Vulnerability database

9,243 results · page 81 of 185

• Apr 17, 2025WooMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32602 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpcraft WooMS wooms allows Reflected XSS.This issue affects WooMS: from n/a through <= 9.12.

  Product

  WooMS

  Affected

  up to 9.12

  What to do

  Affects up to 9.12. Update WooMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Real Estate Manager: Improper Control of Generation of Code ('Code Injection')CVE-2025-32596 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Improper Control of Generation of Code ('Code Injection') vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Code Injection.This issue affects Real Estate Manager: from n/a through <= 7.3.

  Product

  Real Estate Manager

  Affected

  up to 7.3

  What to do

  Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Simple WP Events: Insertion of Sensitive Information Into Sent DataCVE-2025-32594 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Insertion of Sensitive Information Into Sent Data vulnerability in WPMinds Simple WP Events simple-wp-events allows Retrieve Embedded Sensitive Data.This issue affects Simple WP Events: from n/a through <= 1.8.17.

  Product

  Simple WP Events

  Affected

  up to 1.8.17

  What to do

  Affects up to 1.8.17. Update Simple WP Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025TableOn: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32592 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 TableOn posts-table-filterable allows Stored XSS.This issue affects TableOn: from n/a through <= 1.0.3.

  Product

  TableOn

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update TableOn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Web2application: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32590 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tzin111 Web2application web2application allows Reflected XSS.This issue affects Web2application: from n/a through <= 6.1.

  Product

  Web2application

  Affected

  up to 6.1

  What to do

  Affects up to 6.1. Update Web2application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Credova_Financial: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32588 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Credova Financial Credova_Financial credova-financial allows Reflected XSS.This issue affects Credova_Financial: from n/a through <= 2.4.8.

  Product

  Credova_Financial

  Affected

  up to 2.4.8

  What to do

  Affects up to 2.4.8. Update Credova_Financial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025PDF 2 Post: Improper Control of Generation of Code ('Code Injection')CVE-2025-32583 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Improper Control of Generation of Code ('Code Injection') vulnerability in termel PDF 2 Post pdf2post allows Remote Code Inclusion.This issue affects PDF 2 Post: from n/a through <= 2.4.0.

  Product

  PDF 2 Post

  Affected

  up to 2.4.0

  What to do

  Affects up to 2.4.0. Update PDF 2 Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP AutoKeyword: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32582 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EXEIdeas International WP AutoKeyword wp-autokeyword allows Stored XSS.This issue affects WP AutoKeyword: from n/a through <= 1.0.

  Product

  WP AutoKeyword

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP AutoKeyword to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Coming Soon Countdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32578 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mapro Collins Coming Soon Countdown coming-soon-countdown allows Reflected XSS.This issue affects Coming Soon Countdown: from n/a through <= 2.2.

  Product

  Coming Soon Countdown

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Coming Soon Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025KiotViet Sync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32573 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kiotviet KiotViet Sync allows SQL Injection. This issue affects KiotViet Sync: from n/a through 1.8.3.

  Product

  KiotViet Sync

  Affected

  up to 1.8.3

  What to do

  Affects up to 1.8.3. Update KiotViet Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025License For Envato: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32566 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashraful Sarkar Naiem License For Envato license-envato allows Reflected XSS.This issue affects License For Envato: from n/a through <= 1.0.0.

  Product

  License For Envato

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update License For Envato to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Stop Registration Spam: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32564 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tomroyal Stop Registration Spam allows Reflected XSS. This issue affects Stop Registration Spam: from n/a through 1.24.

  Product

  Stop Registration Spam

  Affected

  up to 1.24

  What to do

  Affects up to 1.24. Update Stop Registration Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP Easy Poll: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32562 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com WP Easy Poll wp-easy-poll-afo allows Reflected XSS.This issue affects WP Easy Poll: from n/a through <= 2.2.9.

  Product

  WP Easy Poll

  Affected

  up to 2.2.9

  What to do

  Affects up to 2.2.9. Update WP Easy Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP_DEBUG Toggle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32561 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plugins.club WP_DEBUG Toggle enable-wp-debug-toggle allows Reflected XSS.This issue affects WP_DEBUG Toggle: from n/a through <= 1.1.

  Product

  WP_DEBUG Toggle

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update WP_DEBUG Toggle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP-Hijri: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32560 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mohammad I. Okfie WP-Hijri wp-hijri allows Reflected XSS.This issue affects WP-Hijri: from n/a through <= 1.5.3.

  Product

  WP-Hijri

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update WP-Hijri to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP Featured Screenshot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32557 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rico Macchi WP Featured Screenshot wp-featured-screenshot allows Reflected XSS.This issue affects WP Featured Screenshot: from n/a through <= 1.3.

  Product

  WP Featured Screenshot

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update WP Featured Screenshot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Raptive Ads: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32554 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raptive Raptive Ads adthrive-ads allows Reflected XSS.This issue affects Raptive Ads: from n/a through <= 3.7.3.

  Product

  Raptive Ads

  Affected

  up to 3.7.3

  What to do

  Affects up to 3.7.3. Update Raptive Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025MSRP (RRP) Pricing for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32552 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory MSRP (RRP) Pricing for WooCommerce msrp-for-woocommerce allows Reflected XSS.This issue affects MSRP (RRP) Pricing for WooCommerce: from n/a through <= 1.8.1.

  Product

  MSRP (RRP) Pricing for WooCommerce

  Affected

  up to 1.8.1

  What to do

  Affects up to 1.8.1. Update MSRP (RRP) Pricing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Hamburger Icon Menu Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32548 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in borisolhor Hamburger Icon Menu Lite allows Reflected XSS. This issue affects Hamburger Icon Menu Lite: from n/a through 1.0.

  Product

  Hamburger Icon Menu Lite

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Hamburger Icon Menu Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Feedify – Web Push Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32540 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in feedify Feedify – Web Push Notifications push-notification-by-feedify allows Reflected XSS.This issue affects Feedify – Web Push Notifications: from n/a through <= 2.4.5.

  Product

  Feedify – Web Push Notifications

  Affected

  up to 2.4.5

  What to do

  Affects up to 2.4.5. Update Feedify – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025DN Shipping by Weight for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32535 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digireturn DN Shipping by Weight for WooCommerce dn-shipping-by-weight allows Reflected XSS.This issue affects DN Shipping by Weight for WooCommerce: from n/a through <= 1.2.

  Product

  DN Shipping by Weight for WooCommerce

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update DN Shipping by Weight for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Deliver via Shipos for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32533 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matat Technologies Deliver via Shipos for WooCommerce wc-shipos-delivery allows Reflected XSS.This issue affects Deliver via Shipos for WooCommerce: from n/a through <= 2.1.7.

  Product

  Deliver via Shipos for WooCommerce

  Affected

  up to 2.1.7

  What to do

  Affects up to 2.1.7. Update Deliver via Shipos for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025UXsniff: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32532 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pei Yong Goh UXsniff ux-sniff allows Reflected XSS.This issue affects UXsniff: from n/a through <= 1.3.3.

  Product

  UXsniff

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update UXsniff to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Arconix FAQ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32531 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Reflected XSS.This issue affects Arconix FAQ: from n/a through <= 1.9.5.

  Product

  Arconix FAQ

  Affected

  up to 1.9.5

  What to do

  Affects up to 1.9.5. Update Arconix FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Wallet System for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32530 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Reflected XSS.This issue affects Wallet System for WooCommerce: from n/a through <= 2.6.8.

  Product

  Wallet System for WooCommerce

  Affected

  up to 2.6.8

  What to do

  Affects up to 2.6.8. Update Wallet System for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025iONE360 configurator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32529 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iONE360 iONE360 configurator ione360-configurator allows Reflected XSS.This issue affects iONE360 configurator: from n/a through <= 2.0.57.

  Product

  iONE360 configurator

  Affected

  up to 2.0.57

  What to do

  Affects up to 2.0.57. Update iONE360 configurator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025iCal Feeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32528 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maximevalette iCal Feeds ical-feeds allows Reflected XSS.This issue affects iCal Feeds: from n/a through <= 1.5.3.

  Product

  iCal Feeds

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update iCal Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025T&P Gallery Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32527 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pey22 T&P Gallery Slider tp-gallery-slider allows Stored XSS.This issue affects T&P Gallery Slider: from n/a through <= 1.2.

  Product

  T&P Gallery Slider

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update T&P Gallery Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Zephyr Project Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32526 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a through <= 3.3.101.

  Product

  Zephyr Project Manager

  Affected

  up to 3.3.101

  What to do

  Affects up to 3.3.101. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025License Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32522 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Reflected XSS.This issue affects License Manager for WooCommerce: from n/a through <= 3.0.9.

  Product

  License Manager for WooCommerce

  Affected

  up to 3.0.9

  What to do

  Affects up to 3.0.9. Update License Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Cool Flipbox – Shortcode & Gutenberg Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32521 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CoolHappy Cool Flipbox – Shortcode & Gutenberg Block flip-boxes allows Reflected XSS.This issue affects Cool Flipbox – Shortcode & Gutenberg Block: from n/a through <= 1.8.3.

  Product

  Cool Flipbox – Shortcode & Gutenberg Block

  Affected

  up to 1.8.3

  What to do

  Affects up to 1.8.3. Update Cool Flipbox – Shortcode & Gutenberg Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WordPress Health and Server Condition – Integrated with Google Page Speed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32520 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M. Ali Saleem WordPress Health and Server Condition – Integrated with Google Page Speed wp-condition allows Reflected XSS.This issue affects WordPress Health and Server Condition – Integrated with Google Page Speed: from n/a through <= 4.1.1.

  Product

  WordPress Health and Server Condition – Integrated with Google Page Speed

  Affected

  up to 4.1.1

  What to do

  Affects up to 4.1.1. Update WordPress Health and Server Condition – Integrated with Google Page Speed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Related Videos for JW Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32516 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ilGhera Related Videos for JW Player related-videos-for-jw-player allows Reflected XSS.This issue affects Related Videos for JW Player: from n/a through <= 1.2.0.

  Product

  Related Videos for JW Player

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Related Videos for JW Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Terminal Africa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32515 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in terminalafrica Terminal Africa terminal-africa allows Reflected XSS.This issue affects Terminal Africa: from n/a through <= 1.13.24.

  Product

  Terminal Africa

  Affected

  up to 1.13.24

  What to do

  Affects up to 1.13.24. Update Terminal Africa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WooCommerce Estimate and Quote: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32514 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cscode WooCommerce Estimate and Quote wc-estimate-and-quote allows Reflected XSS.This issue affects WooCommerce Estimate and Quote: from n/a through <= 1.0.2.5.

  Product

  WooCommerce Estimate and Quote

  Affected

  up to 1.0.2.5

  What to do

  Affects up to 1.0.2.5. Update WooCommerce Estimate and Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Nomupay Payment Processing Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32513 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocessing-card-payments allows Reflected XSS.This issue affects Nomupay Payment Processing Gateway: from n/a through <= 7.1.6.

  Product

  Nomupay Payment Processing Gateway

  Affected

  up to 7.1.6

  What to do

  Affects up to 7.1.6. Update Nomupay Payment Processing Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Revamp CRM for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32512 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revampcrm Revamp CRM for WooCommerce revampcrm-woocommerce allows Reflected XSS.This issue affects Revamp CRM for WooCommerce: from n/a through <= 1.1.2.

  Product

  Revamp CRM for WooCommerce

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Revamp CRM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Make Email Customizer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32511 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Excellent Dynamics Make Email Customizer for WooCommerce make-email-customizer-for-woocommerce allows Reflected XSS.This issue affects Make Email Customizer for WooCommerce: from n/a through <= 1.0.6.

  Product

  Make Email Customizer for WooCommerce

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Make Email Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Course Booking System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32508 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ComMotion Course Booking System course-booking-system allows Reflected XSS.This issue affects Course Booking System: from n/a through <= 6.1.2.

  Product

  Course Booking System

  Affected

  up to 6.1.2

  What to do

  Affects up to 6.1.2. Update Course Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Event Espresso – Custom Email Template Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32507 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aakif Kadiwala Event Espresso – Custom Email Template Shortcode email-shortcode allows Reflected XSS.This issue affects Event Espresso – Custom Email Template Shortcode: from n/a through <= 1.0.0.

  Product

  Event Espresso – Custom Email Template Shortcode

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Event Espresso – Custom Email Template Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025AT Internet SmartTag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32506 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BenDlz AT Internet SmartTag at-internet allows Reflected XSS.This issue affects AT Internet SmartTag: from n/a through <= 0.2.

  Product

  AT Internet SmartTag

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update AT Internet SmartTag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Silvasoft boekhouden: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32504 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silvasoft Silvasoft boekhouden silvasoft-boekhouden allows Reflected XSS.This issue affects Silvasoft boekhouden: from n/a through <= 3.0.6.

  Product

  Silvasoft boekhouden

  Affected

  up to 3.0.6

  What to do

  Affects up to 3.0.6. Update Silvasoft boekhouden to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025wp secure: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32490 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebsiteDefender wp secure wp-secure-by-sitesecuritymonitorcom allows Stored XSS.This issue affects wp secure: from n/a through <= 1.2.

  Product

  wp secure

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update wp secure to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Ray Enterprise Translation: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31030 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows PHP Local File Inclusion.This issue affects Ray Enterprise Translation: from n/a through <= 1.7.0.

  Product

  Ray Enterprise Translation

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update Ray Enterprise Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025FireDrum Email Marketing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31018 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FireDrum FireDrum Email Marketing firedrum-email-marketing allows Reflected XSS.This issue affects FireDrum Email Marketing: from n/a through <= 1.64.

  Product

  FireDrum Email Marketing

  Affected

  up to 1.64

  What to do

  Affects up to 1.64. Update FireDrum Email Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Activity Reactions For Buddypress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31006 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arete-it Activity Reactions For Buddypress activity-reactions-for-buddypress allows Reflected XSS.This issue affects Activity Reactions For Buddypress: from n/a through <= 1.0.22.

  Product

  Activity Reactions For Buddypress

  Affected

  up to 1.0.22

  What to do

  Affects up to 1.0.22. Update Activity Reactions For Buddypress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Simple Email Subscriber: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27354 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phil88530 Simple Email Subscriber simple-email-subscriber allows Reflected XSS.This issue affects Simple Email Subscriber: from n/a through <= 2.3.

  Product

  Simple Email Subscriber

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Simple Email Subscriber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Rebuild Permalinks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27346 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gerrygooner Rebuild Permalinks rebuild-permalinks allows Reflected XSS.This issue affects Rebuild Permalinks: from n/a through <= 1.6.

  Product

  Rebuild Permalinks

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Rebuild Permalinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Booking Ultra Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27345 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Reflected XSS.This issue affects Booking Ultra Pro: from n/a through <= 1.1.19.

  Product

  Booking Ultra Pro

  Affected

  up to 1.1.19

  What to do

  Affects up to 1.1.19. Update Booking Ultra Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WooCommerce HTML5 Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27343 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webilop WooCommerce HTML5 Video woocommerce-html5-video allows Reflected XSS.This issue affects WooCommerce HTML5 Video: from n/a through <= 1.7.10.

  Product

  WooCommerce HTML5 Video

  Affected

  up to 1.7.10

  What to do

  Affects up to 1.7.10. Update WooCommerce HTML5 Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.