Vulnerability database

8,915 results · page 79 of 179

• Apr 17, 2025License For Envato: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32566 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashraful Sarkar Naiem License For Envato license-envato allows Reflected XSS.This issue affects License For Envato: from n/a through <= 1.0.0.

  Product

  License For Envato

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update License For Envato to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Stop Registration Spam: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32564 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tomroyal Stop Registration Spam allows Reflected XSS. This issue affects Stop Registration Spam: from n/a through 1.24.

  Product

  Stop Registration Spam

  Affected

  up to 1.24

  What to do

  Affects up to 1.24. Update Stop Registration Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP Easy Poll: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32562 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com WP Easy Poll wp-easy-poll-afo allows Reflected XSS.This issue affects WP Easy Poll: from n/a through <= 2.2.9.

  Product

  WP Easy Poll

  Affected

  up to 2.2.9

  What to do

  Affects up to 2.2.9. Update WP Easy Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP_DEBUG Toggle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32561 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plugins.club WP_DEBUG Toggle enable-wp-debug-toggle allows Reflected XSS.This issue affects WP_DEBUG Toggle: from n/a through <= 1.1.

  Product

  WP_DEBUG Toggle

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update WP_DEBUG Toggle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP-Hijri: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32560 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mohammad I. Okfie WP-Hijri wp-hijri allows Reflected XSS.This issue affects WP-Hijri: from n/a through <= 1.5.3.

  Product

  WP-Hijri

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update WP-Hijri to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP Featured Screenshot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32557 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rico Macchi WP Featured Screenshot wp-featured-screenshot allows Reflected XSS.This issue affects WP Featured Screenshot: from n/a through <= 1.3.

  Product

  WP Featured Screenshot

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update WP Featured Screenshot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Raptive Ads: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32554 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raptive Raptive Ads adthrive-ads allows Reflected XSS.This issue affects Raptive Ads: from n/a through <= 3.7.3.

  Product

  Raptive Ads

  Affected

  up to 3.7.3

  What to do

  Affects up to 3.7.3. Update Raptive Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025MSRP (RRP) Pricing for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32552 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory MSRP (RRP) Pricing for WooCommerce msrp-for-woocommerce allows Reflected XSS.This issue affects MSRP (RRP) Pricing for WooCommerce: from n/a through <= 1.8.1.

  Product

  MSRP (RRP) Pricing for WooCommerce

  Affected

  up to 1.8.1

  What to do

  Affects up to 1.8.1. Update MSRP (RRP) Pricing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Hamburger Icon Menu Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32548 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in borisolhor Hamburger Icon Menu Lite allows Reflected XSS. This issue affects Hamburger Icon Menu Lite: from n/a through 1.0.

  Product

  Hamburger Icon Menu Lite

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Hamburger Icon Menu Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Feedify – Web Push Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32540 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in feedify Feedify – Web Push Notifications push-notification-by-feedify allows Reflected XSS.This issue affects Feedify – Web Push Notifications: from n/a through <= 2.4.5.

  Product

  Feedify – Web Push Notifications

  Affected

  up to 2.4.5

  What to do

  Affects up to 2.4.5. Update Feedify – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025DN Shipping by Weight for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32535 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digireturn DN Shipping by Weight for WooCommerce dn-shipping-by-weight allows Reflected XSS.This issue affects DN Shipping by Weight for WooCommerce: from n/a through <= 1.2.

  Product

  DN Shipping by Weight for WooCommerce

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update DN Shipping by Weight for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Deliver via Shipos for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32533 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matat Technologies Deliver via Shipos for WooCommerce wc-shipos-delivery allows Reflected XSS.This issue affects Deliver via Shipos for WooCommerce: from n/a through <= 2.1.7.

  Product

  Deliver via Shipos for WooCommerce

  Affected

  up to 2.1.7

  What to do

  Affects up to 2.1.7. Update Deliver via Shipos for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025UXsniff: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32532 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pei Yong Goh UXsniff ux-sniff allows Reflected XSS.This issue affects UXsniff: from n/a through <= 1.3.3.

  Product

  UXsniff

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update UXsniff to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Arconix FAQ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32531 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Reflected XSS.This issue affects Arconix FAQ: from n/a through <= 1.9.5.

  Product

  Arconix FAQ

  Affected

  up to 1.9.5

  What to do

  Affects up to 1.9.5. Update Arconix FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Wallet System for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32530 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Reflected XSS.This issue affects Wallet System for WooCommerce: from n/a through <= 2.6.8.

  Product

  Wallet System for WooCommerce

  Affected

  up to 2.6.8

  What to do

  Affects up to 2.6.8. Update Wallet System for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025iONE360 configurator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32529 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iONE360 iONE360 configurator ione360-configurator allows Reflected XSS.This issue affects iONE360 configurator: from n/a through <= 2.0.57.

  Product

  iONE360 configurator

  Affected

  up to 2.0.57

  What to do

  Affects up to 2.0.57. Update iONE360 configurator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025iCal Feeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32528 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maximevalette iCal Feeds ical-feeds allows Reflected XSS.This issue affects iCal Feeds: from n/a through <= 1.5.3.

  Product

  iCal Feeds

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update iCal Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025T&P Gallery Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32527 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pey22 T&P Gallery Slider tp-gallery-slider allows Stored XSS.This issue affects T&P Gallery Slider: from n/a through <= 1.2.

  Product

  T&P Gallery Slider

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update T&P Gallery Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Zephyr Project Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32526 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a through <= 3.3.101.

  Product

  Zephyr Project Manager

  Affected

  up to 3.3.101

  What to do

  Affects up to 3.3.101. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025License Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32522 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Reflected XSS.This issue affects License Manager for WooCommerce: from n/a through <= 3.0.9.

  Product

  License Manager for WooCommerce

  Affected

  up to 3.0.9

  What to do

  Affects up to 3.0.9. Update License Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Cool Flipbox – Shortcode & Gutenberg Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32521 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CoolHappy Cool Flipbox – Shortcode & Gutenberg Block flip-boxes allows Reflected XSS.This issue affects Cool Flipbox – Shortcode & Gutenberg Block: from n/a through <= 1.8.3.

  Product

  Cool Flipbox – Shortcode & Gutenberg Block

  Affected

  up to 1.8.3

  What to do

  Affects up to 1.8.3. Update Cool Flipbox – Shortcode & Gutenberg Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WordPress Health and Server Condition – Integrated with Google Page Speed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32520 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M. Ali Saleem WordPress Health and Server Condition – Integrated with Google Page Speed wp-condition allows Reflected XSS.This issue affects WordPress Health and Server Condition – Integrated with Google Page Speed: from n/a through <= 4.1.1.

  Product

  WordPress Health and Server Condition – Integrated with Google Page Speed

  Affected

  up to 4.1.1

  What to do

  Affects up to 4.1.1. Update WordPress Health and Server Condition – Integrated with Google Page Speed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Related Videos for JW Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32516 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ilGhera Related Videos for JW Player related-videos-for-jw-player allows Reflected XSS.This issue affects Related Videos for JW Player: from n/a through <= 1.2.0.

  Product

  Related Videos for JW Player

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Related Videos for JW Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Terminal Africa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32515 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in terminalafrica Terminal Africa terminal-africa allows Reflected XSS.This issue affects Terminal Africa: from n/a through <= 1.13.24.

  Product

  Terminal Africa

  Affected

  up to 1.13.24

  What to do

  Affects up to 1.13.24. Update Terminal Africa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WooCommerce Estimate and Quote: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32514 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cscode WooCommerce Estimate and Quote wc-estimate-and-quote allows Reflected XSS.This issue affects WooCommerce Estimate and Quote: from n/a through <= 1.0.2.5.

  Product

  WooCommerce Estimate and Quote

  Affected

  up to 1.0.2.5

  What to do

  Affects up to 1.0.2.5. Update WooCommerce Estimate and Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Nomupay Payment Processing Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32513 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocessing-card-payments allows Reflected XSS.This issue affects Nomupay Payment Processing Gateway: from n/a through <= 7.1.6.

  Product

  Nomupay Payment Processing Gateway

  Affected

  up to 7.1.6

  What to do

  Affects up to 7.1.6. Update Nomupay Payment Processing Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Revamp CRM for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32512 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revampcrm Revamp CRM for WooCommerce revampcrm-woocommerce allows Reflected XSS.This issue affects Revamp CRM for WooCommerce: from n/a through <= 1.1.2.

  Product

  Revamp CRM for WooCommerce

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Revamp CRM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Make Email Customizer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32511 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Excellent Dynamics Make Email Customizer for WooCommerce make-email-customizer-for-woocommerce allows Reflected XSS.This issue affects Make Email Customizer for WooCommerce: from n/a through <= 1.0.6.

  Product

  Make Email Customizer for WooCommerce

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Make Email Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Course Booking System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32508 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ComMotion Course Booking System course-booking-system allows Reflected XSS.This issue affects Course Booking System: from n/a through <= 6.1.2.

  Product

  Course Booking System

  Affected

  up to 6.1.2

  What to do

  Affects up to 6.1.2. Update Course Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Event Espresso – Custom Email Template Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32507 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aakif Kadiwala Event Espresso – Custom Email Template Shortcode email-shortcode allows Reflected XSS.This issue affects Event Espresso – Custom Email Template Shortcode: from n/a through <= 1.0.0.

  Product

  Event Espresso – Custom Email Template Shortcode

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Event Espresso – Custom Email Template Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025AT Internet SmartTag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32506 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BenDlz AT Internet SmartTag at-internet allows Reflected XSS.This issue affects AT Internet SmartTag: from n/a through <= 0.2.

  Product

  AT Internet SmartTag

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update AT Internet SmartTag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Silvasoft boekhouden: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32504 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silvasoft Silvasoft boekhouden silvasoft-boekhouden allows Reflected XSS.This issue affects Silvasoft boekhouden: from n/a through <= 3.0.6.

  Product

  Silvasoft boekhouden

  Affected

  up to 3.0.6

  What to do

  Affects up to 3.0.6. Update Silvasoft boekhouden to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025wp secure: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32490 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebsiteDefender wp secure wp-secure-by-sitesecuritymonitorcom allows Stored XSS.This issue affects wp secure: from n/a through <= 1.2.

  Product

  wp secure

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update wp secure to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Ray Enterprise Translation: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31030 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows PHP Local File Inclusion.This issue affects Ray Enterprise Translation: from n/a through <= 1.7.0.

  Product

  Ray Enterprise Translation

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update Ray Enterprise Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025FireDrum Email Marketing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31018 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FireDrum FireDrum Email Marketing firedrum-email-marketing allows Reflected XSS.This issue affects FireDrum Email Marketing: from n/a through <= 1.64.

  Product

  FireDrum Email Marketing

  Affected

  up to 1.64

  What to do

  Affects up to 1.64. Update FireDrum Email Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Activity Reactions For Buddypress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31006 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arete-it Activity Reactions For Buddypress activity-reactions-for-buddypress allows Reflected XSS.This issue affects Activity Reactions For Buddypress: from n/a through <= 1.0.22.

  Product

  Activity Reactions For Buddypress

  Affected

  up to 1.0.22

  What to do

  Affects up to 1.0.22. Update Activity Reactions For Buddypress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Simple Email Subscriber: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27354 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phil88530 Simple Email Subscriber simple-email-subscriber allows Reflected XSS.This issue affects Simple Email Subscriber: from n/a through <= 2.3.

  Product

  Simple Email Subscriber

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Simple Email Subscriber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Rebuild Permalinks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27346 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gerrygooner Rebuild Permalinks rebuild-permalinks allows Reflected XSS.This issue affects Rebuild Permalinks: from n/a through <= 1.6.

  Product

  Rebuild Permalinks

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Rebuild Permalinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Booking Ultra Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27345 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Reflected XSS.This issue affects Booking Ultra Pro: from n/a through <= 1.1.19.

  Product

  Booking Ultra Pro

  Affected

  up to 1.1.19

  What to do

  Affects up to 1.1.19. Update Booking Ultra Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WooCommerce HTML5 Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27343 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webilop WooCommerce HTML5 Video woocommerce-html5-video allows Reflected XSS.This issue affects WooCommerce HTML5 Video: from n/a through <= 1.7.10.

  Product

  WooCommerce HTML5 Video

  Affected

  up to 1.7.10

  What to do

  Affects up to 1.7.10. Update WooCommerce HTML5 Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025List Urls: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27338 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in graphems List Urls list-urls allows Reflected XSS.This issue affects List Urls: from n/a through <= 0.2.

  Product

  List Urls

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update List Urls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Fontsampler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27337 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kontur Fontsampler fontsampler allows Reflected XSS.This issue affects Fontsampler: from n/a through <= 0.4.14.

  Product

  Fontsampler

  Affected

  up to 0.4.14

  What to do

  Affects up to 0.4.14. Update Fontsampler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Protected wp-login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27333 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alvego Protected wp-login protected-wp-login allows Reflected XSS.This issue affects Protected wp-login: from n/a through <= 2.1.

  Product

  Protected wp-login

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Protected wp-login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 202517TRACK for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27324 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 17track 17TRACK for WooCommerce 17track allows Reflected XSS.This issue affects 17TRACK for WooCommerce: from n/a through <= 1.2.10.

  Product

  17TRACK for WooCommerce

  Affected

  up to 1.2.10

  What to do

  Affects up to 1.2.10. Update 17TRACK for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025QR Code for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27322 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bappa Mal QR Code for WooCommerce wc-qr-codes allows Reflected XSS.This issue affects QR Code for WooCommerce: from n/a through <= 1.2.0.

  Product

  QR Code for WooCommerce

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update QR Code for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025User List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27319 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ivan82 User List user-list allows Reflected XSS.This issue affects User List: from n/a through <= 1.5.1.

  Product

  User List

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update User List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Kush Micro News: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27314 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kush Sharma Kush Micro News kush-micro-news allows Stored XSS.This issue affects Kush Micro News: from n/a through <= 1.6.7.

  Product

  Kush Micro News

  Affected

  up to 1.6.7

  What to do

  Affects up to 1.6.7. Update Kush Micro News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Google Maps GPX Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27313 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bernd Altmeier Google Maps GPX Viewer google-maps-gpx-viewer allows Reflected XSS.This issue affects Google Maps GPX Viewer: from n/a through <= 3.6.

  Product

  Google Maps GPX Viewer

  Affected

  up to 3.6

  What to do

  Affects up to 3.6. Update Google Maps GPX Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025flickr-slideshow-wrapper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27309 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeannot Muller flickr-slideshow-wrapper flickr-slideshow-wrapper allows Stored XSS.This issue affects flickr-slideshow-wrapper: from n/a through <= 5.4.6.

  Product

  flickr-slideshow-wrapper

  Affected

  up to 5.4.6

  What to do

  Affects up to 5.4.6. Update flickr-slideshow-wrapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP Video Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27308 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmstactics WP Video Posts wp-video-posts allows Reflected XSS.This issue affects WP Video Posts: from n/a through <= 3.5.1.

  Product

  WP Video Posts

  Affected

  up to 3.5.1

  What to do

  Affects up to 3.5.1. Update WP Video Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.