Vulnerability database

8,919 results · page 92 of 179

• Mar 27, 2025Off-Canvas Sidebars & Menus (Slidebars): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30860 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars allows DOM-Based XSS.This issue affects Off-Canvas Sidebars & Menus (Slidebars): from n/a through <= 0.5.8.2.

  Product

  Off-Canvas Sidebars & Menus (Slidebars)

  Affected

  up to 0.5.8.2

  What to do

  Affects up to 0.5.8.2. Update Off-Canvas Sidebars & Menus (Slidebars) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Dr. Flex: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30850 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sfaerber Dr. Flex dr-flex allows Stored XSS.This issue affects Dr. Flex: from n/a through <= 2.0.0.

  Product

  Dr. Flex

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Dr. Flex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Novelist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30847 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashley Novelist novelist allows Stored XSS.This issue affects Novelist: from n/a through <= 1.2.3.

  Product

  Novelist

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Novelist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Restaurant Menu by MotoPress: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30846 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows PHP Local File Inclusion.This issue affects Restaurant Menu by MotoPress: from n/a through <= 2.4.4.

  Product

  Restaurant Menu by MotoPress

  Affected

  up to 2.4.4

  What to do

  Affects up to 2.4.4. Update Restaurant Menu by MotoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025The Pack Elementor addons: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30845 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in webangon The Pack Elementor addons the-pack-addon allows PHP Local File Inclusion.This issue affects The Pack Elementor addons: from n/a through <= 2.1.1.

  Product

  The Pack Elementor addons

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025bizcalendar-web: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30843 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in setriosoft bizcalendar-web bizcalendar-web allows SQL Injection.This issue affects bizcalendar-web: from n/a through <= 1.1.0.34.

  Product

  bizcalendar-web

  Affected

  up to 1.1.0.34

  What to do

  Affects up to 1.1.0.34. Update bizcalendar-web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Cozy Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30838 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through <= 2.1.6.

  Product

  Cozy Blocks

  Affected

  up to 2.1.6

  What to do

  Affects up to 2.1.6. Update Cozy Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025LatePoint: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30836 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LatePoint LatePoint latepoint allows Stored XSS.This issue affects LatePoint: from n/a through <= 5.1.6.

  Product

  LatePoint

  Affected

  up to 5.1.6

  What to do

  Affects up to 5.1.6. Update LatePoint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Themify Event Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30832 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Event Post themify-event-post allows DOM-Based XSS.This issue affects Themify Event Post: from n/a through <= 1.3.2.

  Product

  Themify Event Post

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update Themify Event Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Themify Event Post: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30831 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Event Post themify-event-post allows PHP Local File Inclusion.This issue affects Themify Event Post: from n/a through <= 1.3.2.

  Product

  Themify Event Post

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update Themify Event Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WPCafe: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30829 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics WPCafe wp-cafe allows PHP Local File Inclusion.This issue affects WPCafe: from n/a through <= 2.2.31.

  Product

  WPCafe

  Affected

  up to 2.2.31

  What to do

  Affects up to 2.2.31. Update WPCafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025IP Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30826 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy IP Locator ip-locator allows DOM-Based XSS.This issue affects IP Locator: from n/a through <= 4.1.0.

  Product

  IP Locator

  Affected

  up to 4.1.0

  What to do

  Affects up to 4.1.0. Update IP Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WishSuite: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30820 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in HT Plugins WishSuite wishsuite allows PHP Local File Inclusion.This issue affects WishSuite: from n/a through <= 1.4.4.

  Product

  WishSuite

  Affected

  up to 1.4.4

  What to do

  Affects up to 1.4.4. Update WishSuite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Simple Giveaways: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30819 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Igor Benic Simple Giveaways giveasap allows SQL Injection.This issue affects Simple Giveaways: from n/a through <= 2.48.1.

  Product

  Simple Giveaways

  Affected

  up to 2.48.1

  What to do

  Affects up to 2.48.1. Update Simple Giveaways to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025jAlbum Bridge: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30818 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mlaza jAlbum Bridge jalbum-bridge allows DOM-Based XSS.This issue affects jAlbum Bridge: from n/a through <= 2.0.17.

  Product

  jAlbum Bridge

  Affected

  up to 2.0.17

  What to do

  Affects up to 2.0.17. Update jAlbum Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025The Post Grid: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30814 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme The Post Grid the-post-grid allows PHP Local File Inclusion.This issue affects The Post Grid: from n/a through <= 7.7.17.

  Product

  The Post Grid

  Affected

  up to 7.7.17

  What to do

  Affects up to 7.7.17. Update The Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Listamester: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30813 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in listamester Listamester listamester allows Stored XSS.This issue affects Listamester: from n/a through <= 2.3.5.

  Product

  Listamester

  Affected

  up to 2.3.5

  What to do

  Affects up to 2.3.5. Update Listamester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025SKT Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30812 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Addons for Elementor skt-addons-for-elementor allows Stored XSS.This issue affects SKT Addons for Elementor: from n/a through <= 3.5.

  Product

  SKT Addons for Elementor

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update SKT Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Lead Form Data Collection to CRM: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30810 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-leads-builder-any-crm allows Blind SQL Injection.This issue affects Lead Form Data Collection to CRM: from n/a through <= 3.0.1.

  Product

  Lead Form Data Collection to CRM

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update Lead Form Data Collection to CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Vimeotheque: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30806 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows SQL Injection.This issue affects Vimeotheque: from n/a through <= 2.3.4.2.

  Product

  Vimeotheque

  Affected

  up to 2.3.4.2

  What to do

  Affects up to 2.3.4.2. Update Vimeotheque to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Gum Elementor Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30800 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atawai Gum Elementor Addon gum-elementor-addon allows Stored XSS.This issue affects Gum Elementor Addon: from n/a through <= 1.3.10.

  Product

  Gum Elementor Addon

  Affected

  up to 1.3.10

  What to do

  Affects up to 1.3.10. Update Gum Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WP Google Street View: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30799 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup WP Google Street View wp-google-street-view allows Stored XSS.This issue affects WP Google Street View: from n/a through <= 1.1.5.

  Product

  WP Google Street View

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update WP Google Street View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Comment Approved Notifier Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30792 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ufukart Comment Approved Notifier Extended comment-approved-notifier-extended allows Stored XSS.This issue affects Comment Approved Notifier Extended: from n/a through <= 5.2.

  Product

  Comment Approved Notifier Extended

  Affected

  up to 5.2

  What to do

  Affects up to 5.2. Update Comment Approved Notifier Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Cart tracking for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30791 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdever Cart tracking for WooCommerce cart-tracking-for-woocommerce allows SQL Injection.This issue affects Cart tracking for WooCommerce: from n/a through <= 1.0.16.

  Product

  Cart tracking for WooCommerce

  Affected

  up to 1.0.16

  What to do

  Affects up to 1.0.16. Update Cart tracking for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Clearout Email Validator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30789 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in clearoutio Clearout Email Validator clearout-email-validator allows Stored XSS.This issue affects Clearout Email Validator: from n/a through <= 3.2.0.

  Product

  Clearout Email Validator

  Affected

  up to 3.2.0

  What to do

  Affects up to 3.2.0. Update Clearout Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Quotes llama: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30786 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oooorgle Quotes llama quotes-llama allows DOM-Based XSS.This issue affects Quotes llama: from n/a through <= 3.1.0.

  Product

  Quotes llama

  Affected

  up to 3.1.0

  What to do

  Affects up to 3.1.0. Update Quotes llama to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Subscribe to Download Lite: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30785 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle Subscribe to Download Lite subscribe-to-download-lite allows PHP Local File Inclusion.This issue affects Subscribe to Download Lite: from n/a through <= 1.2.9.

  Product

  Subscribe to Download Lite

  Affected

  up to 1.2.9

  What to do

  Affects up to 1.2.9. Update Subscribe to Download Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WP Subscription Forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30784 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Shuffle WP Subscription Forms wp-subscription-forms allows SQL Injection.This issue affects WP Subscription Forms: from n/a through <= 1.2.3.

  Product

  WP Subscription Forms

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update WP Subscription Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Audio Album: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30780 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cubecolour Audio Album audio-album allows Stored XSS.This issue affects Audio Album: from n/a through <= 1.5.0.

  Product

  Audio Album

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update Audio Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Doneren met Mollie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30779 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick van Wobbie Doneren met Mollie doneren-met-mollie allows Stored XSS.This issue affects Doneren met Mollie: from n/a through <= 2.10.7.

  Product

  Doneren met Mollie

  Affected

  up to 2.10.7

  What to do

  Affects up to 2.10.7. Update Doneren met Mollie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Sitekit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30776 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue affects Sitekit: from n/a through <= 1.8.

  Product

  Sitekit

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update Sitekit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WPGuppy: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30775 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows SQL Injection.This issue affects WPGuppy: from n/a through <= 1.1.3.

  Product

  WPGuppy

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update WPGuppy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025WP Cassify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30771 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alain-Aymerick FRANCOIS WP Cassify wp-cassify allows DOM-Based XSS.This issue affects WP Cassify: from n/a through <= 2.3.5.

  Product

  WP Cassify

  Affected

  up to 2.3.5

  What to do

  Affects up to 2.3.5. Update WP Cassify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Charitable: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30770 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Charitable charitable allows DOM-Based XSS.This issue affects Charitable: from n/a through <= 1.8.4.7.

  Product

  Charitable

  Affected

  up to 1.8.4.7

  What to do

  Affects up to 1.8.4.7. Update Charitable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025jAlbum Bridge: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30768 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mlaza jAlbum Bridge jalbum-bridge allows Stored XSS.This issue affects jAlbum Bridge: from n/a through <= 2.0.18.

  Product

  jAlbum Bridge

  Affected

  up to 2.0.18

  What to do

  Affects up to 2.0.18. Update jAlbum Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30766 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows DOM-Based XSS.This issue affects Happy Addons for Elementor: from n/a through <= 3.16.2.

  Product

  Happy Addons for Elementor

  Affected

  up to 3.16.2

  What to do

  Affects up to 3.16.2. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025FlexStock: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30765 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPPOOL FlexStock stock-sync-with-google-sheet-for-woocommerce allows Blind SQL Injection.This issue affects FlexStock: from n/a through <= 3.13.1.

  Product

  FlexStock

  Affected

  up to 3.13.1

  What to do

  Affects up to 3.13.1. Update FlexStock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 27, 2025EO4WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30763 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer EO4WP fw-integration-for-emailoctopus allows Stored XSS.This issue affects EO4WP: from n/a through <= 1.0.8.4.

  Product

  EO4WP

  Affected

  up to 1.0.8.4

  What to do

  Affects up to 1.0.8.4. Update EO4WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Product Catalog: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30524 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in origincode Product Catalog displayproduct allows SQL Injection.This issue affects Product Catalog: from n/a through <= 1.0.4.

  Product

  Product Catalog

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Trust Payments Gateway for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28942 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Trust Payments Trust Payments Gateway for WooCommerce trust-payments-hosted-payment-pages-integration allows SQL Injection.This issue affects Trust Payments Gateway for WooCommerce: from n/a through <= 1.1.4.

  Product

  Trust Payments Gateway for WooCommerce

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Trust Payments Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025WP Google Calendar Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28939 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in EuroCizia WP Google Calendar Manager wp-gcalendar allows Blind SQL Injection.This issue affects WP Google Calendar Manager: from n/a through <= 2.1.

  Product

  WP Google Calendar Manager

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update WP Google Calendar Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Fancybox Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28935 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in puzich Fancybox Plus fancybox-plus allows Reflected XSS.This issue affects Fancybox Plus: from n/a through <= 1.0.1.

  Product

  Fancybox Plus

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Fancybox Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Simple Post Series: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28934 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chaozh Simple Post Series simple-post-series allows Reflected XSS.This issue affects Simple Post Series: from n/a through <= 2.4.4.

  Product

  Simple Post Series

  Affected

  up to 2.4.4

  What to do

  Affects up to 2.4.4. Update Simple Post Series to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Are you robot google recaptcha for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28928 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sureshdsk Are you robot google recaptcha for wordpress are-you-robot-recaptcha allows Reflected XSS.This issue affects Are you robot google recaptcha for wordpress: from n/a through <= 2.2.

  Product

  Are you robot google recaptcha for

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Are you robot google recaptcha for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025ZenphotoPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28924 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simbul ZenphotoPress zenphotopress allows Reflected XSS.This issue affects ZenphotoPress: from n/a through <= 1.8.

  Product

  ZenphotoPress

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update ZenphotoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025SpatialMatch IDX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28921 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in homejunction SpatialMatch IDX spatialmatch-free-lifestyle-search allows Reflected XSS.This issue affects SpatialMatch IDX: from n/a through <= 3.0.9.

  Product

  SpatialMatch IDX

  Affected

  up to 3.0.9

  What to do

  Affects up to 3.0.9. Update SpatialMatch IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Custom Smilies: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28917 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crazyloong Custom Smilies custom-smilies-se allows Stored XSS.This issue affects Custom Smilies: from n/a through <= 2.9.2.

  Product

  Custom Smilies

  Affected

  up to 2.9.2

  What to do

  Affects up to 2.9.2. Update Custom Smilies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Docpro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-28916 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rashid Docpro docpro allows PHP Local File Inclusion.This issue affects Docpro: from n/a through <= 2.0.1.

  Product

  Docpro

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Docpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Gravity 2 PDF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28911 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gravity2pdf Gravity 2 PDF gf2pdf allows Reflected XSS.This issue affects Gravity 2 PDF: from n/a through <= 3.1.3.

  Product

  Gravity 2 PDF

  Affected

  up to 3.1.3

  What to do

  Affects up to 3.1.3. Update Gravity 2 PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Driving Directions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28903 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hectorgarrofe Driving Directions ddirections allows Reflected XSS.This issue affects Driving Directions: from n/a through <= 1.4.4.

  Product

  Driving Directions

  Affected

  up to 1.4.4

  What to do

  Affects up to 1.4.4. Update Driving Directions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.