Vulnerability database

8,931 results · page 93 of 179

• Mar 26, 2025Product Catalog: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30524 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in origincode Product Catalog displayproduct allows SQL Injection.This issue affects Product Catalog: from n/a through <= 1.0.4.

  Product

  Product Catalog

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Trust Payments Gateway for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28942 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Trust Payments Trust Payments Gateway for WooCommerce trust-payments-hosted-payment-pages-integration allows SQL Injection.This issue affects Trust Payments Gateway for WooCommerce: from n/a through <= 1.1.4.

  Product

  Trust Payments Gateway for WooCommerce

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Trust Payments Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025WP Google Calendar Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28939 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in EuroCizia WP Google Calendar Manager wp-gcalendar allows Blind SQL Injection.This issue affects WP Google Calendar Manager: from n/a through <= 2.1.

  Product

  WP Google Calendar Manager

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update WP Google Calendar Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Fancybox Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28935 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in puzich Fancybox Plus fancybox-plus allows Reflected XSS.This issue affects Fancybox Plus: from n/a through <= 1.0.1.

  Product

  Fancybox Plus

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Fancybox Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Simple Post Series: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28934 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chaozh Simple Post Series simple-post-series allows Reflected XSS.This issue affects Simple Post Series: from n/a through <= 2.4.4.

  Product

  Simple Post Series

  Affected

  up to 2.4.4

  What to do

  Affects up to 2.4.4. Update Simple Post Series to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Are you robot google recaptcha for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28928 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sureshdsk Are you robot google recaptcha for wordpress are-you-robot-recaptcha allows Reflected XSS.This issue affects Are you robot google recaptcha for wordpress: from n/a through <= 2.2.

  Product

  Are you robot google recaptcha for

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Are you robot google recaptcha for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025ZenphotoPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28924 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simbul ZenphotoPress zenphotopress allows Reflected XSS.This issue affects ZenphotoPress: from n/a through <= 1.8.

  Product

  ZenphotoPress

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update ZenphotoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025SpatialMatch IDX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28921 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in homejunction SpatialMatch IDX spatialmatch-free-lifestyle-search allows Reflected XSS.This issue affects SpatialMatch IDX: from n/a through <= 3.0.9.

  Product

  SpatialMatch IDX

  Affected

  up to 3.0.9

  What to do

  Affects up to 3.0.9. Update SpatialMatch IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Custom Smilies: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28917 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crazyloong Custom Smilies custom-smilies-se allows Stored XSS.This issue affects Custom Smilies: from n/a through <= 2.9.2.

  Product

  Custom Smilies

  Affected

  up to 2.9.2

  What to do

  Affects up to 2.9.2. Update Custom Smilies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Docpro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-28916 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rashid Docpro docpro allows PHP Local File Inclusion.This issue affects Docpro: from n/a through <= 2.0.1.

  Product

  Docpro

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Docpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Gravity 2 PDF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28911 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gravity2pdf Gravity 2 PDF gf2pdf allows Reflected XSS.This issue affects Gravity 2 PDF: from n/a through <= 3.1.3.

  Product

  Gravity 2 PDF

  Affected

  up to 3.1.3

  What to do

  Affects up to 3.1.3. Update Gravity 2 PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Driving Directions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28903 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hectorgarrofe Driving Directions ddirections allows Reflected XSS.This issue affects Driving Directions: from n/a through <= 1.4.4.

  Product

  Driving Directions

  Affected

  up to 1.4.4

  What to do

  Affects up to 1.4.4. Update Driving Directions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025WP Event Ticketing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28899 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in toddhuish WP Event Ticketing wpeventticketing allows Reflected XSS.This issue affects WP Event Ticketing: from n/a through <= 1.3.4.

  Product

  WP Event Ticketing

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update WP Event Ticketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025WP Multistore Locator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28898 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows SQL Injection.This issue affects WP Multistore Locator: from n/a through <= 2.5.2.

  Product

  WP Multistore Locator

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update WP Multistore Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Visual Text Editor: Improper Control of Generation of Code ('Code Injection')CVE-2025-28893 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Improper Control of Generation of Code ('Code Injection') vulnerability in Govind Visual Text Editor visual-text-editor allows Remote Code Inclusion.This issue affects Visual Text Editor: from n/a through <= 1.2.1.

  Product

  Visual Text Editor

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Visual Text Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Lightview Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28890 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in puzich Lightview Plus lightview-plus allows Reflected XSS.This issue affects Lightview Plus: from n/a through <= 3.1.3.

  Product

  Lightview Plus

  Affected

  up to 3.1.3

  What to do

  Affects up to 3.1.3. Update Lightview Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Custom Product Stickers for Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28889 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in starblank Custom Product Stickers for Woocommerce custom-product-stickers-for-woocommerce allows Reflected XSS.This issue affects Custom Product Stickers for Woocommerce: from n/a through <= 1.9.0.

  Product

  Custom Product Stickers for Woocommerce

  Affected

  up to 1.9.0

  What to do

  Affects up to 1.9.0. Update Custom Product Stickers for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Fiverr.com Official Search Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28885 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fiverraffiliates Fiverr.com Official Search Box fiverr-official-search-box allows Stored XSS.This issue affects Fiverr.com Official Search Box: from n/a through <= 1.0.8.

  Product

  Fiverr.com Official Search Box

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Fiverr.com Official Search Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Omnify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28882 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Omnify, Inc. Omnify omnify-widget allows Reflected XSS.This issue affects Omnify: from n/a through <= 2.0.3.

  Product

  Omnify

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update Omnify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Blue Captcha: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28880 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jotis Blue Captcha blue-captcha allows Reflected XSS.This issue affects Blue Captcha: from n/a through <= 1.7.4.

  Product

  Blue Captcha

  Affected

  up to 1.7.4

  What to do

  Affects up to 1.7.4. Update Blue Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Key4ce osTicket Bridge: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28877 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in m.tiggelaar Key4ce osTicket Bridge key4ce-osticket-bridge allows Reflected XSS.This issue affects Key4ce osTicket Bridge: from n/a through <= 1.4.0.

  Product

  Key4ce osTicket Bridge

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Key4ce osTicket Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Shuffle: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28873 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Scott Taylor Shuffle shuffle allows Blind SQL Injection.This issue affects Shuffle: from n/a through <= 0.5.

  Product

  Shuffle

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update Shuffle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025NextGEN Gallery Voting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28869 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shauno NextGEN Gallery Voting nextgen-gallery-voting allows Reflected XSS.This issue affects NextGEN Gallery Voting: from n/a through <= 2.7.6.

  Product

  NextGEN Gallery Voting

  Affected

  up to 2.7.6

  What to do

  Affects up to 2.7.6. Update NextGEN Gallery Voting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025WP Colorful Tag Cloud: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28865 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lionelroux WP Colorful Tag Cloud wp-colorful-tag-cloud allows Reflected XSS.This issue affects WP Colorful Tag Cloud: from n/a through <= 2.0.1.

  Product

  WP Colorful Tag Cloud

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update WP Colorful Tag Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Arrow Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28858 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arrow Plugins Arrow Maps ap-google-maps allows Reflected XSS.This issue affects Arrow Maps: from n/a through <= 1.0.9.

  Product

  Arrow Maps

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Arrow Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Teleport: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28855 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in srcoley Teleport teleport allows Reflected XSS.This issue affects Teleport: from n/a through <= 1.2.4.

  Product

  Teleport

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update Teleport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Random Quotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27267 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in srcoley Random Quotes random-quotes allows Reflected XSS.This issue affects Random Quotes: from n/a through <= 1.3.

  Product

  Random Quotes

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Hostiko: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-27015 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designingmedia Hostiko hostiko allows PHP Local File Inclusion.This issue affects Hostiko: from n/a through < 30.1.

  Product

  Hostiko

  What to do

  Update Hostiko to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Hostiko: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27014 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designingmedia Hostiko hostiko allows Reflected XSS.This issue affects Hostiko: from n/a through < 30.1.

  Product

  Hostiko

  What to do

  Update Hostiko to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Pearl - Corporate Business: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26986 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Pearl - Corporate Business pearl allows PHP Local File Inclusion.This issue affects Pearl - Corporate Business: from n/a through < 3.4.8.

  Product

  Pearl - Corporate Business

  What to do

  Update Pearl - Corporate Business to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Church Admin: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26941 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin allows SQL Injection.This issue affects Church Admin: from n/a through <= 5.0.18.

  Product

  Church Admin

  Affected

  up to 5.0.18

  What to do

  Affects up to 5.0.18. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Accounting for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26929 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Accounting for WooCommerce accounting-for-woocommerce allows Stored XSS.This issue affects Accounting for WooCommerce: from n/a through <= 1.6.8.

  Product

  Accounting for WooCommerce

  Affected

  up to 1.6.8

  What to do

  Affects up to 1.6.8. Update Accounting for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26923 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This issue affects Event post: from n/a through <= 5.9.8.

  Product

  Event post

  Affected

  up to 5.9.8

  What to do

  Affects up to 5.9.8. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025AuraMart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26922 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techthemes AuraMart auramart allows Stored XSS.This issue affects AuraMart: from n/a through <= 2.0.7.

  Product

  AuraMart

  Affected

  up to 2.0.7

  What to do

  Affects up to 2.0.7. Update AuraMart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Build: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26869 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Build allows Stored XSS.This issue affects Build: from n/a through 1.0.3.

  Product

  Build

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Build to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025RainbowNews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26747 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 99colorthemes RainbowNews allows Stored XSS.This issue affects RainbowNews: from n/a through 1.0.7.

  Product

  RainbowNews

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update RainbowNews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025newseqo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26739 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themefunction newseqo allows Stored XSS.This issue affects newseqo: from n/a through 2.1.1.

  Product

  newseqo

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update newseqo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025TBTestimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26584 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Travis Ballard TBTestimonials tb-testimonials allows Reflected XSS.This issue affects TBTestimonials: from n/a through <= 1.7.3.

  Product

  TBTestimonials

  Affected

  up to 1.7.3

  What to do

  Affects up to 1.7.3. Update TBTestimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Video Share VOD: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26583 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in videowhisper Video Share VOD video-share-vod allows Reflected XSS.This issue affects Video Share VOD: from n/a through <= 2.7.9.

  Product

  Video Share VOD

  Affected

  up to 2.7.9

  What to do

  Affects up to 2.7.9. Update Video Share VOD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Picture Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26581 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in videowhisper Picture Gallery picture-gallery allows Reflected XSS.This issue affects Picture Gallery: from n/a through <= 1.6.3.

  Product

  Picture Gallery

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update Picture Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025MicroPayments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26579 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in videowhisper MicroPayments paid-membership allows Reflected XSS.This issue affects MicroPayments: from n/a through <= 3.2.4.

  Product

  MicroPayments

  Affected

  up to 3.2.4

  What to do

  Affects up to 3.2.4. Update MicroPayments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025WP Simple Slideshow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26576 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in takumin WP Simple Slideshow wp-simple-slideshow allows Reflected XSS.This issue affects WP Simple Slideshow: from n/a through <= 1.0.

  Product

  WP Simple Slideshow

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP Simple Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Display Post Meta: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26575 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Maurer Display Post Meta display-post-meta allows Reflected XSS.This issue affects Display Post Meta: from n/a through <= 2.4.4.

  Product

  Display Post Meta

  Affected

  up to 2.4.4

  What to do

  Affects up to 2.4.4. Update Display Post Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Rizzi Guestbook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26573 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JamRizzi Technologies Rizzi Guestbook rizzi-guestbook allows Reflected XSS.This issue affects Rizzi Guestbook: from n/a through <= 4.0.1.

  Product

  Rizzi Guestbook

  Affected

  up to 4.0.1

  What to do

  Affects up to 4.0.1. Update Rizzi Guestbook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025In Stock Mailer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26566 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frank In Stock Mailer for WooCommerce in-stock-mailer-for-woocommerce allows Reflected XSS.This issue affects In Stock Mailer for WooCommerce: from n/a through <= 2.1.1.

  Product

  In Stock Mailer for WooCommerce

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update In Stock Mailer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025GNUPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26565 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kagla GNUPress gnupress allows Reflected XSS.This issue affects GNUPress: from n/a through <= 0.2.9.

  Product

  GNUPress

  Affected

  up to 0.2.9

  What to do

  Affects up to 0.2.9. Update GNUPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025GNUCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26564 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kagla GNUCommerce gnucommerce allows Reflected XSS.This issue affects GNUCommerce: from n/a through <= 1.5.4.

  Product

  GNUCommerce

  Affected

  up to 1.5.4

  What to do

  Affects up to 1.5.4. Update GNUCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025WP Contact Form III: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26560 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KKWangen WP Contact Form III wp-contact-form-iii allows Reflected XSS.This issue affects WP Contact Form III: from n/a through <= 1.6.2d.

  Product

  WP Contact Form III

  Affected

  up to 1.6.2d

  What to do

  Affects up to 1.6.2d. Update WP Contact Form III to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Secure Invites: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26559 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Taylor Secure Invites wordpress-mu-secure-invites allows Reflected XSS.This issue affects Secure Invites: from n/a through <= 1.3.

  Product

  Secure Invites

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Secure Invites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 26, 2025Cookies Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26546 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelpro Cookies Pro cookies-pro allows Reflected XSS.This issue affects Cookies Pro: from n/a through <= 1.0.

  Product

  Cookies Pro

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Cookies Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.