Vulnerability database

9,243 results · page 79 of 185

• Apr 24, 2025RAphicon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46467 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rahendra Putra K™ RAphicon raphicon allows DOM-Based XSS.This issue affects RAphicon: from n/a through <= 2.1.2.

  Product

  RAphicon

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update RAphicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025RRSSB: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46461 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Relentless Apps RRSSB rrssb allows DOM-Based XSS.This issue affects RRSSB: from n/a through <= 1.0.1.

  Product

  RRSSB

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update RRSSB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Confirm User Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46459 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ralf Hortt Confirm User Registration confirm-user-registration allows Stored XSS.This issue affects Confirm User Registration: from n/a through <= 2.1.5.

  Product

  Confirm User Registration

  Affected

  up to 2.1.5

  What to do

  Affects up to 2.1.5. Update Confirm User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Zoho Creator Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46453 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreatorTeam Zoho Creator Forms allows Stored XSS. This issue affects Zoho Creator Forms: from n/a through 1.0.5.

  Product

  Zoho Creator Forms

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Zoho Creator Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Floating Social Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46451 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Floating Social Bar floating-social-bar allows Stored XSS.This issue affects Floating Social Bar: from n/a through <= 1.1.7.

  Product

  Floating Social Bar

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update Floating Social Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025WoWHead Tooltips: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46449 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Novium WoWHead Tooltips wowhead-tooltips allows Stored XSS.This issue affects WoWHead Tooltips: from n/a through <= 2.0.1.

  Product

  WoWHead Tooltips

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update WoWHead Tooltips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Fable Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46447 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFable Fable Extra fable-extra allows DOM-Based XSS.This issue affects Fable Extra: from n/a through <= 1.0.6.

  Product

  Fable Extra

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Fable Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025External Markdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46445 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pReya External Markdown external-markdown allows Stored XSS.This issue affects External Markdown: from n/a through <= 0.0.1.

  Product

  External Markdown

  Affected

  up to 0.0.1

  What to do

  Affects up to 0.0.1. Update External Markdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025GTDB Guitar Tuners: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46438 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in warmwhisky GTDB Guitar Tuners guitar-tuner allows Stored XSS.This issue affects GTDB Guitar Tuners: from n/a through <= 4.2.2.

  Product

  GTDB Guitar Tuners

  Affected

  up to 4.2.2

  What to do

  Affects up to 4.2.2. Update GTDB Guitar Tuners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Seriously Simple Podcasting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46261 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through <= 3.9.0.

  Product

  Seriously Simple Podcasting

  Affected

  up to 3.9.0

  What to do

  Affects up to 3.9.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Sky Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46260 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wowDevs Sky Addons for Elementor sky-elementor-addons allows Stored XSS.This issue affects Sky Addons for Elementor: from n/a through <= 3.0.1.

  Product

  Sky Addons for Elementor

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update Sky Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Frontend Dashboard: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-46248 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows SQL Injection.This issue affects Frontend Dashboard: from n/a through <= 2.2.5.

  Product

  Frontend Dashboard

  Affected

  up to 2.2.5

  What to do

  Affects up to 2.2.5. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Control Listings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46234 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Razib Control Listings control-listings allows Reflected XSS.This issue affects Control Listings: from n/a through <= 1.0.4.1.

  Product

  Control Listings

  Affected

  up to 1.0.4.1

  What to do

  Affects up to 1.0.4.1. Update Control Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Popup Builder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-46230 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GhozyLab Popup Builder easy-notify-lite allows PHP Local File Inclusion.This issue affects Popup Builder: from n/a through <= 1.1.35.

  Product

  Popup Builder

  Affected

  up to 1.1.35

  What to do

  Affects up to 1.1.35. Update Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025BruteGuard – Brute Force Login Protection: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39408 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress BruteGuard – Brute Force Login Protection bruteguard allows Reflected XSS.This issue affects BruteGuard – Brute Force Login Protection: from n/a through <= 0.1.4.

  Product

  BruteGuard – Brute Force Login Protection

  Affected

  up to 0.1.4

  What to do

  Affects up to 0.1.4. Update BruteGuard – Brute Force Login Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025User Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39400 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Reflected XSS.This issue affects User Registration: from n/a through < 4.2.0.

  Product

  User Registration

  What to do

  Update User Registration to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025License For Envato: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39399 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashraful Sarkar Naiem License For Envato license-envato allows PHP Local File Inclusion.This issue affects License For Envato: from n/a through <= 1.0.0.

  Product

  License For Envato

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update License For Envato to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Anything Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39397 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus@hotmail.com Anything Popup anything-popup allows Reflected XSS.This issue affects Anything Popup: from n/a through <= 7.3.

  Product

  Anything Popup

  Affected

  up to 7.3

  What to do

  Affects up to 7.3. Update Anything Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Checkout Field Visibility for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39391 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zamartz Checkout Field Visibility for WooCommerce checkout-field-visibility-for-woocommerce allows PHP Local File Inclusion.This issue affects Checkout Field Visibility for WooCommerce: from n/a through <= 1.3.0.

  Product

  Checkout Field Visibility for WooCommerce

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Checkout Field Visibility for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Opstore: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39387 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpoperations Opstore opstore allows PHP Local File Inclusion.This issue affects Opstore: from n/a through <= 1.4.5.

  Product

  Opstore

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update Opstore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Product Lister for eBay: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39384 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cedcommerce Product Lister for eBay product-lister-ebay allows PHP Local File Inclusion.This issue affects Product Lister for eBay: from n/a through <= 2.0.9.

  Product

  Product Lister for eBay

  Affected

  up to 2.0.9

  What to do

  Affects up to 2.0.9. Update Product Lister for eBay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Xews Lite: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39383 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codeworkweb Xews Lite xews-lite allows PHP Local File Inclusion.This issue affects Xews Lite: from n/a through <= 1.0.9.

  Product

  Xews Lite

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Xews Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025ACF: Google Font Selector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39382 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in danielpataki ACF: Google Font Selector acf-google-font-selector-field allows Reflected XSS.This issue affects ACF: Google Font Selector: from n/a through <= 3.0.1.

  Product

  ACF: Google Font Selector

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update ACF: Google Font Selector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Capturly: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39379 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Capturly Capturly capturly-optimize-your-website allows PHP Local File Inclusion.This issue affects Capturly: from n/a through <= 2.0.1.

  Product

  Capturly

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Capturly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39378 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows PHP Local File Inclusion.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.

  Product

  Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light

  Affected

  up to 2.4.37

  What to do

  Affects up to 2.4.37. Update Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Appsero Helper: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39377 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Appsero Helper appsero-helper allows SQL Injection.This issue affects Appsero Helper: from n/a through <= 1.3.4.

  Product

  Appsero Helper

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update Appsero Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Grace Mag: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39360 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in everestthemes Grace Mag grace-mag allows PHP Local File Inclusion.This issue affects Grace Mag: from n/a through <= 1.1.5.

  Product

  Grace Mag

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update Grace Mag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025CWW Portfolio: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39359 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codeworkweb CWW Portfolio cww-portfolio allows PHP Local File Inclusion.This issue affects CWW Portfolio: from n/a through <= 1.3.1.

  Product

  CWW Portfolio

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update CWW Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Arrival: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32921 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpoperations Arrival arrival allows PHP Local File Inclusion.This issue affects Arrival: from n/a through <= 1.4.5.

  Product

  Arrival

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update Arrival to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 23, 2025WordPress Simple Shopping Cart: Product price manipulationCVE-2025-3530 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to product price manipulation in all versions up to, and including, 5.1.2. This is due to a logic flaw involving the inconsistent use of parameters during the cart addition process. The plugin uses the parameter 'product_tmp_two' for computing a security hash against price tampering while using 'wspsc_product' to display the product, allowing an unauthenticated attacker to substitute details from a cheaper product and bypass payment for a more expensive item.

  Product

  WordPress Simple Shopping Cart

  Affected

  up to 5.1.2

  What to do

  Affects up to 5.1.2. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 23, 2025WordPress Simple Shopping Cart: Sensitive Information ExposureCVE-2025-3529 · WordPress plugins & themes · reported by WordfenceHigh 8.2

  The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.2 via the 'file_url' parameter. This makes it possible for unauthenticated attackers to view potentially sensitive information and download a digital product without paying for it.

  Product

  WordPress Simple Shopping Cart

  Affected

  up to 5.1.2

  What to do

  Affects up to 5.1.2. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 22, 2025Visual Composer Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46254 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Stored XSS.This issue affects Visual Composer Website Builder: from n/a through <= 45.10.0.

  Product

  Visual Composer Website Builder

  Affected

  up to 45.10.0

  What to do

  Affects up to 45.10.0. Update Visual Composer Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025GutenKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46253 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ataur R GutenKit gutenkit-blocks-addon allows Stored XSS.This issue affects GutenKit: from n/a through <= 2.2.2.

  Product

  GutenKit

  Affected

  up to 2.2.2

  What to do

  Affects up to 2.2.2. Update GutenKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025Message Filter for Contact Form 7: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-46252 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kofi Mokome Message Filter for Contact Form 7 allows SQL Injection. This issue affects Message Filter for Contact Form 7: from n/a through 1.6.3.2.

  Product

  Message Filter for Contact Form 7

  Affected

  up to 1.6.3.2

  What to do

  Affects up to 1.6.3.2. Update Message Filter for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025VPSUForm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46250 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Ratudi VPSUForm v-form allows Stored XSS.This issue affects VPSUForm: from n/a through <= 3.1.14.

  Product

  VPSUForm

  Affected

  up to 3.1.14

  What to do

  Affects up to 3.1.14. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025Simple calendar for Elementor: Cross-Site Request Forgery (CSRF)CVE-2025-46249 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Michael Simple calendar for Elementor simple-calendar-for-elementor allows Cross Site Request Forgery.This issue affects Simple calendar for Elementor: from n/a through <= 1.6.4.

  Product

  Simple calendar for Elementor

  Affected

  up to 1.6.4

  What to do

  Affects up to 1.6.4. Update Simple calendar for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025Watu Quiz: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-46242 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affects Watu Quiz: from n/a through <= 3.4.3.

  Product

  Watu Quiz

  Affected

  up to 3.4.3

  What to do

  Affects up to 3.4.3. Update Watu Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025Simple Download Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46240 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Simple Download Counter simple-download-counter allows Stored XSS.This issue affects Simple Download Counter: from n/a through <= 2.2.

  Product

  Simple Download Counter

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Simple Download Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025Theme Switcha: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46239 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Theme Switcha theme-switcha allows Stored XSS.This issue affects Theme Switcha: from n/a through <= 3.4.

  Product

  Theme Switcha

  Affected

  up to 3.4

  What to do

  Affects up to 3.4. Update Theme Switcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025List Last Changes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46238 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rbaer List Last Changes list-last-changes allows Stored XSS.This issue affects List Last Changes: from n/a through <= 1.2.1.

  Product

  List Last Changes

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update List Last Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025Link Library: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46237 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library link-library allows Stored XSS.This issue affects Link Library: from n/a through <= 7.8.

  Product

  Link Library

  Affected

  up to 7.8

  What to do

  Affects up to 7.8. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025HTML Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46236 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms html-forms allows Stored XSS.This issue affects HTML Forms: from n/a through <= 1.5.2.

  Product

  HTML Forms

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update HTML Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025SKT Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46235 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This issue affects SKT Blocks: from n/a through <= 2.0.

  Product

  SKT Blocks

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update SKT Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025Sirv: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46233 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sirv CDN and Image Hosting Sirv sirv allows Stored XSS.This issue affects Sirv: from n/a through <= 7.5.3.

  Product

  Sirv

  Affected

  up to 7.5.3

  What to do

  Affects up to 7.5.3. Update Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025Textmetrics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46229 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Israpil Textmetrics webtexttool allows Stored XSS.This issue affects Textmetrics: from n/a through <= 3.6.2.

  Product

  Textmetrics

  Affected

  up to 3.6.2

  What to do

  Affects up to 3.6.2. Update Textmetrics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46228 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows DOM-Based XSS.This issue affects Event post: from n/a through <= 5.9.11.

  Product

  Event post

  Affected

  up to 5.9.11

  What to do

  Affects up to 5.9.11. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025Custom Related Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46227 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brecht Custom Related Posts custom-related-posts allows Stored XSS.This issue affects Custom Related Posts: from n/a through <= 1.7.4.

  Product

  Custom Related Posts

  Affected

  up to 1.7.4

  What to do

  Affects up to 1.7.4. Update Custom Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025MPL-Publisher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46226 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ferranfg MPL-Publisher mpl-publisher allows Stored XSS.This issue affects MPL-Publisher: from n/a through <= 2.18.0.

  Product

  MPL-Publisher

  Affected

  up to 2.18.0

  What to do

  Affects up to 2.18.0. Update MPL-Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025Post in page for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46225 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Post in page for Elementor allows DOM-Based XSS. This issue affects Post in page for Elementor: from n/a through 1.0.1.

  Product

  Post in page for Elementor

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Post in page for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025WP Import Export Lite: Stored Cross-Site ScriptingCVE-2025-2839 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versions up to, and including, 3.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  WP Import Export Lite

  Affected

  up to 3.9.27

  What to do

  Affects up to 3.9.27. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.