Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

549new WordPress flaws this week

391,964entries in the database

12,393 results · page 86 of 248

Aug 20, 2025iFrame Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49411 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Sharma iFrame Block allows Stored XSS. This issue affects iFrame Block: from n/a through 0.1.1.
Product
iFrame Block
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update iFrame Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025TC Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49410 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC Testimonials allows Stored XSS. This issue affects TC Testimonials: from n/a through 1.1.1.
Product
TC Testimonials
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update TC Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025SensorPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49409 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brewlabs SensorPress allows Stored XSS. This issue affects SensorPress: from n/a through 1.0.
Product
SensorPress
Affected
up to 1.0
What to do
Affects up to 1.0. Update SensorPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49400 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) allows Stored XSS. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 8.2.
Product
WP Visitor Statistics (Real Time Traffic)
Affected
up to 8.2
What to do
Affects up to 8.2. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Colorbox Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49397 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Colorbox Lightbox wp-colorbox allows Stored XSS.This issue affects Colorbox Lightbox: from n/a through <= 1.1.5.
Product
Colorbox Lightbox
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Colorbox Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Themify Icons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49395 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Icons themify-icons allows Stored XSS.This issue affects Themify Icons: from n/a through <= 2.0.3.
Product
Themify Icons
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Themify Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Themify Audio Dock: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49392 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Audio Dock themify-audio-dock allows Stored XSS.This issue affects Themify Audio Dock: from n/a through <= 2.0.5.
Product
Themify Audio Dock
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Themify Audio Dock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Notice Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49389 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Solutions Notice Bar notice-bar allows Stored XSS.This issue affects Notice Bar: from n/a through <= 3.1.3.
Product
Notice Bar
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Notice Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Simple Link Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48297 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Reflected XSS.This issue affects Simple Link Directory: from n/a through < 14.8.1.
Product
Simple Link Directory
What to do
Update Simple Link Directory to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025UpStore: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48296 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup UpStore upstore allows Reflected XSS.This issue affects UpStore: from n/a through <= 1.7.0.
Product
UpStore
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update UpStore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Universal Video Player - Addon for WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48170 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery Page Builder lbg-universal-video-player-addon-visual-composer allows Reflected XSS.This issue affects Universal Video Player - Addon for WPBakery Page Builder: from n/a through <= 3.2.1.
Product
Universal Video Player - Addon for WPBakery Page Builder
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Universal Video Player - Addon for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Apollo - Sticky Full Width HTML5 Audio Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48168 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Apollo - Sticky Full Width HTML5 Audio Player lbg-audio5-html5-shoutcast-sticky allows Reflected XSS.This issue affects Apollo - Sticky Full Width HTML5 Audio Player: from n/a through <= 3.4.
Product
Apollo - Sticky Full Width HTML5 Audio Player
Affected
up to 3.4
What to do
Affects up to 3.4. Update Apollo - Sticky Full Width HTML5 Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48163 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support lbg-audio8-html5-radio-ads allows Reflected XSS.This issue affects SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support: from n/a through <= 3.5.4.
Product
SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support
Affected
up to 3.5.4
What to do
Affects up to 3.5.4. Update SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Simple Business Directory Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48162 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Reflected XSS.This issue affects Simple Business Directory Pro: from n/a through <= 15.5.1.
Product
Simple Business Directory Pro
Affected
up to 15.5.1
What to do
Affects up to 15.5.1. Update Simple Business Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Youtube Vimeo Video Player and Slider WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48159 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Youtube Vimeo Video Player and Slider WP Plugin video-player-youtube-vimeo allows Reflected XSS.This issue affects Youtube Vimeo Video Player and Slider WP Plugin: from n/a through <= 3.8.
Product
Youtube Vimeo Video Player and Slider WP
Affected
up to 3.8
What to do
Affects up to 3.8. Update Youtube Vimeo Video Player and Slider WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Multimedia Playlist Slider Addon for WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48154 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Multimedia Playlist Slider Addon for WPBakery Page Builder lbg_vp_youtube_vimeo_addon_visual_composer allows Reflected XSS.This issue affects Multimedia Playlist Slider Addon for WPBakery Page Builder: from n/a through <= 2.1.
Product
Multimedia Playlist Slider Addon for WPBakery Page Builder
Affected
up to 2.1
What to do
Affects up to 2.1. Update Multimedia Playlist Slider Addon for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Rentsyst: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48152 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dimafreund Rentsyst rentsyst allows Reflected XSS.This issue affects Rentsyst: from n/a through <= 2.0.100.
Product
Rentsyst
Affected
up to 2.0.100
What to do
Affects up to 2.0.100. Update Rentsyst to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025CM Map Locations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48151 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations cm-map-locations allows Reflected XSS.This issue affects CM Map Locations: from n/a through <= 2.1.6.
Product
CM Map Locations
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update CM Map Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025WP Pipes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28977 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress WP Pipes allows Reflected XSS. This issue affects WP Pipes: from n/a through 1.4.3.
Product
WP Pipes
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update WP Pipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025WPC Smart Quick View for WooCommerce: Stored Cross-Site ScriptingCVE-2025-8618 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woosq_btn shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPC Smart Quick View for WooCommerce
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update WPC Smart Quick View for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 19, 2025Contact Manager: Stored Cross-Site ScriptingCVE-2025-8783 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Contact Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title’ parameter in all versions up to, and including, 8.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Contact Manager
Affected
up to 8.6.5
What to do
Affects up to 8.6.5. Update Contact Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 19, 2025Nexter Blocks: Stored Cross-Site ScriptingCVE-2025-8567 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Nexter Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Nexter Blocks
Affected
up to 4.5.4
What to do
Affects up to 4.5.4. Update Nexter Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 19, 2025Flexible Map: Stored Cross-Site ScriptingCVE-2025-8622 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flexible Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Flexible Maps shortcode in all versions up to, and including, 1.18.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Flexible Map
Affected
up to 1.18.0
What to do
Affects up to 1.18.0. Update Flexible Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 19, 2025WPC Smart Compare for WooCommerce: Stored Cross-Site ScriptingCVE-2025-7496 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via DOM elements in all versions up to, and including, 6.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPC Smart Compare for WooCommerce
Affected
up to 6.4.7
What to do
Affects up to 6.4.7. Update WPC Smart Compare for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 16, 2025Soledad: Stored Cross-Site ScriptingCVE-2025-8143 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pcsml_smartlists_h’ parameter in all versions up to, and including, 8.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Soledad
Affected
up to 8.6.7
What to do
Affects up to 8.6.7. Update Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 16, 2025Translate This gTranslate Shortcode: Stored Cross-Site ScriptingCVE-2025-8719 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Translate This gTranslate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘base_lang’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Translate This gTranslate Shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update Translate This gTranslate Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Aug 16, 2025User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2025-8896 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_communication_preferences[]' parameter in all versions up to, and including, 3.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the GDPR Communication Preferences module is enabled and at least one GDPR Communication Preferences field has been added to the edit profile form.
Product
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Affected
up to 3.14.3
What to do
Affects up to 3.14.3. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 16, 2025Advanced iFrame: Stored Cross-Site ScriptingCVE-2025-8089 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in version less than, or equal to, 2025.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced iFrame
What to do
Update Advanced iFrame to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2025Intl DateTime Calendar: Stored Cross-Site ScriptingCVE-2025-8293 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Intl DateTime Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Intl DateTime Calendar
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Intl DateTime Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 16, 2025Earnware Connect: Stored Cross-Site ScriptingCVE-2025-7651 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Earnware Connect plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ew_hasrole' shortcode in all versions up to, and including, 1.0.74 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Earnware Connect
Affected
up to 1.0.74
What to do
Affects up to 1.0.74. Update Earnware Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 16, 2025Surbma | Recent Comments Shortcode: Stored Cross-Site ScriptingCVE-2025-7649 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Surbma | Recent Comments Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'recent-comments' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Surbma | Recent Comments Shortcode
Affected
up to 2.0
What to do
Affects up to 2.0. Update Surbma | Recent Comments Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordfence.com
Aug 16, 2025Anber Elementor Addon: Stored Cross-Site ScriptingCVE-2025-7440 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Anber Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $item['button_link']['url'] parameter in all versions up to, and including, 1.0.1 to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Anber Elementor Addon
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Anber Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 16, 2025Anber Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $anber_item['button_link']['url']’ parameter in all versions up CVE-2025-7439 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Anber Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $anber_item['button_link']['url']’ parameter in all versions up to, and including, 1.0.1 to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 16, 2025Embed Bokun: Stored Cross-Site ScriptingCVE-2025-6221 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Embed Bokun plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 0.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Embed Bokun
Affected
up to 0.23
What to do
Affects up to 0.23. Update Embed Bokun to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2025Dropshix: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49898 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xolluteon Dropshix allows DOM-Based XSS.This issue affects Dropshix: from n/a through 4.0.14.
Product
Dropshix
Affected
up to 4.0.14
What to do
Affects up to 4.0.14. Update Dropshix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 15, 2025Plugin README Parser: Stored Cross-Site ScriptingCVE-2025-8720 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Plugin README Parser plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘target’ parameter in all versions up to, and including, 1.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Plugin README Parser
Affected
up to 1.3.15
What to do
Affects up to 1.3.15. Update Plugin README Parser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Aug 15, 2025Alobaidi Captcha: Stored Cross-Site ScriptingCVE-2025-8080 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Alobaidi Captcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Alobaidi Captcha
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Alobaidi Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2025Radius Blocks: Stored Cross-Site ScriptingCVE-2025-5844 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Radius Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘subHeadingTagName’ parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Radius Blocks
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Radius Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 15, 2025WP Table Builder – WordPress Table: Stored Cross-Site ScriptingCVE-2025-8604 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Table Builder – WordPress Table Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wptb shortcode in all versions up to, and including, 2.0.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Table Builder – WordPress Table
Affected
up to 2.0.12
What to do
Affects up to 2.0.12. Update WP Table Builder – WordPress Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2025Essential Addons for Elementor – Popular Elementor Templates & Widgets: DOM-Based Stored Cross-Site ScriptingCVE-2025-8451 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘data-gallery-items’ parameter in all versions up to, and including, 6.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Addons for Elementor – Popular Elementor Templates & Widgets
Affected
up to 6.2.2
What to do
Affects up to 6.2.2. Update Essential Addons for Elementor – Popular Elementor Templates & Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2025Graphina - Elementor Charts and Graphs: Stored Cross-Site ScriptingCVE-2025-8867 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Graphina - Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widget parameters in version 3.1.3 and below. This is due to insufficient input sanitization and output escaping on user supplied attributes such as chart categories, titles, and tooltip settings. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Graphina - Elementor Charts and Graphs
What to do
Update Graphina - Elementor Charts and Graphs to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2025JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-55714 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.9.
Product
JetElements For Elementor
Affected
up to 2.7.9
What to do
Affects up to 2.7.9. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Blocksy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-55713 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativethemeshq Blocksy blocksy allows Stored XSS.This issue affects Blocksy: from n/a through <= 2.1.6.
Product
Blocksy
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update Blocksy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025WP Table Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-55711 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Stored XSS.This issue affects WP Table Builder: from n/a through <= 2.0.12.
Product
WP Table Builder
Affected
up to 2.0.12
What to do
Affects up to 2.0.12. Update WP Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Visual Composer Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-55709 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Stored XSS.This issue affects Visual Composer Website Builder: from n/a through < 45.15.0.
Product
Visual Composer Website Builder
What to do
Update Visual Composer Website Builder to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025JetProductGallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54749 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductGallery jet-woo-product-gallery allows Stored XSS.This issue affects JetProductGallery: from n/a through <= 2.2.0.2.
Product
JetProductGallery
Affected
up to 2.2.0.2
What to do
Affects up to 2.2.0.2. Update JetProductGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Templatera: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54747 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbakery Templatera templatera allows DOM-Based XSS.This issue affects Templatera: from n/a through <= 2.3.0.
Product
Templatera
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Templatera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Shortcode Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54746 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cartpauj Shortcode Redirect shortcode-redirect allows Stored XSS.This issue affects Shortcode Redirect: from n/a through <= 1.0.02.
Product
Shortcode Redirect
Affected
up to 1.0.02
What to do
Affects up to 1.0.02. Update Shortcode Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Print My Blog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54740 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Nelson Print My Blog print-my-blog allows Stored XSS.This issue affects Print My Blog: from n/a through <= 3.27.9.
Product
Print My Blog
Affected
up to 3.27.9
What to do
Affects up to 3.27.9. Update Print My Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Webba Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54729 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Stored XSS.This issue affects Webba Booking: from n/a through <= 6.0.5.
Product
Webba Booking
Affected
up to 6.0.5
What to do
Affects up to 6.0.5. Update Webba Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.