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Job Board Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60162 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager job-board-manager allows DOM-Based XSS.This issue affects Job Board Manager: from n/a through <= 2.1.61.
Product
Job Board Manager
Affected
up to 2.1.61
What to do
Affects up to 2.1.61. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Smart Related Products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60160 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sharkthemes Smart Related Products ai-related-products allows Stored XSS.This issue affects Smart Related Products: from n/a through <= 2.0.8.
Product
Smart Related Products
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Smart Related Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Nota Fiscal Eletrônica WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60158 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webmaniabr Nota Fiscal Eletrônica WooCommerce nota-fiscal-eletronica-woocommerce allows Stored XSS.This issue affects Nota Fiscal Eletrônica WooCommerce: from n/a through <= 3.4.0.9.
Product
Nota Fiscal Eletrônica WooCommerce
Affected
up to 3.4.0.9
What to do
Affects up to 3.4.0.9. Update Nota Fiscal Eletrônica WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025WP Ticket Customer Service Software & Support Ticket System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60157 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System wp-ticket allows Stored XSS.This issue affects WP Ticket Customer Service Software & Support Ticket System: from n/a through <= 6.0.2.
Product
WP Ticket Customer Service Software & Support Ticket System
Affected
up to 6.0.2
What to do
Affects up to 6.0.2. Update WP Ticket Customer Service Software & Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025MWW Disclaimer Buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60154 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jennifer Moss MWW Disclaimer Buttons mww-disclaimer-buttons allows Stored XSS.This issue affects MWW Disclaimer Buttons: from n/a through <= 3.41.
Product
MWW Disclaimer Buttons
Affected
up to 3.41
What to do
Affects up to 3.41. Update MWW Disclaimer Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Notely: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60149 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rocket Apps Notely notely allows Stored XSS.This issue affects Notely: from n/a through <= 1.8.0.
Product
Notely
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update Notely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025HT Feed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60147 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Feed ht-instagram allows Stored XSS.This issue affects HT Feed: from n/a through <= 1.3.0.
Product
HT Feed
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update HT Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Map Categories to Pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60146 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amit Verma Map Categories to Pages map-categories-to-pages allows Stored XSS.This issue affects Map Categories to Pages: from n/a through <= 1.3.2.
Product
Map Categories to Pages
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Map Categories to Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Lenix scss compiler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60144 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Lenix scss compiler lenix-scss-compiler allows Stored XSS.This issue affects Lenix scss compiler: from n/a through <= 1.2.
Product
Lenix scss compiler
Affected
up to 1.2
What to do
Affects up to 1.2. Update Lenix scss compiler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Simple Meta Tags: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60142 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DaganLev Simple Meta Tags simple-meta-tags allows DOM-Based XSS.This issue affects Simple Meta Tags: from n/a through <= 1.5.
Product
Simple Meta Tags
Affected
up to 1.5
What to do
Affects up to 1.5. Update Simple Meta Tags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025The Tribal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60141 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thetechtribe The Tribal the-tech-tribe allows Stored XSS.This issue affects The Tribal: from n/a through <= 1.3.3.
Product
The Tribal
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update The Tribal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025SKT Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60138 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This issue affects SKT Blocks: from n/a through <= 2.6.
Product
SKT Blocks
Affected
up to 2.6
What to do
Affects up to 2.6. Update SKT Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025User Notes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60136 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cartpauj User Notes user-notes allows Stored XSS.This issue affects User Notes: from n/a through <= 1.0.2.
Product
User Notes
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update User Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025PE Easy Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60133 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DJ-Extensions.com PE Easy Slider pe-easy-slider allows Stored XSS.This issue affects PE Easy Slider: from n/a through <= 1.1.0.
Product
PE Easy Slider
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update PE Easy Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Simple Colorbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60124 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Hellyer Simple Colorbox simple-colorbox allows Stored XSS.This issue affects Simple Colorbox: from n/a through <= 1.6.1.
Product
Simple Colorbox
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Simple Colorbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025aThemes Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60112 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.1.2.
Product
aThemes Addons for Elementor
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update aThemes Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Ditty: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60105 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through <= 3.1.58.
Product
Ditty
Affected
up to 3.1.58
What to do
Affects up to 3.1.58. Update Ditty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Gallery Custom Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60104 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Gallery Custom Links gallery-custom-links allows Stored XSS.This issue affects Gallery Custom Links: from n/a through <= 2.2.5.
Product
Gallery Custom Links
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Gallery Custom Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025WPFront User Role Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60102 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syam Mohan WPFront User Role Editor wpfront-user-role-editor allows Stored XSS.This issue affects WPFront User Role Editor: from n/a through <= 4.2.3.
Product
WPFront User Role Editor
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update WPFront User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Woostify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60101 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in duongancol Woostify woostify allows Stored XSS.This issue affects Woostify: from n/a through <= 2.4.2.
Product
Woostify
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update Woostify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Embed Any Document: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60099 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Embed Any Document embed-any-document allows Stored XSS.This issue affects Embed Any Document: from n/a through <= 2.7.7.
Product
Embed Any Document
Affected
up to 2.7.7
What to do
Affects up to 2.7.7. Update Embed Any Document to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025wp-mpdf: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60040 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fkrauthan wp-mpdf wp-mpdf allows Stored XSS.This issue affects wp-mpdf: from n/a through <= 3.9.1.
Product
wp-mpdf
Affected
up to 3.9.1
What to do
Affects up to 3.9.1. Update wp-mpdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Traveler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59012 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.3.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Quantities and Units for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58917 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Verwymeren Quantities and Units for WooCommerce quantities-and-units-for-woocommerce allows Stored XSS.This issue affects Quantities and Units for WooCommerce: from n/a through <= 1.0.13.
Product
Quantities and Units for WooCommerce
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Quantities and Units for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025ProfileGrid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-4957 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Reflected XSS.This issue affects ProfileGrid : from n/a through <= 5.9.5.7.
Product
ProfileGrid
Affected
up to 5.9.5.7
What to do
Affects up to 5.9.5.7. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Uncode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48107 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undsgn Uncode uncode allows Reflected XSS.This issue affects Uncode: from n/a through < 2.9.4.4.
Product
Uncode
What to do
Update Uncode to the newest version.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Authorsy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27006 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeplugs Authorsy authorsy allows Stored XSS.This issue affects Authorsy: from n/a through <= 1.0.5.
Product
Authorsy
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Authorsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Zephyr Project Manager: Stored Cross-Site ScriptingCVE-2025-10490 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.3.202 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Zephyr Project Manager
Affected
up to 3.3.202
What to do
Affects up to 3.3.202. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 26, 2025Markdown Shortcode: Stored Cross-Site ScriptingCVE-2025-10180 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Markdown Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'markdown' shortcode in all versions up to, and including, 0.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Markdown Shortcode
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update Markdown Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 26, 2025TweetThis Shortcode: Stored Cross-Site ScriptingCVE-2025-10136 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TweetThis Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tweetthis' shortcode in all versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TweetThis Shortcode
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update TweetThis Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordfence.com
Sep 26, 2025Popup Maker: Stored Cross-Site ScriptingCVE-2025-9490 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.20.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Popup Maker
Affected
up to 1.20.6
What to do
Affects up to 1.20.6. Update Popup Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2025Mapster WP Maps: Stored Cross-Site ScriptingCVE-2025-9044 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up to, and including, 1.20.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mapster WP Maps
Affected
up to 1.20.0
What to do
Affects up to 1.20.0. Update Mapster WP Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2025Widgets for Tiktok Feed: Stored Cross-Site ScriptingCVE-2025-8906 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Widgets for Tiktok Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trustindex-feed' shortcode in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Widgets for Tiktok Feed
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Widgets for Tiktok Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 25, 2025Mega Elements – Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-8200 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mega Elements – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Timer widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mega Elements – Addons for Elementor
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Mega Elements – Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 25, 2025CM Business Directory: Stored Cross-Site ScriptingCVE-2025-10178 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CM Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cmbd_featured_image' shortcode in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CM Business Directory
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update CM Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 24, 2025Themify Builder: Stored Cross-Site ScriptingCVE-2025-9353 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 7.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 7.6.9.
Product
Themify Builder
Affected
up to 7.6.9
What to do
Affects up to 7.6.9. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 23, 2025WordPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58674 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress allows Stored XSS. WordPress core security team is aware of the issue and working on a fix. This is low severity vulnerability that requires an attacker to have Author or higher user privileges to execute the attack vector.This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.
Product
WordPress
Affected
up to 6.8.2
What to do
Affects up to 6.8.2. Update WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2025Widget Options - Extended: Stored Cross-Site ScriptingCVE-2025-8902 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Widget Options - Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'do_sidebar' shortcode in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Widget Options - Extended
Affected
up to 5.2.1
What to do
Affects up to 5.2.1. Update Widget Options - Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record widget-options.com wordfence.com
Sep 22, 2025Request a Quote: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58915 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design Request a Quote request-a-quote allows Stored XSS.This issue affects Request a Quote: from n/a through <= 2.5.0.
Product
Request a Quote
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Make Column Clickable Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59592 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fernando Acosta Make Column Clickable Elementor make-column-clickable-elementor allows Stored XSS.This issue affects Make Column Clickable Elementor: from n/a through <= 1.6.0.
Product
Make Column Clickable Elementor
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Make Column Clickable Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Media LIbrary Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59590 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through <= 3.28.
Product
Media LIbrary Assistant
Affected
up to 3.28
What to do
Affects up to 3.28. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Soledad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59589 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad soledad allows DOM-Based XSS.This issue affects Soledad: from n/a through <= 8.6.8.
Product
Soledad
Affected
up to 8.6.8
What to do
Affects up to 8.6.8. Update Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Penci Shortcodes & Performance: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59587 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Shortcodes & Performance penci-shortcodes allows DOM-Based XSS.This issue affects Penci Shortcodes & Performance: from n/a through < 6.1.
Product
Penci Shortcodes & Performance
What to do
Update Penci Shortcodes & Performance to the newest version.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Penci Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59586 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Portfolio penci-portfolio allows DOM-Based XSS.This issue affects Penci Portfolio: from n/a through <= 3.5.
Product
Penci Portfolio
Affected
up to 3.5
What to do
Affects up to 3.5. Update Penci Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Penci Recipe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59585 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Recipe penci-recipe allows DOM-Based XSS.This issue affects Penci Recipe: from n/a through <= 4.0.
Product
Penci Recipe
Affected
up to 4.0
What to do
Affects up to 4.0. Update Penci Recipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.