Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

546new WordPress flaws this week

391,964entries in the database

15,905 results · page 98 of 319

Aug 23, 2025Sertifier Certificate & Badge Maker for WordPress – Tutor LMS: Cross-Site Request ForgeryCVE-2025-7841 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Sertifier Certificate & Badge Maker for WordPress – Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.19. This is due to missing or incorrect nonce validation on the 'sertifier_settings' page. This makes it possible for unauthenticated attackers to update the plugin's api key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Sertifier Certificate & Badge Maker for WordPress – Tutor LMS
Affected
up to 1.19
What to do
Affects up to 1.19. Update Sertifier Certificate & Badge Maker for WordPress – Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 23, 2025Restore Permanently delete Post or Page Data: Cross-Site Request ForgeryCVE-2025-7839 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Restore Permanently delete Post or Page Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the rp_dpo_dpa_ajax_dp_delete_data() function. This makes it possible for unauthenticated attackers to delete data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Restore Permanently delete Post or Page Data
Affected
up to 1.0
What to do
Affects up to 1.0. Update Restore Permanently delete Post or Page Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 22, 2025JobWP: Cross-Site Request Forgery (CSRF)CVE-2025-57895 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2.4.3.
Product
JobWP
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 22, 2025WP Fast Total Search: Cross-Site Request Forgery (CSRF)CVE-2025-57893 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Cross Site Request Forgery.This issue affects WP Fast Total Search: from n/a through <= 1.79.270.
Product
WP Fast Total Search
Affected
up to 1.79.270
What to do
Affects up to 1.79.270. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 22, 2025Simple Statistics for Feeds: Cross-Site Request Forgery (CSRF)CVE-2025-57892 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Jeff Starr Simple Statistics for Feeds simple-feed-stats allows Cross Site Request Forgery.This issue affects Simple Statistics for Feeds: from n/a through <= 20250322.
Product
Simple Statistics for Feeds
Affected
up to 20250322
What to do
Affects up to 20250322. Update Simple Statistics for Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 22, 2025Recurring PayPal Donations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57891 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpecommerce Recurring PayPal Donations recurring-donation allows Stored XSS.This issue affects Recurring PayPal Donations: from n/a through <= 1.8.
Product
Recurring PayPal Donations
Affected
up to 1.8
What to do
Affects up to 1.8. Update Recurring PayPal Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 22, 2025Sessions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57890 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy Sessions sessions allows Stored XSS.This issue affects Sessions: from n/a through <= 3.2.0.
Product
Sessions
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Sessions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 22, 2025Jobmonster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57887 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Stored XSS.This issue affects Jobmonster: from n/a through <= 4.8.0.
Product
Jobmonster
Affected
up to 4.8.0
What to do
Affects up to 4.8.0. Update Jobmonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 22, 2025Fluent Support: Cross-Site Request Forgery (CSRF)CVE-2025-57885 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Cross Site Request Forgery.This issue affects Fluent Support: from n/a through <= 1.9.1.
Product
Fluent Support
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Fluent Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 21, 2025Bible SuperSearch: Stored Cross-Site ScriptingCVE-2025-8064 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bible SuperSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘selector_height’ parameter in all versions up to, and including, 6.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bible SuperSearch
Affected
up to 6.0.1
What to do
Affects up to 6.0.1. Update Bible SuperSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 21, 2025SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels): Stored Cross-Site ScriptingCVE-2025-8607 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown block's attributes in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels)
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 21, 2025Inspiro: Cross-Site Request ForgeryCVE-2025-8592 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Inspiro theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2. This is due to missing or incorrect nonce validation on the inspiro_install_plugin() function. This makes it possible for unauthenticated attackers to install plugins from the repository via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Inspiro
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Inspiro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.cleantalk.org themes.trac.wordpress.org
Aug 20, 2025Easy Digital Downloads: Cross-Site Request ForgeryCVE-2025-8102 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing nonce validations in the edd_sendwp_disconnect() and edd_sendwp_remote_install() functions. This makes it possible for unauthenticated attackers to deactivate or download and activate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Easy Digital Downloads
Affected
up to 3.5.0
What to do
Affects up to 3.5.0. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 20, 2025oik: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54670 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bobbingwide oik oik allows Reflected XSS.This issue affects oik: from n/a through <= 4.15.2.
Product
oik
Affected
up to 4.15.2
What to do
Affects up to 4.15.2. Update oik to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Responsive HTML5 Audio Player PRO With Playlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54056 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playlist lbg-audio2-html5 allows Reflected XSS.This issue affects Responsive HTML5 Audio Player PRO With Playlist: from n/a through <= 3.5.8.
Product
Responsive HTML5 Audio Player PRO With Playlist
Affected
up to 3.5.8
What to do
Affects up to 3.5.8. Update Responsive HTML5 Audio Player PRO With Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Druco: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54055 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Druco druco allows Reflected XSS.This issue affects Druco: from n/a through <= 1.5.2.
Product
Druco
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Druco to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Realtyna Organic IDX: Cross-Site Request Forgery (CSRF)CVE-2025-54052 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Cross-Site Request Forgery (CSRF) vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows PHP Local File Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through <= 5.0.0.
Product
Realtyna Organic IDX
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update Realtyna Organic IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Cost Calculator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54046 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows Stored XSS.This issue affects Cost Calculator: from n/a through <= 7.4.
Product
Cost Calculator
Affected
up to 7.4
What to do
Affects up to 7.4. Update Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Elite Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54044 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player elite-video-player allows Reflected XSS.This issue affects Elite Video Player: from n/a through <= 10.0.5.
Product
Elite Video Player
Affected
up to 10.0.5
What to do
Affects up to 10.0.5. Update Elite Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Real Estate Manager Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54032 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manager-pro allows Reflected XSS.This issue affects Real Estate Manager Pro: from n/a through <= 12.7.3.
Product
Real Estate Manager Pro
Affected
up to 12.7.3
What to do
Affects up to 12.7.3. Update Real Estate Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Support Board: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54027 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Schiocco Support Board supportboard allows Reflected XSS.This issue affects Support Board: from n/a through <= 3.8.0.
Product
Support Board
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Support Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025HTML5 Radio Player - WPBakery Page Builder Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53564 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon lbg_radio_player_addon_visual_composer allows Reflected XSS.This issue affects HTML5 Radio Player - WPBakery Page Builder Addon: from n/a through <= 2.5.
Product
HTML5 Radio Player - WPBakery Page Builder Addon
Affected
up to 2.5
What to do
Affects up to 2.5. Update HTML5 Radio Player - WPBakery Page Builder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Youtube Vimeo Video Player and Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53563 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Youtube Vimeo Video Player and Slider video_player_youtube_vimeo allows Reflected XSS.This issue affects Youtube Vimeo Video Player and Slider: from n/a through <= 3.8.
Product
Youtube Vimeo Video Player and Slider
Affected
up to 3.8
What to do
Affects up to 3.8. Update Youtube Vimeo Video Player and Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Universal Video Player - Addon for WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53562 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery Page Builder lbg_universal_video_player_addon_visual_composer allows Reflected XSS.This issue affects Universal Video Player - Addon for WPBakery Page Builder: from n/a through <= 3.2.1.
Product
Universal Video Player - Addon for WPBakery Page Builder
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Universal Video Player - Addon for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Universal Video Player - Addon for WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53559 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery Page Builder lbg-universal-video-player-addon-visual-composer allows Reflected XSS.This issue affects Universal Video Player - Addon for WPBakery Page Builder: from n/a through <= 3.2.1.
Product
Universal Video Player - Addon for WPBakery Page Builder
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Universal Video Player - Addon for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Raptive Ads: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53319 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raptive Raptive Ads adthrive-ads allows Reflected XSS.This issue affects Raptive Ads: from n/a through <= 3.8.0.
Product
Raptive Ads
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Raptive Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Comments Capcha Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53226 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalzoomstudio Comments Capcha Box comments-capcha-box allows Reflected XSS.This issue affects Comments Capcha Box: from n/a through <= 1.1.
Product
Comments Capcha Box
Affected
up to 1.1
What to do
Affects up to 1.1. Update Comments Capcha Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Revolution Video Player With Bottom Playlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53212 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Revolution Video Player With Bottom Playlist revolution-video-player allows Reflected XSS.This issue affects Revolution Video Player With Bottom Playlist: from n/a through <= 2.9.2.
Product
Revolution Video Player With Bottom Playlist
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update Revolution Video Player With Bottom Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Radio Player Shoutcast & Icecast: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53205 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Radio Player Shoutcast & Icecast lbg-audio4-html5-shoutcast allows Reflected XSS.This issue affects Radio Player Shoutcast & Icecast: from n/a through <= 4.4.7.
Product
Radio Player Shoutcast & Icecast
Affected
up to 4.4.7
What to do
Affects up to 4.4.7. Update Radio Player Shoutcast & Icecast to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Jobmonster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53201 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through <= 4.7.8.
Product
Jobmonster
Affected
up to 4.7.8
What to do
Affects up to 4.7.8. Update Jobmonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53195 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.0.
Product
JetEngine
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025WP Discord Post Plus – Supports Unlimited Channels: Cross-Site Request Forgery (CSRF)CVE-2025-49896 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in wptasker WP Discord Post Plus – Supports Unlimited Channels allows Cross Site Request Forgery. This issue affects WP Discord Post Plus – Supports Unlimited Channels: from n/a through 1.0.2.
Product
WP Discord Post Plus – Supports Unlimited Channels
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP Discord Post Plus – Supports Unlimited Channels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Nuss: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49893 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Nuss nuss allows Reflected XSS.This issue affects Nuss: from n/a through <= 1.3.3.
Product
Nuss
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Nuss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Cookie Warning: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49428 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dourou Cookie Warning allows Stored XSS. This issue affects Cookie Warning: from n/a through 1.3.
Product
Cookie Warning
Affected
up to 1.3
What to do
Affects up to 1.3. Update Cookie Warning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Support Ticket: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49424 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepassion Support Ticket support-ticket allows Reflected XSS.This issue affects Support Ticket: from n/a through <= 1.9.
Product
Support Ticket
Affected
up to 1.9
What to do
Affects up to 1.9. Update Support Ticket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Ultra Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49420 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Reflected XSS.This issue affects Ultra Portfolio: from n/a through <= 6.7.
Product
Ultra Portfolio
Affected
up to 6.7
What to do
Affects up to 6.7. Update Ultra Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Super Store Finder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49413 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Store Finder superstorefinder-wp allows Reflected XSS.This issue affects Super Store Finder: from n/a through <= 7.6.
Product
Super Store Finder
Affected
up to 7.6
What to do
Affects up to 7.6. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Page Transition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49412 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in numixtech Page Transition page-transition allows Stored XSS.This issue affects Page Transition: from n/a through <= 1.3.
Product
Page Transition
Affected
up to 1.3
What to do
Affects up to 1.3. Update Page Transition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025iFrame Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49411 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Sharma iFrame Block allows Stored XSS. This issue affects iFrame Block: from n/a through 0.1.1.
Product
iFrame Block
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update iFrame Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025TC Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49410 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC Testimonials allows Stored XSS. This issue affects TC Testimonials: from n/a through 1.1.1.
Product
TC Testimonials
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update TC Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025SensorPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49409 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brewlabs SensorPress allows Stored XSS. This issue affects SensorPress: from n/a through 1.0.
Product
SensorPress
Affected
up to 1.0
What to do
Affects up to 1.0. Update SensorPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49400 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) allows Stored XSS. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 8.2.
Product
WP Visitor Statistics (Real Time Traffic)
Affected
up to 8.2
What to do
Affects up to 8.2. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025NEX-Forms: Cross-Site Request Forgery (CSRF)CVE-2025-49399 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Cross Site Request Forgery.This issue affects NEX-Forms: from n/a through <= 9.1.3.
Product
NEX-Forms
Affected
up to 9.1.3
What to do
Affects up to 9.1.3. Update NEX-Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Colorbox Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49397 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Colorbox Lightbox wp-colorbox allows Stored XSS.This issue affects Colorbox Lightbox: from n/a through <= 1.1.5.
Product
Colorbox Lightbox
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Colorbox Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Themify Icons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49395 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Icons themify-icons allows Stored XSS.This issue affects Themify Icons: from n/a through <= 2.0.3.
Product
Themify Icons
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Themify Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Themify Audio Dock: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49392 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Audio Dock themify-audio-dock allows Stored XSS.This issue affects Themify Audio Dock: from n/a through <= 2.0.5.
Product
Themify Audio Dock
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Themify Audio Dock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Sign-up Sheets: Cross-Site Request Forgery (CSRF)CVE-2025-49391 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Cross Site Request Forgery.This issue affects Sign-up Sheets: from n/a through <= 2.3.3.
Product
Sign-up Sheets
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update Sign-up Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Notice Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49389 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Solutions Notice Bar notice-bar allows Stored XSS.This issue affects Notice Bar: from n/a through <= 3.1.3.
Product
Notice Bar
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Notice Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025JobZilla - Job Board: Cross-Site Request Forgery (CSRF)CVE-2025-49382 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in DexignZone JobZilla - Job Board WordPress Theme jobzilla allows Privilege Escalation.This issue affects JobZilla - Job Board WordPress Theme: from n/a through <= 2.0.
Product
JobZilla - Job Board
Affected
up to 2.0
What to do
Affects up to 2.0. Update JobZilla - Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025ads.txt Guru Connect: Cross-Site Request Forgery (CSRF)CVE-2025-49381 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in ads.txt Guru ads.txt Guru Connect adstxt-guru-connect allows Cross Site Request Forgery.This issue affects ads.txt Guru Connect: from n/a through <= 1.1.1.
Product
ads.txt Guru Connect
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update ads.txt Guru Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.