Vulnerability database

6,573 results · page 78 of 132

• Jan 7, 2025Digi Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22354 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Themes Digi Store allows DOM-Based XSS.This issue affects Digi Store: from n/a through 1.1.4.

  Product

  Digi Store

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Digi Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Education LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22334 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FilaThemes Education LMS allows Stored XSS.This issue affects Education LMS: from n/a through 0.0.7.

  Product

  Education LMS

  Affected

  up to 0.0.7

  What to do

  Affects up to 0.0.7. Update Education LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Hash Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22296 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Hash Elements hash-elements.This issue affects Hash Elements: from n/a through <= 1.5.0.

  Product

  Hash Elements

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update Hash Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Laika Pedigree Tree: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22593 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burria Laika Pedigree Tree laika-pedigree-tree allows Stored XSS.This issue affects Laika Pedigree Tree: from n/a through <= 1.4.

  Product

  Laika Pedigree Tree

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Laika Pedigree Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Ultimate Image Hover Effects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22585 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Ultimate Image Hover Effects ultimate-image-hover-effects allows DOM-Based XSS.This issue affects Ultimate Image Hover Effects: from n/a through <= 1.1.2.

  Product

  Ultimate Image Hover Effects

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Ultimate Image Hover Effects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Timeline Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22584 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Timeline Pro timeline-pro allows DOM-Based XSS.This issue affects Timeline Pro: from n/a through <= 1.3.

  Product

  Timeline Pro

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Timeline Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Arcade Ready: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22581 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bytephp Arcade Ready arcadeready allows Stored XSS.This issue affects Arcade Ready: from n/a through <= 1.1.

  Product

  Arcade Ready

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Arcade Ready to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Biltorvet Dealer Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22580 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Auto IT Biltorvet Dealer Tools biltorvet-dealer-tools allows Stored XSS.This issue affects Biltorvet Dealer Tools: from n/a through <= 1.0.22.

  Product

  Biltorvet Dealer Tools

  Affected

  up to 1.0.22

  What to do

  Affects up to 1.0.22. Update Biltorvet Dealer Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025WP Header Notification: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22579 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly WP Header Notification wp-header-notification allows Stored XSS.This issue affects WP Header Notification: from n/a through <= 1.2.7.

  Product

  WP Header Notification

  Affected

  up to 1.2.7

  What to do

  Affects up to 1.2.7. Update WP Header Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025WP Cookie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22578 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aazztech WP Cookie wp-cookie allows Stored XSS.This issue affects WP Cookie: from n/a through <= 1.0.0.

  Product

  WP Cookie

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update WP Cookie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Able Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22577 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damion Armentrout Able Player wp-able-player allows DOM-Based XSS.This issue affects Able Player: from n/a through <= 1.0.

  Product

  Able Player

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Able Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025ICS Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22574 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleanshooter ICS Button ics-button allows Stored XSS.This issue affects ICS Button: from n/a through <= 0.6.

  Product

  ICS Button

  Affected

  up to 0.6

  What to do

  Affects up to 0.6. Update ICS Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Icons Enricher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22573 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in copist Icons Enricher icons-enricher allows Stored XSS.This issue affects Icons Enricher: from n/a through <= 1.0.8.

  Product

  Icons Enricher

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Icons Enricher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Legacy ePlayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22572 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Legacy ePlayer sportspress-tv allows Stored XSS.This issue affects Legacy ePlayer: from n/a through <= 0.9.9.

  Product

  Legacy ePlayer

  Affected

  up to 0.9.9

  What to do

  Affects up to 0.9.9. Update Legacy ePlayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025mcjh button shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22558 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus C. J. Hartmann mcjh button shortcode mcjh-button-shortcode allows Stored XSS.This issue affects mcjh button shortcode: from n/a through <= 1.6.4.

  Product

  mcjh button shortcode

  Affected

  up to 1.6.4

  What to do

  Affects up to 1.6.4. Update mcjh button shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Video Embed Optimizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22554 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fdfranklin06 Video Embed Optimizer video-embed-optimizer allows Stored XSS.This issue affects Video Embed Optimizer: from n/a through <= 1.0.0.

  Product

  Video Embed Optimizer

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Video Embed Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Boot-Modal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22551 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in albedo0 Boot-Modal boot-modal allows Stored XSS.This issue affects Boot-Modal: from n/a through <= 1.9.1.

  Product

  Boot-Modal

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update Boot-Modal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025AddFunc Mobile Detect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22550 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Rhoney AddFunc Mobile Detect addfunc-mobile-detect allows Stored XSS.This issue affects AddFunc Mobile Detect: from n/a through <= 3.1.

  Product

  AddFunc Mobile Detect

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update AddFunc Mobile Detect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025WP Github: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22549 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in seinoxygen WP Github wp-github allows Stored XSS.This issue affects WP Github: from n/a through <= 1.3.3.

  Product

  WP Github

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update WP Github to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025ldap_login_password_and_role_manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22548 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in frankkoenen ldap_login_password_and_role_manager ldap-login-password-and-role-manager allows Stored XSS.This issue affects ldap_login_password_and_role_manager: from n/a through <= 1.0.12.

  Product

  ldap_login_password_and_role_manager

  Affected

  up to 1.0.12

  What to do

  Affects up to 1.0.12. Update ldap_login_password_and_role_manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025JK Html To Pdf: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22547 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jaykrishnang JK Html To Pdf jk-html-to-pdf allows Stored XSS.This issue affects JK Html To Pdf: from n/a through <= 1.0.0.

  Product

  JK Html To Pdf

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update JK Html To Pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025jQuery TwentyTwenty: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22546 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Obaid Hossain jQuery TwentyTwenty js-twentytwenty allows Stored XSS.This issue affects jQuery TwentyTwenty: from n/a through <= 1.0.

  Product

  jQuery TwentyTwenty

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update jQuery TwentyTwenty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025iframe to embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22545 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sw.galati iframe to embed iframe-to-embed allows Stored XSS.This issue affects iframe to embed: from n/a through <= 1.2.

  Product

  iframe to embed

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update iframe to embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Mind Doodle Visual Sitemaps & Tasks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22544 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mind Doodle Mind Doodle Visual Sitemaps & Tasks mind-doodle-sitemap allows Stored XSS.This issue affects Mind Doodle Visual Sitemaps & Tasks: from n/a through <= 1.6.

  Product

  Mind Doodle Visual Sitemaps & Tasks

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Mind Doodle Visual Sitemaps & Tasks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Simple Photo Sphere: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22532 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snagysandor Simple Photo Sphere simple-photo-sphere allows Stored XSS.This issue affects Simple Photo Sphere: from n/a through <= 0.0.10.

  Product

  Simple Photo Sphere

  Affected

  up to 0.0.10

  What to do

  Affects up to 0.0.10. Update Simple Photo Sphere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Urdu Formatter – Shamil: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22531 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M Bilal M Urdu Formatter – Shamil urdu-formatter-shamil allows Stored XSS.This issue affects Urdu Formatter – Shamil: from n/a through <= 0.1.

  Product

  Urdu Formatter – Shamil

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Urdu Formatter – Shamil to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025아임포트 결제버튼 생성 플러그인: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22530 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PORTONE 아임포트 결제버튼 생성 플러그인 iamport-payment allows Stored XSS.This issue affects 아임포트 결제버튼 생성 플러그인: from n/a through <= 1.1.19.

  Product

  아임포트 결제버튼 생성 플러그인

  Affected

  up to 1.1.19

  What to do

  Affects up to 1.1.19. Update 아임포트 결제버튼 생성 플러그인 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025WE Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22529 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordpresteem WE Blocks we-blocks allows Stored XSS.This issue affects WE Blocks: from n/a through <= 1.3.5.

  Product

  WE Blocks

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update WE Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Huurkalender WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22528 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Huurkalender.nl Huurkalender WP huurkalender-wp allows Stored XSS.This issue affects Huurkalender WP: from n/a through <= 1.5.6.

  Product

  Huurkalender WP

  Affected

  up to 1.5.6

  What to do

  Affects up to 1.5.6. Update Huurkalender WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Donation Block For PayPal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22525 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bharat Kambariya Donation Block For PayPal donations-block allows Stored XSS.This issue affects Donation Block For PayPal: from n/a through <= 2.2.0.

  Product

  Donation Block For PayPal

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update Donation Block For PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025فرم ساز فرم افزار: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22524 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in formafzar فرم ساز فرم افزار formafzar allows Stored XSS.This issue affects فرم ساز فرم افزار: from n/a through <= 2.0.

  Product

  فرم ساز فرم افزار

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update فرم ساز فرم افزار to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025SingSong: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22522 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in roya khosravi SingSong singsong allows Stored XSS.This issue affects SingSong: from n/a through <= 1.2.

  Product

  SingSong

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update SingSong to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Justified Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22518 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Justified Image Gallery justified-image-gallery allows Stored XSS.This issue affects Justified Image Gallery: from n/a through <= 1.0.

  Product

  Justified Image Gallery

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Justified Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025List Pages at Depth: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22517 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ben Huson List Pages at Depth list-pages-at-depth allows Stored XSS.This issue affects List Pages at Depth: from n/a through <= 1.5.

  Product

  List Pages at Depth

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update List Pages at Depth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Metadata SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22516 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hpinfosys Metadata SEO metadata-seo allows Stored XSS.This issue affects Metadata SEO: from n/a through <= 2.3.

  Product

  Metadata SEO

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Metadata SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Show Google Analytics widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22515 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simon Show Google Analytics widget show-google-analytics-widget allows Stored XSS.This issue affects Show Google Analytics widget: from n/a through <= 1.5.4.

  Product

  Show Google Analytics widget

  Affected

  up to 1.5.4

  What to do

  Affects up to 1.5.4. Update Show Google Analytics widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Slides & Presentations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22511 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ella Van Durpe Slides & Presentations slide allows Stored XSS.This issue affects Slides & Presentations: from n/a through <= 0.0.39.

  Product

  Slides & Presentations

  Affected

  up to 0.0.39

  What to do

  Affects up to 0.0.39. Update Slides & Presentations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025WP-tagMaker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22338 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lich_wang WP-tagMaker tagmaker allows Reflected XSS.This issue affects WP-tagMaker: from n/a through <= 0.2.2.

  Product

  WP-tagMaker

  Affected

  up to 0.2.2

  What to do

  Affects up to 0.2.2. Update WP-tagMaker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Opencart Product in WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22335 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rajib.dewan Opencart Product in WP opencart-product-in-wp allows Reflected XSS.This issue affects Opencart Product in WP: from n/a through <= 1.0.1.

  Product

  Opencart Product in WP

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Opencart Product in WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Custom Field For WP Job Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22294 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in theme funda Custom Field For WP Job Manager custom-field-for-wp-job-manager allows Reflected XSS.This issue affects Custom Field For WP Job Manager: from n/a through <= 1.3.

  Product

  Custom Field For WP Job Manager

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Custom Field For WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025SimpleCharm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56056 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kmfoysal06 SimpleCharm simplecharm allows Reflected XSS.This issue affects SimpleCharm: from n/a through <= 1.4.3.

  Product

  SimpleCharm

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update SimpleCharm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025WP Job Portal – A Complete Recruitment System for Company or Job Board website: Insecure Direct Object ReferenceCVE-2024-12131 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.5 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit resumes for other applicants when applying for jobs.

  Product

  WP Job Portal – A Complete Recruitment System for Company or Job Board website

  Affected

  up to 2.2.5

  What to do

  Affects up to 2.2.5. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 7, 2025WPAchievements Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22362 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Bakovic WPAchievements Free wpachievements-free allows Stored XSS.This issue affects WPAchievements Free: from n/a through <= 1.2.0.

  Product

  WPAchievements Free

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update WPAchievements Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025SyncFields: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22359 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pjfc SyncFields syncfields allows Reflected XSS.This issue affects SyncFields: from n/a through <= 2.1.

  Product

  SyncFields

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update SyncFields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Wp advertising management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22358 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simone Marcon Wp advertising management advertising-management allows Reflected XSS.This issue affects Wp advertising management: from n/a through <= 1.0.3.

  Product

  Wp advertising management

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Wp advertising management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Target Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22357 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdever Target Notifications target-notifications allows Reflected XSS.This issue affects Target Notifications: from n/a through <= 1.1.1.

  Product

  Target Notifications

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Target Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Kikx Simple Post Author Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22355 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in asokaaso2 Kikx Simple Post Author Filter sa-post-author-filter allows Reflected XSS.This issue affects Kikx Simple Post Author Filter: from n/a through <= 1.0.

  Product

  Kikx Simple Post Author Filter

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Kikx Simple Post Author Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025BVD Easy Gallery Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22353 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bvads BVD Easy Gallery Manager bvd-easy-gallery-manager allows Reflected XSS.This issue affects BVD Easy Gallery Manager: from n/a through <= 1.0.6.

  Product

  BVD Easy Gallery Manager

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update BVD Easy Gallery Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Store Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22339 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in athemeart Store Commerce store-commerce allows DOM-Based XSS.This issue affects Store Commerce: from n/a through <= 1.2.3.

  Product

  Store Commerce

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Store Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Piotnet Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22333 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Addons For Elementor piotnet-addons-for-elementor allows Stored XSS.This issue affects Piotnet Addons For Elementor: from n/a through <= 2.4.31.

  Product

  Piotnet Addons For Elementor

  Affected

  up to 2.4.31

  What to do

  Affects up to 2.4.31. Update Piotnet Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.