Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

34added in the last 30 days

563new WordPress flaws this week

392,577entries in the database

12,192 results · page 96 of 244

May 23, 2025Smart Forms – when you need more than just a contact form: Stored Cross-Site ScriptingCVE-2025-5055 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.98 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Smart Forms – when you need more than just a contact form
Affected
up to 2.6.98
What to do
Affects up to 2.6.98. Update Smart Forms – when you need more than just a contact form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 23, 2025Page Builder: Pagelayer – Drag and Drop website builder: Stored Cross-Site ScriptingCVE-2024-13427 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 1.9.9 and completely fixed in version 2.0.1.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 2.0.0
Fixed in
1.9.9
What to do
Update Page Builder: Pagelayer – Drag and Drop website builder to 1.9.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 23, 2025ReDi Restaurant Reservation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48286 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catkin ReDi Restaurant Reservation redi-restaurant-reservation allows Reflected XSS.This issue affects ReDi Restaurant Reservation: from n/a through <= 24.1209.
Product
ReDi Restaurant Reservation
Affected
up to 24.1209
What to do
Affects up to 24.1209. Update ReDi Restaurant Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Quick Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48245 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal Quick Contact Form quick-contact-form allows Reflected XSS.This issue affects Quick Contact Form: from n/a through <= 8.2.1.
Product
Quick Contact Form
Affected
up to 8.2.1
What to do
Affects up to 8.2.1. Update Quick Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Verge3D: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48241 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D verge3d allows Reflected XSS.This issue affects Verge3D: from n/a through <= 4.9.3.
Product
Verge3D
Affected
up to 4.9.3
What to do
Affects up to 4.9.3. Update Verge3D to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025xili-tidy-tags: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47680 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-tidy-tags xili-tidy-tags allows Reflected XSS.This issue affects xili-tidy-tags: from n/a through <= 1.12.06.
Product
xili-tidy-tags
Affected
up to 1.12.06
What to do
Affects up to 1.12.06. Update xili-tidy-tags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025FunnelCockpit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47678 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelCockpit FunnelCockpit funnelcockpit allows Reflected XSS.This issue affects FunnelCockpit: from n/a through <= 1.4.3.
Product
FunnelCockpit
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update FunnelCockpit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Arconix Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47673 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Reflected XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.16.
Product
Arconix Shortcodes
Affected
up to 2.1.16
What to do
Affects up to 2.1.16. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025BMI Adult & Kid Calculator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47618 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mortgage Calculator BMI Adult & Kid Calculator bmi-adultkid-calculator allows Reflected XSS.This issue affects BMI Adult & Kid Calculator: from n/a through <= 1.2.2.
Product
BMI Adult & Kid Calculator
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update BMI Adult & Kid Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025School Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47613 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla School Management allows Reflected XSS. This issue affects School Management: from n/a through 92.0.0.
Product
School Management
Affected
up to 92.0.0
What to do
Affects up to 92.0.0. Update School Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025User Meta: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47611 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Khaled User Meta user-meta allows Reflected XSS.This issue affects User Meta: from n/a through <= 3.1.2.
Product
User Meta
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update User Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025B2i Investor Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47458 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in B2itech B2i Investor Tools b2i-investor-tools allows Reflected XSS.This issue affects B2i Investor Tools: from n/a through <= 1.0.7.9.
Product
B2i Investor Tools
Affected
up to 1.0.7.9
What to do
Affects up to 1.0.7.9. Update B2i Investor Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Section Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46537 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ctltwp Section Widget section-widget allows Reflected XSS.This issue affects Section Widget: from n/a through <= 3.3.1.
Product
Section Widget
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Section Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025My Custom Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46526 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in janekniefeldt My Custom Widgets mycustomwidget allows Reflected XSS.This issue affects My Custom Widgets: from n/a through <= 2.0.5.
Product
My Custom Widgets
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update My Custom Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025IGIT Related Posts With Thumb Image After Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46518 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phpaddicted IGIT Related Posts With Thumb Image After Posts igit-related-posts-with-thumb-images-after-posts allows Stored XSS.This issue affects IGIT Related Posts With Thumb Image After Posts: from n/a through <= 4.5.3.
Product
IGIT Related Posts With Thumb Image After Posts
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update IGIT Related Posts With Thumb Image After Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Category Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46515 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Category Widget category-widget allows Reflected XSS.This issue affects Category Widget: from n/a through <= 2.0.2.
Product
Category Widget
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Category Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Crossword Compiler Puzzles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46493 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordwebsoftware Crossword Compiler Puzzles crossword-compiler-puzzles allows Stored XSS.This issue affects Crossword Compiler Puzzles: from n/a through <= 14.5.
Product
Crossword Compiler Puzzles
Affected
up to 14.5
What to do
Affects up to 14.5. Update Crossword Compiler Puzzles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025EC Authorize.net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46487 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sftranna EC Authorize.net ec-authorizenet allows Reflected XSS.This issue affects EC Authorize.net: from n/a through <= 0.3.3.
Product
EC Authorize.net
Affected
up to 0.3.3
What to do
Affects up to 0.3.3. Update EC Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Theme Blvd Sliders: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46456 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Theme Blvd Sliders theme-blvd-sliders allows Reflected XSS.This issue affects Theme Blvd Sliders: from n/a through <= 1.2.5.
Product
Theme Blvd Sliders
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Theme Blvd Sliders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Meta Keywords & Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-46454 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in svil4ok Meta Keywords & Description wp-meta-keywords-meta-description allows PHP Local File Inclusion.This issue affects Meta Keywords & Description: from n/a through <= 0.8.
Product
Meta Keywords & Description
Affected
up to 0.8
What to do
Affects up to 0.8. Update Meta Keywords & Description to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Document Management System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46448 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reifsnyderb Document Management System dms allows Reflected XSS.This issue affects Document Management System: from n/a through <= 1.24.
Product
Document Management System
Affected
up to 1.24
What to do
Affects up to 1.24. Update Document Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Libro de Reclamaciones: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46446 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ivanrojas Libro de Reclamaciones libro-de-reclamaciones allows Stored XSS.This issue affects Libro de Reclamaciones: from n/a through <= 1.0.1.
Product
Libro de Reclamaciones
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Libro de Reclamaciones to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025kStats Reloaded: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46440 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark kStats Reloaded kstats-reloaded allows Reflected XSS.This issue affects kStats Reloaded: from n/a through <= 0.7.4.
Product
kStats Reloaded
Affected
up to 0.7.4
What to do
Affects up to 0.7.4. Update kStats Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Tayori Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46437 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tayoricom Tayori Form tayori allows Reflected XSS.This issue affects Tayori Form: from n/a through <= 1.2.9.
Product
Tayori Form
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Tayori Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Goodlayers Hotel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39505 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Reflected XSS.This issue affects Goodlayers Hotel: from n/a through <= 3.1.4.
Product
Goodlayers Hotel
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update Goodlayers Hotel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Goodlayers Hostel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39502 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Reflected XSS.This issue affects Goodlayers Hostel: from n/a through <= 3.1.2.
Product
Goodlayers Hostel
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Goodlayers Hostel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Butcher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32285 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ApusTheme Butcher butcher allows Reflected XSS.This issue affects Butcher: from n/a through < 2.54.
Product
Butcher
What to do
Update Butcher to the newest version.
Full record and what to do →NVD record patchstack.com
May 23, 2025WP Post Modules for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31636 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SaurabhSharma WP Post Modules for Elementor wp-post-modules-el allows Reflected XSS.This issue affects WP Post Modules for Elementor: from n/a through <= 2.5.0.
Product
WP Post Modules for Elementor
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update WP Post Modules for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Solid Mail – SMTP email and logging made by SolidWP: Stored Cross-Site ScriptingCVE-2025-1123 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Solid Mail – SMTP email and logging made by SolidWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email Name, Subject, and Body in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Solid Mail – SMTP email and logging made by SolidWP
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Solid Mail – SMTP email and logging made by SolidWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 23, 2025TablePress: DOM-Based Stored Cross-Site ScriptingCVE-2025-5096 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TablePress plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the 'data-caption', 'data-s-content-padding', 'data-s-title', and 'data-footer' data-attributes in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TablePress
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update TablePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record datatables.net github.com
May 23, 2025Tournamatch: Stored Cross-Site ScriptingCVE-2025-4594 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registration-button' shortcode in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Tournamatch
Affected
up to 4.6.1
What to do
Affects up to 4.6.1. Update Tournamatch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2025Hot Random Image: Stored Cross-Site ScriptingCVE-2025-4405 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Hot Random Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Hot Random Image
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update Hot Random Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2025MapSVG: Stored Cross-Site ScriptingCVE-2024-9544 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 8.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
MapSVG
Affected
up to 8.6.4
What to do
Affects up to 8.6.4. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record simplepx.com wordfence.com
May 22, 2025WooCommerce: PostMessage-Based Cross-Site ScriptingCVE-2025-5062 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions up to, and including, 9.4.2 due to insufficient input sanitization and output escaping on PostMessage data. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WooCommerce
Affected
up to 9.4.2
What to do
Affects up to 9.4.2. Update WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.woocommerce.com github.com
May 21, 2025Slim SEO – Fast & Automated WordPress SEO: Stored Cross-Site ScriptingCVE-2025-4611 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slim SEO – Fast & Automated WordPress SEO Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slim_seo_breadcrumbs shortcode in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slim SEO – Fast & Automated WordPress SEO
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update Slim SEO – Fast & Automated WordPress SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 21, 2025Animated Buttons: Stored Cross-Site ScriptingCVE-2025-4221 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Animated Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-downloader' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Animated Buttons
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Animated Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 21, 2025DPEPress: Stored Cross-Site ScriptingCVE-2025-4219 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DPEPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dpe' shortcode in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
DPEPress
Affected
up to 0.3
What to do
Affects up to 0.3. Update DPEPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 21, 2025WP YouTube Video Optimizer: Stored Cross-Site ScriptingCVE-2025-4217 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP YouTube Video Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ib_youtube' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP YouTube Video Optimizer
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP YouTube Video Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 21, 2025Raisely Donation Form: Stored Cross-Site ScriptingCVE-2025-3781 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's raisely_donation_form shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Raisely Donation Form
Affected
up to 1.1
What to do
Affects up to 1.1. Update Raisely Donation Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 21, 2025Network Posts Extended: Stored Cross-Site ScriptingCVE-2025-3750 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Network Posts Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_height’ parameter in all versions up to, and including, 7.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Network Posts Extended
Affected
up to 7.7.1
What to do
Affects up to 7.7.1. Update Network Posts Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 20, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in varioCVE-2024-5878 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2025Hospital Management System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39393 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla Hospital Management System hospital-management allows Reflected XSS.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-2023).
Product
Hospital Management System
Affected
up to 47.0
What to do
Affects up to 47.0. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WPAMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39392 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPAMS apartment-management allows Reflected XSS.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
Product
WPAMS
Affected
up to 44.0
What to do
Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WordPress Events Calendar Registration & Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39372 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Reflected XSS.This issue affects WordPress Events Calendar Registration & Tickets: from n/a through <= 2.6.0.
Product
WordPress Events Calendar Registration & Tickets
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update WordPress Events Calendar Registration & Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025wProject: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39365 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rocket Apps wProject allows Reflected XSS.This issue affects wProject: from n/a before 5.8.0.
Product
wProject
Fixed in
5.8.0
What to do
Update wProject to 5.8.0 or newer.
Full record and what to do →NVD record patchstack.com
May 19, 2025Tiger: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31027 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jocoxdesign Tiger tiger allows Reflected XSS.This issue affects Tiger: from n/a through 2.0.
Product
Tiger
Affected
up to 2.0
What to do
Affects up to 2.0. Update Tiger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025BP Messages Tool: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43839 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Messages Tool bp-messages-tool allows Reflected XSS.This issue affects BP Messages Tool: from n/a through <= 2.2.
Product
BP Messages Tool
Affected
up to 2.2
What to do
Affects up to 2.2. Update BP Messages Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Total Donations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43837 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in binti76 Total Donations total-donations allows Reflected XSS.This issue affects Total Donations: from n/a through <= 3.0.8.
Product
Total Donations
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Total Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Syndicate Out: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43836 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in confuzzledduck Syndicate Out syndicate-out allows Reflected XSS.This issue affects Syndicate Out: from n/a through <= 0.9.
Product
Syndicate Out
Affected
up to 0.9
What to do
Affects up to 0.9. Update Syndicate Out to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Remote Images Grabber: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43832 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andreyk Remote Images Grabber remote-images-grabber allows Reflected XSS.This issue affects Remote Images Grabber: from n/a through <= 0.6.
Product
Remote Images Grabber
Affected
up to 0.6
What to do
Affects up to 0.6. Update Remote Images Grabber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.