Vulnerability database

9,244 results · page 92 of 185

• Mar 31, 2025Timeline Event History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31595 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Timeline Event History timeline-event-history allows Stored XSS.This issue affects Timeline Event History: from n/a through <= 3.2.

  Product

  Timeline Event History

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update Timeline Event History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025OpenMenu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31593 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OpenMenu OpenMenu allows Stored XSS. This issue affects OpenMenu: from n/a through 3.5.

  Product

  OpenMenu

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update OpenMenu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Send E-mail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31592 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo Melchiorre Send E-mail send-e-mail allows Stored XSS.This issue affects Send E-mail: from n/a through <= 1.3.

  Product

  Send E-mail

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Send E-mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Exit Popup Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31591 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in promoz73 Exit Popup Free exit-popup-free allows Stored XSS.This issue affects Exit Popup Free: from n/a through <= 1.0.

  Product

  Exit Popup Free

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Exit Popup Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025WP Date and Time Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31590 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denra.com WP Date and Time Shortcode wp-date-and-time-shortcode allows Stored XSS.This issue affects WP Date and Time Shortcode: from n/a through <= 2.6.7.

  Product

  WP Date and Time Shortcode

  Affected

  up to 2.6.7

  What to do

  Affects up to 2.6.7. Update WP Date and Time Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Ethiopian Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31589 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kibru Demeke Ethiopian Calendar ethiopian-calendar allows Stored XSS.This issue affects Ethiopian Calendar: from n/a through <= 1.1.1.

  Product

  Ethiopian Calendar

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Ethiopian Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Elfsight Testimonials Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31587 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elfsight Elfsight Testimonials Slider elfsight-testimonials-slider allows Stored XSS.This issue affects Elfsight Testimonials Slider: from n/a through <= 1.0.1.

  Product

  Elfsight Testimonials Slider

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Elfsight Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Gallery – Photo Albums: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31586 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery – Photo Albums Plugin easy-media-gallery allows Stored XSS.This issue affects Gallery – Photo Albums Plugin: from n/a through <= 1.3.170.

  Product

  Gallery – Photo Albums

  Affected

  up to 1.3.170

  What to do

  Affects up to 1.3.170. Update Gallery – Photo Albums to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Flag Icons: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-31575 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Vasilis Triantafyllou Flag Icons language-icons-flags-switcher allows Stored XSS.This issue affects Flag Icons: from n/a through <= 2.2.

  Product

  Flag Icons

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Flag Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Custom Content Scrollbar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31574 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoftHopper Custom Content Scrollbar custom-content-scrollbar allows Stored XSS.This issue affects Custom Content Scrollbar: from n/a through <= 1.3.

  Product

  Custom Content Scrollbar

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Custom Content Scrollbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025themesflat-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31567 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows Stored XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.3.1.

  Product

  themesflat-addons-for-elementor

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update themesflat-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Uptime Robot Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31562 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aphotrax Uptime Robot Plugin for WordPress uptime-robot-monitor allows DOM-Based XSS.This issue affects Uptime Robot Plugin for WordPress: from n/a through <= 2.3.

  Product

  Uptime Robot Plugin for

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Uptime Robot Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Custom Database Applications by Caspio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31559 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caspio Bridge Custom Database Applications by Caspio custom-database-applications-by-caspio allows DOM-Based XSS.This issue affects Custom Database Applications by Caspio: from n/a through <= 2.1.

  Product

  Custom Database Applications by Caspio

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Custom Database Applications by Caspio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025OSM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31557 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MiKa OSM osm allows DOM-Based XSS.This issue affects OSM: from n/a through <= 6.1.13.

  Product

  OSM

  Affected

  up to 6.1.13

  What to do

  Affects up to 6.1.13. Update OSM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025IMPress for IDX Broker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31556 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through <= 3.2.3.

  Product

  IMPress for IDX Broker

  Affected

  up to 3.2.3

  What to do

  Affects up to 3.2.3. Update IMPress for IDX Broker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Fusion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31549 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agency Dominion Inc. Fusion fusion allows DOM-Based XSS.This issue affects Fusion: from n/a through <= 1.6.4.

  Product

  Fusion

  Affected

  up to 1.6.4

  What to do

  Affects up to 1.6.4. Update Fusion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Uptime Robot Plugin for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31547 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aphotrax Uptime Robot Plugin for WordPress uptime-robot-monitor allows SQL Injection.This issue affects Uptime Robot Plugin for WordPress: from n/a through <= 2.3.

  Product

  Uptime Robot Plugin for

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Uptime Robot Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Twice Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31543 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twice Commerce Twice Commerce embed-rentle allows DOM-Based XSS.This issue affects Twice Commerce: from n/a through <= 1.3.1.

  Product

  Twice Commerce

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Twice Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025My auctions allegro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31542 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Blind SQL Injection.This issue affects My auctions allegro: from n/a through <= 3.6.20.

  Product

  My auctions allegro

  Affected

  up to 3.6.20

  What to do

  Affects up to 3.6.20. Update My auctions allegro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Checklist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31538 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in checklistcom Checklist checklist allows Stored XSS.This issue affects Checklist: from n/a through <= 1.1.9.

  Product

  Checklist

  Affected

  up to 1.1.9

  What to do

  Affects up to 1.1.9. Update Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Simple Owl Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31535 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Owl Carousel simple-owl-carousel allows DOM-Based XSS.This issue affects Simple Owl Carousel: from n/a through <= 1.1.1.

  Product

  Simple Owl Carousel

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Simple Owl Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025AtomChat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31532 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team AtomChat AtomChat atomchat allows Stored XSS.This issue affects AtomChat: from n/a through <= 1.1.8.

  Product

  AtomChat

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update AtomChat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Behance Portfolio Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31526 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows SQL Injection.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.

  Product

  Behance Portfolio Manager

  Affected

  up to 1.7.5

  What to do

  Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Churel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31419 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeix Churel allows DOM-Based XSS.This issue affects Churel: from n/a through 1.0.8.

  Product

  Churel

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Churel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025JetSmartFilters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30963 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows DOM-Based XSS.This issue affects JetSmartFilters: from n/a through <= 3.6.3.

  Product

  JetSmartFilters

  Affected

  up to 3.6.3

  What to do

  Affects up to 3.6.3. Update JetSmartFilters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Tantyyellow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23995 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ta2g Tantyyellow allows Reflected XSS.This issue affects Tantyyellow: from n/a through 1.0.0.5.

  Product

  Tantyyellow

  Affected

  up to 1.0.0.5

  What to do

  Affects up to 1.0.0.5. Update Tantyyellow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Simple:Press: Missing AuthorizationCVE-2025-31386 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in simplepress Simple:Press simplepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple:Press: from n/a through <= 6.11.5.

  Product

  Simple:Press

  Affected

  up to 6.11.5

  What to do

  Affects up to 6.11.5. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Trackserver: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30961 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tinuzz Trackserver trackserver allows DOM-Based XSS.This issue affects Trackserver: from n/a through <= 5.1.0.

  Product

  Trackserver

  Affected

  up to 5.1.0

  What to do

  Affects up to 5.1.0. Update Trackserver to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Cost Calculator Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31414 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder allows Stored XSS.This issue affects Cost Calculator Builder: from n/a through <= 3.2.65.

  Product

  Cost Calculator Builder

  Affected

  up to 3.2.65

  What to do

  Affects up to 3.2.65. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025JetProductGallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31412 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductGallery jet-woo-product-gallery allows DOM-Based XSS.This issue affects JetProductGallery: from n/a through <= 2.1.22.

  Product

  JetProductGallery

  Affected

  up to 2.1.22

  What to do

  Affects up to 2.1.22. Update JetProductGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025InstaWP Connect: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31387 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in InstaWP InstaWP Connect instawp-connect allows PHP Local File Inclusion.This issue affects InstaWP Connect: from n/a through <= 0.1.0.82.

  Product

  InstaWP Connect

  Affected

  up to 0.1.0.82

  What to do

  Affects up to 0.1.0.82. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025JetSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31043 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows DOM-Based XSS.This issue affects JetSearch: from n/a through <= 3.5.7.

  Product

  JetSearch

  Affected

  up to 3.5.7

  What to do

  Affects up to 3.5.7. Update JetSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025JetWooBuilder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31016 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows PHP Local File Inclusion.This issue affects JetWooBuilder: from n/a through <= 2.1.18.

  Product

  JetWooBuilder

  Affected

  up to 2.1.18

  What to do

  Affects up to 2.1.18. Update JetWooBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025JetBlocks For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30987 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.16.

  Product

  JetBlocks For Elementor

  Affected

  up to 1.3.16

  What to do

  Affects up to 1.3.16. Update JetBlocks For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Accounting for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30835 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Bastien Ho Accounting for WooCommerce accounting-for-woocommerce allows PHP Local File Inclusion.This issue affects Accounting for WooCommerce: from n/a through <= 1.6.8.

  Product

  Accounting for WooCommerce

  Affected

  up to 1.6.8

  What to do

  Affects up to 1.6.8. Update Accounting for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025SimplyRETS Real Estate IDX: Cross-Site Request Forgery (CSRF)CVE-2025-31010 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets allows Cross Site Request Forgery.This issue affects SimplyRETS Real Estate IDX: from n/a through <= 3.0.5.

  Product

  SimplyRETS Real Estate IDX

  Affected

  up to 3.0.5

  What to do

  Affects up to 3.0.5. Update SimplyRETS Real Estate IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025GlobalPayments WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22767 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Global Payments GlobalPayments WooCommerce global-payments-woocommerce allows Reflected XSS.This issue affects GlobalPayments WooCommerce: from n/a through <= 1.13.2.

  Product

  GlobalPayments WooCommerce

  Affected

  up to 1.13.2

  What to do

  Affects up to 1.13.2. Update GlobalPayments WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025SUPER RESPONSIVE SLIDER: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22575 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendyourweb SUPER RESPONSIVE SLIDER super-slider allows Reflected XSS.This issue affects SUPER RESPONSIVE SLIDER: from n/a through <= 1.4.

  Product

  SUPER RESPONSIVE SLIDER

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update SUPER RESPONSIVE SLIDER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025ULTIMATE VIDEO GALLERY: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22566 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendyourweb ULTIMATE VIDEO GALLERY ultimate-gallery allows Reflected XSS.This issue affects ULTIMATE VIDEO GALLERY: from n/a through <= 1.4.

  Product

  ULTIMATE VIDEO GALLERY

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update ULTIMATE VIDEO GALLERY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Schedule: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22523 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in scheduler Schedule schedule allows Blind SQL Injection.This issue affects Schedule: from n/a through <= 1.0.0.

  Product

  Schedule

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Improve My City: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-22501 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Improve My City Improve My City improve-my-city allows Reflected XSS.This issue affects Improve My City: from n/a through <= 1.6.

  Product

  Improve My City

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Improve My City to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025WP Azure offload: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22360 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in promact WP Azure offload wp-azure-offload allows Reflected XSS.This issue affects WP Azure offload: from n/a through <= 2.0.

  Product

  WP Azure offload

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update WP Azure offload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Stencies: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22356 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stencies Stencies stencies allows Reflected XSS.This issue affects Stencies: from n/a through <= 0.58.

  Product

  Stencies

  Affected

  up to 0.58

  What to do

  Affects up to 0.58. Update Stencies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025PluginPass: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54291 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 PluginPass pluginpass-pro-plugintheme-licensing allows Manipulating Web Input to File System Calls.This issue affects PluginPass: from n/a through <= 0.9.10.

  Product

  PluginPass

  Affected

  up to 0.9.10

  What to do

  Affects up to 0.9.10. Update PluginPass to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Já-Já Pagamentos for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51624 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jajapagamentos Já-Já Pagamentos for WooCommerce wc-ja-ja-pagamentos-multicaixa-express allows Reflected XSS.This issue affects Já-Já Pagamentos for WooCommerce: from n/a through <= 1.3.0.

  Product

  Já-Já Pagamentos for WooCommerce

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Já-Já Pagamentos for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025WP Database Optimizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31473 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthewprice1178 WP Database Optimizer wp-database-optimizer allows Stored XSS.This issue affects WP Database Optimizer: from n/a through <= 1.2.1.3.

  Product

  WP Database Optimizer

  Affected

  up to 1.2.1.3

  What to do

  Affects up to 1.2.1.3. Update WP Database Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Flatty: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31472 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michele Marri Flatty flatty-flat-admin-theme allows Stored XSS.This issue affects Flatty: from n/a through <= 2.0.0.

  Product

  Flatty

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Flatty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Duplicate Page and Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31471 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Falcon Solutions Duplicate Page and Post duplicate-post-and-page allows Stored XSS.This issue affects Duplicate Page and Post: from n/a through <= 1.0.

  Product

  Duplicate Page and Post

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Duplicate Page and Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Page Takeover: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31470 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FancyThemes Page Takeover page-takeover allows Stored XSS.This issue affects Page Takeover: from n/a through <= 1.1.6.

  Product

  Page Takeover

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Page Takeover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 28, 2025Duplicate Page and Post: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31466 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Falcon Solutions Duplicate Page and Post duplicate-post-and-page allows Blind SQL Injection.This issue affects Duplicate Page and Post: from n/a through <= 1.0.

  Product

  Duplicate Page and Post

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Duplicate Page and Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.