Wordfence Intelligence Weekly WordPress Vulnerability Report (December 16, 2024 to January 5, 2025)
📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest.
Special Note: This weeks Wordfence Intelligence Weekly WordPress Vulnerability Report is an extended edition to cover the last few weeks in December over the holidays and the first week in January.
Over the past three weeks, there were 427 vulnerabilities disclosed in 352 WordPress Plugins and 13 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 92 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 21,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- ALL In One Custom Login Page <= 7.1.1 – Missing Authorization to Authenticated (Subscriber+)Privilege Escalation
- MainWP Child <= 5.2 – Missing Authorization to Unauthenticated Privilege Escalation
- WAF-RULE-789 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-790 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-791 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-792 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 313 |
| Unpatched | 114 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 2 |
| Medium Severity | 342 |
| High Severity | 55 |
| Critical Severity | 28 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 216 |
| Missing Authorization | 51 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 35 |
| Cross-Site Request Forgery (CSRF) | 30 |
| Exposure of Sensitive Information to an Unauthorized Actor | 15 |
| Unrestricted Upload of File with Dangerous Type | 12 |
| Deserialization of Untrusted Data | 11 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 11 |
| Incorrect Privilege Assignment | 7 |
| Improper Control of Generation of Code ('Code Injection') | 6 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 6 |
| Server-Side Request Forgery (SSRF) | 6 |
| Authorization Bypass Through User-Controlled Key | 5 |
| External Control of File Name or Path | 2 |
| Authentication Bypass Using an Alternate Path or Channel | 1 |
| Generation of Predictable Numbers or Identifiers | 1 |
| Guessable CAPTCHA | 1 |
| Improper Access Control | 1 |
| Improper Authentication | 1 |
| Improper Authorization | 1 |
| Improper Encoding or Escaping of Output | 1 |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | 1 |
| Improper Neutralization of Special Elements Used in a Template Engine | 1 |
| Incorrect Authorization | 1 |
| Storage of File with Sensitive Data Under Web Root | 1 |
| Uncontrolled Resource Consumption | 1 |
| Use of Insufficiently Random Values | 1 |
| Weak Password Recovery Mechanism for Forgotten Password | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 38 | |
| 33 | |
| 30 | |
| 25 | |
| 21 | |
| 18 | |
| 12 | |
| 12 | |
| 11 | |
| 10 | |
| 10 | |
| 9 | |
| 9 | |
| 9 | |
| 8 | |
| 8 | |
| 7 | |
| 7 | |
| 7 | |
| 7 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 10CentMail | 10centmail-subscription-management-and-analytics |
| 12 Step Meeting List | 12-step-meeting-list |
| 5centsCDN – WordPress CDN Plugin | 5centscdn |
| Accept Authorize.NET Payments Using Contact Form 7 | accept-authorize-net-payments-using-contact-form-7 |
| Accessibility by AllAccessible | allaccessible |
| ACF City Selector | acf-city-selector |
| ACH Invoicing Plugin | ach-invoice-app |
| AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress | acymailing |
| Additional Fees For WooCommerce Checkout | woo-additional-fees-on-checkout-wordpress |
| Advanced Floating Content | advanced-floating-content |
| Advanced Form Integration — Connect Forms to 300+ Apps | advanced-form-integration |
| Advanced Google reCAPTCHA | advanced-google-recaptcha |
| AdWork Media EZ Content Locker | adwork-media-ez-content-locker |
| Affiliate Program Suite — SliceWP Affiliates | slicewp |
| Agency Toolkit | agency-toolkit |
| AHAthat Plugin | ahathat |
| Aklamator INfeed | aklamator-infeed |
| Allada T-shirt Designer for Woocommerce – Custom Product Designer for T-shirt personalization and design | allada-tshirt-designer-for-woocommerce |
| AMP for WP – Accelerated Mobile Pages | accelerated-mobile-pages |
| Analytics Cat – Google Analytics Made Easy | analytics-cat |
| Animated Counters | animated-counters |
| Animation Addons for Elementor – Elementor V4 Atomic Widgets, GSAP Animations & Templates | animation-addons-for-elementor |
| Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress | bookingpress-appointment-booking |
| Arconix Shortcodes | arconix-shortcodes |
| ARPrice - WordPress Pricing Table Plugin | arprice |
| Asgard Security Scanner | asgard |
| Ashe Extra | ashe-extra |
| Astra Widgets | astra-widgets |
| Auto iFrame | auto-iframe |
| Autocompleter | autocompleter |
| AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI | automatorwp |
| Avada (Fusion) Builder | fusion-builder |
| AyeCode Connect | ayecode-connect |
| Backlink Monitoring Manager | backlink-monitoring-manager |
| Backup Migration | backup-backup |
| Barcode Generator for WooCommerce – Show barcodes on products, orders, invoices and other pages | embedding-barcodes-into-product-pages-and-orders |
| Best WordPress Shortcode Plugin in 2025 – AIO Shortcodes | aio-shortcodes |
| Biagiotti Membership | biagiotti-membership |
| Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder | bit-form |
| Bitcoin Lightning Publisher for WordPress | bitcoin-lightning-publisher |
| Booking calendar, Appointment Booking System | booking-calendar |
| Broken Link Checker | Finder | broken-link-finder |
| BSK Forms Blacklist | bsk-gravityforms-blacklist |
| BU Section Editing | bu-section-editing |
| Button Block – Stylish buttons that get more clicks | button-block |
| BVD Easy Gallery Manager | bvd-easy-gallery-manager |
| Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More | calculated-fields-form |
| Category Post Shortcode | category-post-shortcode |
| Category Post Slider | category-post-slider |
| Category Posts Block | category-posts |
| Cf7Save Extension | cf7save-extension |
| Classic Addons – WPBakery Page Builder | classic-addons-wpbakery-page-builder-addons |
| CloudFlare(R) Cache Purge | cloudflare-cache-purge |
| CodeBard Help Desk | codebard-help-desk |
| Coins MarketCap | coins-marketcap |
| Collapsing Categories | collapsing-categories |
| Compact WP Audio Player | compact-wp-audio-player |
| Contact Form 7 Database – CFDB7 | advanced-cf7-database |
| Contact Form Master – by Edmon | contact-form-master |
| Content No Cache | Serve uncached partial content even when you add it to a page that is fully cached. | content-no-cache |
| Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe | contest-gallery |
| Contests by Rewards Fuel | contests-from-rewards-fuel |
| ConvertCalculator: Build Cost, Price, Quotation, ROI Interactive Calculators | convertcalculator |
| Coupon Plugin Lite | coupon-lite |
| Course Migration for LearnDash | course-migration-for-learndash |
| CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout | support-x |
| Custom Dashboard Widget | create-custom-dashboard-widget |
| Custom Product tabs for WooCommerce | wb-custom-product-tabs-for-woocommerce |
| Data Dash | data-dash |
| Data Tables Generator by Supsystic | data-tables-generator-by-supsystic |
| Database Backup and Table Integrity Check with Automated Scheduling | database-backup |
| DirectoryPress – Business Directory And Classified Ad Listing | directorypress |
| Distance Based Shipping Calculator | distance-based-shipping-calculator |
| Download Manager | download-manager |
| DTX – Dynamic Text Extension for Contact Form 7 | contact-form-7-dynamic-text-extension |
| Dynamic Product Category Grid, Slider for WooCommerce | dynamic-product-categories-design |
| Dynamics 365 Integration | integration-dynamics |
| DynamicTags | dynamictags |
| Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | easy-digital-downloads |
| Easy Language Switcher | easy-language-switcher |
| Easy Waveform Player | easy-waveform-player |
| Ebook Store | ebook-store |
| eCommerce Product Catalog | ecommerce-product-catalog |
| EditionGuard for WooCommerce – eBook Sales with DRM | editionguard-for-woocommerce-ebook-sales-with-drm |
| Edwiser Bridge – WordPress Moodle Integration | edwiser-bridge |
| Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | bdthemes-element-pack-lite |
| Elementor Website Builder – more than just a page builder | elementor |
| ElementsCSS Addons for Elementor (Elementor Widgets Extender & Addons) | css-for-elementor |
| ElementsReady Addons for Elementor | element-ready-lite |
| Elevio | elevio |
| ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) | elex-bulk-edit-products-prices-attributes-for-woocommerce-basic |
| ELEX WooCommerce Dynamic Pricing and Discounts | elex-woocommerce-dynamic-pricing-and-discounts |
| Email Reminders | email-reminders |
| Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | email-subscribers |
| Embed PDF Viewer | embed-pdf-viewer |
| Embed Twine | embed-twine |
| EMC2 Alert Boxes | emc2-alert-boxes |
| Enter Addons – Ultimate Template Builder for Elementor | enteraddons |
| Envato Elements – Photos & Elementor Templates | envato-elements |
| EO4WP: EmailOctopus for WordPress | fw-integration-for-emailoctopus |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| Event Espresso – Event Registration & Ticketing Sales | event-espresso-decaf |
| Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce | wp-event-solution |
| EventPrime – Events Calendar, Bookings, Tickets & AI | eventprime-event-calendar-management |
| Events Addon for Elementor | events-addon-for-elementor |
| Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export | wp-ultimate-exporter |
| Export Customers Data | export-customers-data |
| Fancy Product Designer | fancy-product-designer |
| FAQs | faqs |
| Feedify – Web Push Notifications | push-notification-by-feedify |
| File Manager Pro – Filester | filester |
| Financial Calculator | finance-calculator-with-application-form |
| Floating Action Buttons | floating-action-buttons |
| Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | form-maker |
| Free Google Maps | wp-map |
| Frontend Admin by DynamiApps | acf-frontend-form-element |
| Full Screen Menu for Elementor | full-screen-menu-for-elementor |
| FV Descriptions | fv-descriptions |
| G Web Pro Store Locator | gwebpro-store-locator |
| Gallery Images Ape | gallery-images-ape |
| gap-hub-user-role. | gap-hub-user-role |
| GD Mail Queue | gd-mail-queue |
| GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | geodirectory |
| Goodlayers Core | goodlayers-core |
| Groundhogg — CRM, Newsletters, and Marketing Automation | groundhogg |
| GS Coach – Professional Team Showcase for Coaches & Consultants | gs-coach |
| GS Shots for Dribbble | gs-dribbble-portfolio |
| Gulri Slider | gulri-slider |
| Hero Mega Menu - Responsive WordPress Menu Plugin | hmenu |
| Hestia Nginx Cache | hestia-nginx-cache |
| Hide Category by User Role for WooCommerce | hide-category-by-user-role-for-woocommerce |
| Hide Login+ | hide-login |
| Highlight Sitewide Notice, Text, Button Menu | highlight |
| HT Event – WordPress Event Manager Plugin for Elementor | ht-event |
| HTML Forms – Simple WordPress Forms Plugin | html-forms |
| Icegram Engage – Popups, Optins, CTAs & Lead Generation | icegram |
| IdeaPush | ideapush |
| Image Hover Effects for Elementor | image-hover-effects-elementor-addon |
| Image Mapper | image-mapper |
| Inline Footnotes | inline-footnotes |
| Instantio — Side Cart & One-Page Checkout for WooCommerce | instantio |
| Insya Magic — AI Content Generator for ChatGPT, Claude and Gemini | newsletter-page-redirects |
| Interactive UK Map | interactive-uk-map |
| JobBoard Job listing plugin | job-board-light |
| JSP Store Locator | jsp-store-locator |
| Just Writing Statistics | just-writing-statistics |
| Kikx Simple Post Author Filter | sa-post-author-filter |
| KinTPV WooConnect | kintpv-connect |
| kk Star Ratings – Rate Post & Collect User Feedbacks | kk-star-ratings |
| Landing Page Cat – Coming Soon & Maintenance Pages | landing-page-cat |
| LaTeX2HTML | latex2html |
| Leads CRM for WordPress WooCommerce | leads-crm |
| Ledenbeheer | ledenbeheer-external-connection |
| Lemonade Social Networks Autoposter Pinterest | lemonade-sna-pinterest-edition |
| LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes | lifterlms |
| List category posts | list-category-posts |
| LiteSpeed Cache | litespeed-cache |
| Loan Comparison | loan-comparison |
| Locatoraid Store Locator | locatoraid |
| Login Page Styler – Custom WordPress Login Page Customizer & Security | login-page-styler |
| Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid | magazine-blocks |
| MagicPost – WordPress文章管理功能增强插件 | magicpost |
| Maintenance & Coming Soon Redirect Animation | maintenance-coming-soon-redirect-animation |
| Mang Board | mangboard |
| MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution | marketking-multivendor-marketplace-for-woocommerce |
| MashShare – Social Media Share Buttons, Social Share Icons | mashsharer |
| Media Category Library | media-category-library |
| Media Library Assistant | media-library-assistant |
| Member Directory and Contact Form | pta-member-directory |
| Memberful – Membership Plugin | memberful-wp |
| MG Parallax Slider | mg-parallax-slider |
| Move Addons for Elementor | move-addons |
| MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | mp3-music-player-by-sonaar |
| Multi-column Tag Map | multi-column-tag-map |
| Multiple Shipping And Billing Address For WooCommerce | different-shipping-and-billing-address-for-woocommerce |
| Music Store – WordPress eCommerce | music-store |
| NACC WordPress Plugin | nacc-wordpress-plugin |
| NAVER Analytics | naver-analytics |
| Newsletters | newsletters-lite |
| NEX-Forms – Ultimate Forms Plugin for WordPress | nex-forms-express-wp-form-builder |
| Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder | the-plus-addons-for-block-editor |
| Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder | ninja-forms |
| Notify Odoo | notify-odoo |
| odPhotogalleryPlugin | od-photogallery-plugin |
| One Click Upsell Funnel for Woocommerce | woo-one-click-upsell-funnel |
| One to one user Chat by WPGuppy | wpguppy-lite |
| Opencart Product in WP | opencart-product-in-wp |
| Opentracker Analytics | opentracker-analytics |
| Optio Dentistry | optio-dentistry |
| Order Audit Log for WooCommerce | order-audit-log-for-woocommerce |
| Outdooractive Embed | outdooractive-embed |
| OZ Canonical | oz-canonical |
| Page and Post Restriction | page-and-post-restriction |
| Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | paid-member-subscriptions |
| Panorama – WordPress Project Management Plugin | project-panorama-lite |
| Particle Background | particle-background |
| Partners | partners |
| PCRecruiter Extensions | pcrecruiter-extensions |
| Peter’s Custom Anti-Spam | peters-custom-anti-spam-image |
| Philantro – Donations and Donor Management | philantro |
| Photo Gallery Slideshow & Masonry Tiled Gallery | wp-responsive-photo-gallery |
| picu – Online Photo Proofing Gallery | picu |
| Pingmeter Uptime Monitoring | pingmeter-uptime-monitoring |
| Piotnet Addons For Elementor | piotnet-addons-for-elementor |
| PKT1 Centro de envios | pkt1-centro-de-envios |
| PlugVersions – Easily roll back to previous versions of your plugins. | plugversions |
| Pods – Custom Content Types and Fields | pods |
| Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls | poll-maker |
| Portfolio – Filterable Masonry Portfolio Gallery for Professionals | portfolio-pro |
| Post Grid Addon for Elementor | post-grid-elementor-addon |
| Post Timeline | post-timeline |
| Post/Page Import Export – Migrate Content with Custom Fields & Taxonomies | postpage-import-export-with-custom-fields-taxonomies |
| PostLists | postlists |
| PowerPack Lite for Beaver Builder | powerpack-addon-for-beaver-builder |
| PPWP – Password Protect Pages | password-protect-page |
| Preloader by WordPress Monsters | preloader-sws |
| Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates | premium-addons-for-elementor |
| Premium Blocks – Gutenberg Blocks, Patterns & Templates | premium-blocks-for-gutenberg |
| Pretty Simple Popup Builder | pretty-simple-popup-builder |
| Print Invoice & Delivery Notes for WooCommerce | woocommerce-delivery-notes |
| Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages | wplegalpages |
| Private Messages for UserPro | userpro-messaging |
| ProductDyno | productdyno |
| Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker | wedevs-project-manager |
| Project Showcase – Responsive Portfolio, Case Studies & Filterable Grid Layouts | gs-projects |
| Pronamic Google Maps | pronamic-google-maps |
| Property Hive | propertyhive |
| Reactflow Visitor Recording and Heatmaps | reactflow-session-replay-heatmap |
| real.Kit | real-kit |
| reCaptcha by BestWebSoft | google-captcha |
| RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress | computer-repair-shop |
| Responsive Blocks – Page Builder for Blocks & Patterns | responsive-block-editor-addons |
| Robo Gallery – Photo & Image Slider | robo-gallery |
| Royal Addons for Elementor – Addons and Templates Kit for Elementor | royal-elementor-addons |
| s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions | s2member |
| S3Player – WooCommerce & Elementor Integration | drm-protected-video-streaming |
| SaasPricing – Advanced Pricing & Comparison Tables for Elementor | saaspricing |
| Saoshyant Element | saoshyant-element |
| ScanCircle | scancircle |
| Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more | scratch-win-giveaways-for-website-facebook |
| SearchIQ – The Search Solution | searchiq |
| SendSMS | sendsms |
| Seraphinite Accelerator | seraphinite-accelerator |
| Seraphinite Accelerator (Full, premium) | seraphinite-accelerator-ext |
| Services updates for customers | service-updates-for-customers |
| Shipment Tracker for Woocommerce | shipment-tracker-for-woocommerce |
| Shipping for Nova Poshta | nova-poshta-ttn |
| ShMapper by Teplitsa | shmapper-by-teplitsa |
| ShopElement – Elementor Addons for WooCommerce Product Grid, Carousel & Category Widgets | shopelement |
| Shortcodes and extra features for Phlox theme | auxin-elements |
| Sikshya LMS – LMS Course Builder, Online Courses & eLearning | sikshya |
| Simple Dashboard | simple-dashboard |
| Simple Page Access Restriction | simple-page-access-restriction |
| Simple Proxy | simple-proxy |
| Simple Shopping Cart | wordpress-simple-paypal-shopping-cart |
| Simplified Plugin | simplified |
| Sinking Dropdowns WordPress | sinking-dropdowns |
| Slope Widgets | slope-widgets |
| Smart Shopify Product | smart-shopify-product |
| SMS for WooCommerce | wc-sms |
| SMSA Shipping (official) | smsa-shipping-official |
| Spoki – Chat Buttons and WooCommerce Notifications | spoki |
| Spotlightr – Secure Video Hosting for WordPress, Courses & LearnDash | spotlightr |
| Sprout Invoices – Client Invoicing & Estimates | sprout-invoices |
| SSL Wireless SMS Notification | ssl-wireless-sms-notification |
| Standard Box Sizes – for WooCommerce | standard-box-sizes |
| Stop Registration Spam | stop-registration-spam |
| Store Locator for WordPress with Google Maps – LotsOfLocales | store-locator |
| Super Backup & Clone - Migrate for WordPress | indeed-wp-superbackup |
| SvegliaT Buttons | svegliat-buttons |
| SyncFields | syncfields |
| SysBasics Customize My Account for WooCommerce – Live My Account Customizer | customize-my-account-for-woocommerce |
| Tabs Shortcode | tabs-shortcode |
| Taeggie Feed | taeggie-feed |
| Target Notifications | target-notifications |
| Taskbuilder – Project Management & Task Management Tool With Kanban Board | taskbuilder |
| Text Prompter – Unlimited chatgpt text prompts for openai tasks | ai-content |
| Themify Audio Dock | themify-audio-dock |
| Themify Builder | themify-builder |
| TicketSource Ticket Shop | ticketsource-events |
| Tidy Up | tidy-up |
| Top Comments | top-comments |
| Tour Master - Tour Booking, Travel, Hotel | tourmaster |
| Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental | tourfic |
| TPG Get Posts | tpg-get-posts |
| Tracking Code Manager | tracking-code-manager |
| TS Comfort DB | ts-comfort-database |
| Turnkey bbPress by WeaverTheme | weaver-for-bbpress |
| Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder | header-footer-elementor |
| Ultimate Learning Pro | indeed-learning-pro |
| Ultimate Store Kit – Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder | ultimate-store-kit |
| UpdraftPlus: WP Backup & Migration Plugin | updraftplus |
| Upload Scanner | upload-scanner |
| User Referral ( Free ) – Points, Rewards, Loyalty, Leader Board & Referrals Plugin | user-referral-free |
| User Role Editor | user-role-editor |
| UserPro - Community and User Profile WordPress Plugin | userpro |
| VibeBP | vibebp |
| Video Share VOD – Turnkey Video Site Builder Script | video-share-vod |
| VRPConnector | vrpconnector |
| Wayne Audio Player | wayne-audio-player |
| WC Price History | wc-price-history |
| Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets | widget-options |
| Wishlist for WooCommerce: Multiple Wishlists per Customer | wish-list-for-woocommerce |
| Wizhi Multi Filters by Wenprise | wizhi-multi-filters |
| WOLF – WordPress Posts Bulk Editor and Manager Professional | bulk-editor |
| WooCommerce - PDF Vouchers | woocommerce-pdf-vouchers |
| WooCommerce Point of Sale | woo-point-of-sale |
| WordPress Auction Plugin | wp-auctions |
| Wp advertising management | advertising-management |
| WP All Import Pro | wp-all-import-pro |
| WP BASE Booking of Appointments, Services and Events | wp-base-booking-of-appointments-services-and-events |
| WP Compress – Instant Performance & Speed Optimization | wp-compress-image-optimizer |
| WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards | wp-data-access |
| WP Datepicker | wp-datepicker |
| WP Docs | wp-docs |
| WP eCommerce Quickpay | wp-ecommerce-quickpay |
| WP Job Portal – AI-Powered Recruitment System for Company or Job Board website | wp-job-portal |
| WP jQuery DataTable | wp-jquery-datatable |
| WP Mailster | wp-mailster |
| WP Menu Image | wp-menu-image |
| WP Multistore Locator — WP Store Locator Plugin: Effortless Integration With Snazzy Maps | wp-multi-store-locator |
| WP Nice Loader | wp-nice-loader |
| WP on AWS | wp-migrate-2-aws |
| WP Popular Posts | wordpress-popular-posts |
| WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars | wp-post-author |
| WP SecureSubmit | securesubmit |
| WP SHAPES | wp-shapes |
| WP Simple Sitemap | wp-simple-sitemap |
| WP Smart Import : Import any XML File to WordPress | wp-smart-import |
| WP Social AutoConnect | wp-fb-autoconnect |
| WP Telegram Chat Widget | ninjateam-telegram |
| WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor | wte-elementor-widgets |
| WP-Appbox | wp-appbox |
| WP-tagMaker | tagmaker |
| WP24 Domain Check | wp24-domain-check |
| WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden | wp2leads |
| WPAchievements Free | wpachievements-free |
| WPBITS Addons For Elementor Page Builder | wpbits-addons-for-elementor |
| WPC Shop as a Customer for WooCommerce | wpc-shop-as-customer |
| WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | wpforms-lite |
| WPKoi Templates for Elementor | wpkoi-templates-for-elementor |
| WPLMS Plugin | wplms_plugin |
| WPMasterToolKit (WPMTK) – All in one plugin | wpmastertoolkit |
| WPMozo Addons Lite for Elementor | wpmozo-addons-lite-for-elementor |
| wpSOL | wpsol |
| WPSSO Core – Complete Schema Markup and Meta Tags | wpsso |
| WPvivid — Backup, Migration & Staging | wpvivid-backuprestore |
| Wtyczka SeoPilot dla WP | wtyczka-seopilot-dla-wp |
| Zintory – Inventory Manager | z-inventory-manager |
| استخراج محصولات ووکامرس برای آیسی | isee-products-extractor |
| 우커머스 포트원 플러그인 (국내 모든 PG를 한 번에) | iamport-for-woocommerce |
| 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 | pgall-for-woocommerce |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| AdForest | adforest |
| Barter | barter |
| Digi Store | digi-store |
| Education LMS | education-lms |
| Kalium 3 | Creative WordPress & WooCommerce Theme | kalium |
| KLEO - Community Focused & Multi-Purpose BuddyPress WordPress Theme | kleo |
| NewsDaily | newsdaily |
| Olivia | olivia |
| SimpleCharm | simplecharm |
| Store Commerce | store-commerce |
| Travel Booking WordPress Theme | traveler |
| VW Automobile Lite | vw-automobile-lite |
| WPLMS Learning Management System for WordPress, WordPress LMS | wplms |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Dynamics 365 Integration [integration-dynamics]
Researcher
Affected Software
ACH Invoicing Plugin [ach-invoice-app]
Researcher
Affected Software
Insya Magic — AI Content Generator for ChatGPT, Claude and Gemini [newsletter-page-redirects]
Researcher
Affected Software
ARPrice - WordPress Pricing Table Plugin [arprice]
Researcher
Biagiotti Membership <= 1.0.2 - Authentication Bypass via biagiotti_membership_check_facebook_user
9.8
Affected Software
Biagiotti Membership [biagiotti-membership]
Researcher
Computer Repair Shop <= 3.8119 - Authenticated (Customer+) Privilege Esclation via Account Takeover
9.8
Affected Software
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress [computer-repair-shop]
Researcher
Affected Software
Fancy Product Designer [fancy-product-designer]
Researcher
Affected Software
JobBoard Job listing plugin [job-board-light]
Researcher
Affected Software
Locatoraid Store Locator [locatoraid]
Researcher
Affected Software
Partners [partners]
Researcher
Affected Software
Zintory – Inventory Manager [z-inventory-manager]
Researcher
Affected Software
Private Messages for UserPro [userpro-messaging]
Researcher
Affected Software
Simple Dashboard [simple-dashboard]
Researcher
Affected Software
Simplified Plugin [simplified]
Researcher
Affected Software
SSL Wireless SMS Notification [ssl-wireless-sms-notification]
Researcher
Affected Software
Store Locator for WordPress with Google Maps – LotsOfLocales [store-locator]
Researcher
Affected Software
Researcher
Affected Software
VibeBP [vibebp]
Researcher
Affected Software
VRPConnector [vrpconnector]
Researcher
Affected Software
WooCommerce Point of Sale [woo-point-of-sale]
Researcher
Affected Software
Super Backup & Clone - Migrate for WordPress [indeed-wp-superbackup]
Researcher
Affected Software
One to one user Chat by WPGuppy [wpguppy-lite]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Accessibility by AllAccessible [allaccessible]
Researcher
Affected Software
Login Page Styler – Custom WordPress Login Page Customizer & Security [login-page-styler]
Researcher
Affected Software
ARPrice - WordPress Pricing Table Plugin [arprice]
Researcher
Backup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'
8.8
Affected Software
Backup Migration [backup-backup]
Researcher
Affected Software
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress [computer-repair-shop]
Researcher
Affected Software
Dynamic Product Category Grid, Slider for WooCommerce [dynamic-product-categories-design]
Researcher
Affected Software
eCommerce Product Catalog [ecommerce-product-catalog]
Researcher
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Sinking Dropdowns WordPress [sinking-dropdowns]
Researcher
Affected Software
SMSA Shipping (official) [smsa-shipping-official]
Researcher
Affected Software
Themify Builder [themify-builder]
Researcher
UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection
8.8
Affected Software
UpdraftPlus: WP Backup & Migration Plugin [updraftplus]
Researcher
Affected Software
User Role Editor [user-role-editor]
Researcher
Affected Software
Wayne Audio Player [wayne-audio-player]
Researcher
Affected Software
Super Backup & Clone - Migrate for WordPress [indeed-wp-superbackup]
Researcher
Affected Software
Researcher
Affected Software
One to one user Chat by WPGuppy [wpguppy-lite]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WPMozo Addons Lite for Elementor [wpmozo-addons-lite-for-elementor]
Researcher
Affected Software
워드프레스 결제 심플페이 – 우커머스 결제 플러그인 [pgall-for-woocommerce]
Researcher
Affected Software
Interactive UK Map [interactive-uk-map]
Researcher
Affected Software
Researcher
Affected Software
WPC Shop as a Customer for WooCommerce [wpc-shop-as-customer]
Researcher
Affected Software
WP All Import Pro [wp-all-import-pro]
Researcher
Affected Software
ARPrice - WordPress Pricing Table Plugin [arprice]
Researcher
Affected Software
Collapsing Categories [collapsing-categories]
Researcher
Affected Software
Fancy Product Designer [fancy-product-designer]
Researcher
Affected Software
Multiple Shipping And Billing Address For WooCommerce [different-shipping-and-billing-address-for-woocommerce]
Researcher
Affected Software
Shipping for Nova Poshta [nova-poshta-ttn]
Researcher
Affected Software
SSL Wireless SMS Notification [ssl-wireless-sms-notification]
Researcher
Affected Software
Travel Booking WordPress Theme [traveler]
Researcher
Affected Software
VibeBP [vibebp]
Researcher
WP Data Access – App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injection
7.5
Affected Software
Researcher
Affected Software
Super Backup & Clone - Migrate for WordPress [indeed-wp-superbackup]
Researcher
Affected Software
WPLMS Plugin [wplms_plugin]
Researcher
Affected Software
Download Manager [download-manager]
Researcher
Affected Software
kk Star Ratings – Rate Post & Collect User Feedbacks [kk-star-ratings]
Researcher
Affected Software
WP Popular Posts [wordpress-popular-posts]
Researcher
Affected Software
ACF City Selector [acf-city-selector]
Researcher
Affected Software
Best WordPress Shortcode Plugin in 2025 – AIO Shortcodes [aio-shortcodes]
Researcher
Affected Software
Classic Addons – WPBakery Page Builder [classic-addons-wpbakery-page-builder-addons]
Researcher
Custom Product Tabs For WooCommerce <= 1.2.4 - Authenticated (Shop Manager+) PHP Object Injection
7.2
Affected Software
Custom Product tabs for WooCommerce [wb-custom-product-tabs-for-woocommerce]
Researcher
Affected Software
EventPrime – Events Calendar, Bookings, Tickets & AI [eventprime-event-calendar-management]
Researcher
Affected Software
KinTPV WooConnect [kintpv-connect]
Researcher
Affected Software
Tour Master - Tour Booking, Travel, Hotel [tourmaster]
Researcher
Affected Software
WPMasterToolKit (WPMTK) – All in one plugin [wpmastertoolkit]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Advanced Floating Content [advanced-floating-content]
Researcher
Affected Software
AHAthat Plugin [ahathat]
Researcher
Affected Software
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress [bookingpress-appointment-booking]
Researcher
Affected Software
ARPrice - WordPress Pricing Table Plugin [arprice]
Researcher
Affected Software
Barcode Generator for WooCommerce – Show barcodes on products, orders, invoices and other pages [embedding-barcodes-into-product-pages-and-orders]
Researcher
Affected Software
Booking calendar, Appointment Booking System [booking-calendar]
Researcher
Affected Software
DynamicTags [dynamictags]
Researcher
Affected Software
ELEX WooCommerce Dynamic Pricing and Discounts [elex-woocommerce-dynamic-pricing-and-discounts]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
JSP Store Locator [jsp-store-locator]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Travel Booking WordPress Theme [traveler]
Researcher
Affected Software
Researcher
Affected Software
VibeBP [vibebp]
Researcher
Affected Software
WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events]
Researcher
Affected Software
WP Docs [wp-docs]
Researcher
Affected Software
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker [wedevs-project-manager]
Researcher
Affected Software
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker [wedevs-project-manager]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Animated Counters [animated-counters]
Researcher
Affected Software
Arconix Shortcodes [arconix-shortcodes]
Researcher
Affected Software
Astra Widgets [astra-widgets]
Researcher
Affected Software
Auto iFrame [auto-iframe]
Researcher
Affected Software
Barter [barter]
Researcher
Affected Software
Category Post Shortcode [category-post-shortcode]
Researcher
Affected Software
Category Post Slider [category-post-slider]
Researcher
Affected Software
Coins MarketCap [coins-marketcap]
Researcher
Affected Software
Compact WP Audio Player [compact-wp-audio-player]
Researcher
Affected Software
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]
Researcher
Affected Software
Contests by Rewards Fuel [contests-from-rewards-fuel]
Researcher
ConvertCalculator for WordPress <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
ConvertCalculator: Build Cost, Price, Quotation, ROI Interactive Calculators [convertcalculator]
Researcher
Affected Software
Coupon Plugin Lite [coupon-lite]
Researcher
Course Migration for LearnDash <= 1.0.2 - Authenticated (Subscriber+) Server-Side Request Forgery
6.4
Affected Software
Course Migration for LearnDash [course-migration-for-learndash]
Researcher
Affected Software
Researcher
Affected Software
Digi Store [digi-store]
Researcher
Affected Software
Easy Waveform Player [easy-waveform-player]
Researcher
Affected Software
Education LMS [education-lms]
Researcher
Affected Software
Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder [header-footer-elementor]
Researcher
Affected Software
Researcher
Affected Software
ElementsCSS Addons for Elementor (Elementor Widgets Extender & Addons) [css-for-elementor]
Researcher
Affected Software
Embed Twine [embed-twine]
Researcher
Affected Software
EMC2 Alert Boxes [emc2-alert-boxes]
Researcher
Affected Software
Enter Addons – Ultimate Template Builder for Elementor [enteraddons]
Researcher
Affected Software
Envato Elements – Photos & Elementor Templates [envato-elements]
Researcher
Affected Software
EO4WP: EmailOctopus for WordPress [fw-integration-for-emailoctopus]
Researcher
Essential Addons for Elementor <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Financial Calculator [finance-calculator-with-application-form]
Researcher
Affected Software
Researcher
Affected Software
Goodlayers Core [goodlayers-core]
Researcher
Affected Software
Researcher
Affected Software
GS Shots for Dribbble [gs-dribbble-portfolio]
Researcher
Affected Software
Researcher
Affected Software
Image Hover Effects for Elementor [image-hover-effects-elementor-addon]
Researcher
Affected Software
Inline Footnotes [inline-footnotes]
Researcher
Affected Software
Ledenbeheer [ledenbeheer-external-connection]
Researcher
Affected Software
List category posts [list-category-posts]
Researcher
Affected Software
LiteSpeed Cache [litespeed-cache]
Researcher
Affected Software
Loan Comparison [loan-comparison]
Researcher
Affected Software
Researcher
Affected Software
MagicPost – WordPress文章管理功能增强插件 [magicpost]
Researcher
Affected Software
Move Addons for Elementor [move-addons]
Researcher
Affected Software
Multi-column Tag Map [multi-column-tag-map]
Researcher
Affected Software
NACC WordPress Plugin [nacc-wordpress-plugin]
Researcher
Affected Software
NewsDaily [newsdaily]
Researcher
Affected Software
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder [the-plus-addons-for-block-editor]
Researcher
Affected Software
WP Telegram Chat Widget [ninjateam-telegram]
Researcher
Affected Software
One Click Upsell Funnel for Woocommerce [woo-one-click-upsell-funnel]
Researcher
Affected Software
Optio Dentistry [optio-dentistry]
Researcher
Affected Software
Outdooractive Embed [outdooractive-embed]
Researcher
Affected Software
Particle Background [particle-background]
Researcher
Affected Software
PCRecruiter Extensions [pcrecruiter-extensions]
Researcher
Affected Software
Philantro – Donations and Donor Management [philantro]
Researcher
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Piotnet Addons For Elementor <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Piotnet Addons For Elementor [piotnet-addons-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Post Grid Addon for Elementor [post-grid-elementor-addon]
Researcher
Affected Software
Premium Blocks – Gutenberg Blocks, Patterns & Templates [premium-blocks-for-gutenberg]
Researcher
Affected Software
Researcher
Affected Software
Pronamic Google Maps [pronamic-google-maps]
Researcher
Affected Software
Responsive Blocks – Page Builder for Blocks & Patterns [responsive-block-editor-addons]
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
Researcher
Affected Software
ScanCircle [scancircle]
Researcher
Affected Software
TicketSource Ticket Shop [ticketsource-events]
Researcher
Affected Software
ShMapper by Teplitsa [shmapper-by-teplitsa]
Researcher
Affected Software
Researcher
Affected Software
Shortcodes and extra features for Phlox theme [auxin-elements]
Researcher
Affected Software
Shortcodes and extra features for Phlox theme [auxin-elements]
Researcher
Affected Software
Slope Widgets [slope-widgets]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Store Commerce [store-commerce]
Researcher
Affected Software
SvegliaT Buttons [svegliat-buttons]
Researcher
Affected Software
Tabs Shortcode [tabs-shortcode]
Researcher
Affected Software
Taeggie Feed [taeggie-feed]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Themify Audio Dock [themify-audio-dock]
Researcher
Affected Software
TPG Get Posts [tpg-get-posts]
Researcher
Affected Software
Tracking Code Manager [tracking-code-manager]
Researcher
Affected Software
Video Share VOD – Turnkey Video Site Builder Script [video-share-vod]
Researcher
WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Simple Shopping Cart [wordpress-simple-paypal-shopping-cart]
Researcher
Affected Software
WP jQuery DataTable [wp-jquery-datatable]
Researcher
Affected Software
WP Multistore Locator — WP Store Locator Plugin: Effortless Integration With Snazzy Maps [wp-multi-store-locator]
Researcher
Affected Software
WP SHAPES [wp-shapes]
Researcher
Affected Software
WPAchievements Free [wpachievements-free]
Researcher
Affected Software
WPBITS Addons For Elementor Page Builder [wpbits-addons-for-elementor]
Researcher
WPKoi Templates for Elementor <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
WPKoi Templates for Elementor [wpkoi-templates-for-elementor]
Researcher
WPMozo Addons Lite for Elementor <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
WPMozo Addons Lite for Elementor [wpmozo-addons-lite-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
10CentMail [10centmail-subscription-management-and-analytics]
Researcher
Affected Software
5centsCDN – WordPress CDN Plugin [5centscdn]
Researcher
Affected Software
Researcher
Affected Software
AdWork Media EZ Content Locker [adwork-media-ez-content-locker]
Researcher
Affected Software
Researcher
Affected Software
Aklamator INfeed [aklamator-infeed]
Researcher
Affected Software
AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages]
Researcher
Affected Software
Analytics Cat – Google Analytics Made Easy [analytics-cat]
Researcher
Affected Software
Arconix Shortcodes [arconix-shortcodes]
Researcher
Affected Software
ARPrice - WordPress Pricing Table Plugin [arprice]
Researcher
Affected Software
Asgard Security Scanner [asgard]
Researcher
Affected Software
Autocompleter [autocompleter]
Researcher
Affected Software
Backlink Monitoring Manager [backlink-monitoring-manager]
Researcher
Affected Software
Bitcoin Lightning Publisher for WordPress [bitcoin-lightning-publisher]
Researcher
Affected Software
BU Section Editing [bu-section-editing]
Researcher
Affected Software
BU Section Editing [bu-section-editing]
Researcher
Affected Software
BVD Easy Gallery Manager [bvd-easy-gallery-manager]
Researcher
Affected Software
Cf7Save Extension [cf7save-extension]
Researcher
Affected Software
CloudFlare(R) Cache Purge [cloudflare-cache-purge]
Researcher
Affected Software
Contact Form Master – by Edmon [contact-form-master]
Researcher
Affected Software
Custom Dashboard Widget [create-custom-dashboard-widget]
Researcher
Affected Software
Distance Based Shipping Calculator [distance-based-shipping-calculator]
Researcher
Affected Software
Easy Language Switcher [easy-language-switcher]
Researcher
Affected Software
Ebook Store [ebook-store]
Researcher
Affected Software
Ebook Store [ebook-store]
Researcher
Affected Software
Edwiser Bridge – WordPress Moodle Integration [edwiser-bridge]
Researcher
Affected Software
Export Customers Data [export-customers-data]
Researcher
Affected Software
Feedify – Web Push Notifications [push-notification-by-feedify]
Researcher
Affected Software
FV Descriptions [fv-descriptions]
Researcher
Affected Software
G Web Pro Store Locator [gwebpro-store-locator]
Researcher
Affected Software
Gallery Images Ape [gallery-images-ape]
Researcher
Affected Software
GD Mail Queue [gd-mail-queue]
Researcher
Affected Software
Researcher
Affected Software
Gulri Slider [gulri-slider]
Researcher
Affected Software
Researcher
Affected Software
Hide Login+ [hide-login]
Researcher
Affected Software
Researcher
Affected Software
HTML Forms – Simple WordPress Forms Plugin [html-forms]
Researcher
Affected Software
Image Mapper [image-mapper]
Researcher
Affected Software
استخراج محصولات ووکامرس برای آیسی [isee-products-extractor]
Researcher
Affected Software
Researcher
Affected Software
Kikx Simple Post Author Filter [sa-post-author-filter]
Researcher
Affected Software
Researcher
Affected Software
Landing Page Cat – Coming Soon & Maintenance Pages [landing-page-cat]
Researcher
Affected Software
LaTeX2HTML [latex2html]
Researcher
Affected Software
Leads CRM for WordPress WooCommerce [leads-crm]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Lemonade Social Networks Autoposter Pinterest [lemonade-sna-pinterest-edition]
Researcher
Affected Software
Mang Board [mangboard]
Researcher
Affected Software
Media Category Library [media-category-library]
Researcher
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Affected Software
MG Parallax Slider [mg-parallax-slider]
Researcher
Affected Software
Music Store – WordPress eCommerce [music-store]
Researcher
Affected Software
NAVER Analytics [naver-analytics]
Researcher
Affected Software
Newsletters [newsletters-lite]
Researcher
Affected Software
Notify Odoo [notify-odoo]
Researcher
Affected Software
odPhotogalleryPlugin [od-photogallery-plugin]
Researcher
Affected Software
Olivia [olivia]
Researcher
Affected Software
Opencart Product in WP [opencart-product-in-wp]
Researcher
Affected Software
Opentracker Analytics [opentracker-analytics]
Researcher
Affected Software
Order Audit Log for WooCommerce [order-audit-log-for-woocommerce]
Researcher
Affected Software
OZ Canonical [oz-canonical]
Researcher
Affected Software
Pingmeter Uptime Monitoring [pingmeter-uptime-monitoring]
Researcher
Affected Software
PKT1 Centro de envios [pkt1-centro-de-envios]
Researcher
Affected Software
우커머스 포트원 플러그인 (국내 모든 PG를 한 번에) [iamport-for-woocommerce]
Researcher
Affected Software
Post Timeline [post-timeline]
Researcher
Affected Software
PostLists [postlists]
Researcher
PowerPack Lite for Beaver Builder <= 1.3.0.5 - Reflected Cross-Site Scripting via Navigate Parameter
6.1
Affected Software
PowerPack Lite for Beaver Builder [powerpack-addon-for-beaver-builder]
Researcher
Affected Software
Preloader by WordPress Monsters [preloader-sws]
Researcher
Affected Software
Private Messages for UserPro [userpro-messaging]
Researcher
Affected Software
ProductDyno [productdyno]
Researcher
Affected Software
Property Hive [propertyhive]
Researcher
Affected Software
Reactflow Visitor Recording and Heatmaps [reactflow-session-replay-heatmap]
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
S3Player – WooCommerce & Elementor Integration [drm-protected-video-streaming]
Researcher
Affected Software
Saoshyant Element [saoshyant-element]
Researcher
Affected Software
SendSMS [sendsms]
Researcher
Affected Software
Services updates for customers [service-updates-for-customers]
Researcher
Affected Software
Shipment Tracker for Woocommerce [shipment-tracker-for-woocommerce]
Researcher
Affected Software
Simple Proxy [simple-proxy]
Researcher
Affected Software
SimpleCharm [simplecharm]
Researcher
Affected Software
SMS for WooCommerce [wc-sms]
Researcher
Affected Software
Stop Registration Spam [stop-registration-spam]
Researcher
Affected Software
SyncFields [syncfields]
Researcher
Affected Software
SysBasics Customize My Account for WooCommerce – Live My Account Customizer [customize-my-account-for-woocommerce]
Researcher
Affected Software
Target Notifications [target-notifications]
Researcher
Affected Software
TS Comfort DB [ts-comfort-database]
Researcher
Affected Software
Turnkey bbPress by WeaverTheme [weaver-for-bbpress]
Researcher
Affected Software
Upload Scanner [upload-scanner]
Researcher
Affected Software
User Referral ( Free ) – Points, Rewards, Loyalty, Leader Board & Referrals Plugin [user-referral-free]
Researcher
Affected Software
Researcher
Wishlist for WooCommerce: Multi Wishlists Per Customer <= 3.1.2 - Reflected Cross-Site Scripting
6.1
Affected Software
Wishlist for WooCommerce: Multiple Wishlists per Customer [wish-list-for-woocommerce]
Researcher
Wizhi Multi Filters by Wenprise <= 1.8.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
Affected Software
Wizhi Multi Filters by Wenprise [wizhi-multi-filters]
Researcher
Affected Software
Additional Fees For WooCommerce Checkout [woo-additional-fees-on-checkout-wordpress]
Researcher
Affected Software
WooCommerce - PDF Vouchers [woocommerce-pdf-vouchers]
Researcher
Affected Software
Wp advertising management [advertising-management]
Researcher
Affected Software
WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events]
Researcher
Affected Software
WP Compress – Instant Performance & Speed Optimization [wp-compress-image-optimizer]
Researcher
Affected Software
WP Datepicker [wp-datepicker]
Researcher
Affected Software
WP eCommerce Quickpay [wp-ecommerce-quickpay]
Researcher
Affected Software
WP Mailster [wp-mailster]
Researcher
Affected Software
WP Simple Sitemap [wp-simple-sitemap]
Researcher
Affected Software
WP Smart Import : Import any XML File to WordPress [wp-smart-import]
Researcher
Affected Software
WP Social AutoConnect [wp-fb-autoconnect]
Researcher
Affected Software
Super Backup & Clone - Migrate for WordPress [indeed-wp-superbackup]
Researcher
Affected Software
WP-tagMaker [tagmaker]
Researcher
Affected Software
WP24 Domain Check [wp24-domain-check]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Wtyczka SeoPilot dla WP [wtyczka-seopilot-dla-wp]
Researcher
Affected Software
Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Affected Software
WordPress Auction Plugin [wp-auctions]
Researcher
Broken Link Checker | Finder <= 2.5.0 - Authenticated (Author+) Blind Server-Side Request Forgery
5.4
Affected Software
Broken Link Checker | Finder [broken-link-finder]
Researcher
Affected Software
DirectoryPress – Business Directory And Classified Ad Listing [directorypress]
Researcher
Affected Software
Free Google Maps [wp-map]
Researcher
Affected Software
Peter’s Custom Anti-Spam [peters-custom-anti-spam-image]
Researcher
Affected Software
Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more [scratch-win-giveaways-for-website-facebook]
Researcher
Affected Software
WC Price History [wc-price-history]
Researcher
Affected Software
WP Nice Loader [wp-nice-loader]
Researcher
Accept Authorize.NET Payments Using Contact Form 7 <= 2.2 - Unauthenticated Information Exposure
5.3
Affected Software
Accept Authorize.NET Payments Using Contact Form 7 [accept-authorize-net-payments-using-contact-form-7]
Researcher
Affected Software
Advanced Google reCAPTCHA [advanced-google-recaptcha]
Researcher
Affected Software
Allada T-shirt Designer for Woocommerce – Custom Product Designer for T-shirt personalization and design [allada-tshirt-designer-for-woocommerce]
Researcher
Affected Software
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress [bookingpress-appointment-booking]
Researcher
Affected Software
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More [calculated-fields-form]
Researcher
Affected Software
Researcher
Affected Software
Download Manager [download-manager]
Researcher
Affected Software
Floating Action Buttons [floating-action-buttons]
Researcher
Affected Software
Hestia Nginx Cache [hestia-nginx-cache]
Researcher
Affected Software
IdeaPush [ideapush]
Researcher
Affected Software
Researcher
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.0.00 - Missing Authorization
5.3
Affected Software
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]
Researcher
Memberful <= 1.73.9 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
5.3
Affected Software
Memberful – Membership Plugin [memberful-wp]
Researcher
Affected Software
Page and Post Restriction [page-and-post-restriction]
Researcher
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]
Researcher
Affected Software
Researcher
Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.5.4 - Unauthenticated HTML Injection
5.3
Affected Software
Researcher
Affected Software
Post/Page Import Export – Migrate Content with Custom Fields & Taxonomies [postpage-import-export-with-custom-fields-taxonomies]
Researcher
Affected Software
PPWP – Password Protect Pages [password-protect-page]
Researcher
Affected Software
reCaptcha by BestWebSoft [google-captcha]
Researcher
Affected Software
Simple Page Access Restriction [simple-page-access-restriction]
Researcher
Affected Software
Standard Box Sizes – for WooCommerce [standard-box-sizes]
Researcher
Affected Software
WP Menu Image [wp-menu-image]
Researcher
Affected Software
WP SecureSubmit [securesubmit]
Researcher
Affected Software
Researcher
Affected Software
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore]
Researcher
Client Invoicing by Sprout Invoices – Easy Estimates and Invoices <= 20.8.1 - Missing Authorization
5.0
Affected Software
Sprout Invoices – Client Invoicing & Estimates [sprout-invoices]
Researcher
Affected Software
Contact Form 7 Database – CFDB7 [advanced-cf7-database]
Researcher
Affected Software
Database Backup and Table Integrity Check with Automated Scheduling [database-backup]
Researcher
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Affected Software
ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) [elex-bulk-edit-products-prices-attributes-for-woocommerce-basic]
Researcher
Affected Software
Researcher
Affected Software
Just Writing Statistics [just-writing-statistics]
Researcher
Affected Software
NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]
Researcher
Affected Software
Ultimate Learning Pro [indeed-learning-pro]
Researcher
Affected Software
WordPress Auction Plugin [wp-auctions]
Researcher
Affected Software
WordPress Auction Plugin [wp-auctions]
Researcher
Affected Software
Researcher
Affected Software
WPMasterToolKit (WPMTK) – All in one plugin [wpmastertoolkit]
Researcher
Advanced Form Integration <= 1.95.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
Affected Software
Advanced Form Integration — Connect Forms to 300+ Apps [advanced-form-integration]
Researcher
Affected Software
Aklamator INfeed [aklamator-infeed]
Researcher
Affected Software
Category Posts Block [category-posts]
Researcher
Affected Software
Email Reminders [email-reminders]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Embed PDF Viewer [embed-pdf-viewer]
Researcher
Affected Software
Researcher
Affected Software
Highlight Sitewide Notice, Text, Button Menu [highlight]
Researcher
Affected Software
Panorama – WordPress Project Management Plugin [project-panorama-lite]
Researcher
Pods – Custom Content Types and Fields <= 3.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
Affected Software
Researcher
Pretty Simple Popup Builder <= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
Affected Software
Pretty Simple Popup Builder [pretty-simple-popup-builder]
Researcher
Affected Software
Top Comments [top-comments]
Researchers
Affected Software
Animation Addons for Elementor – Elementor V4 Atomic Widgets, GSAP Animations & Templates [animation-addons-for-elementor]
Researcher
Affected Software
Ashe Extra [ashe-extra]
Researcher
Affected Software
Avada (Fusion) Builder [fusion-builder]
Researcher
Affected Software
AyeCode Connect [ayecode-connect]
Researcher
Affected Software
BSK Forms Blacklist [bsk-gravityforms-blacklist]
Researcher
Affected Software
Button Block – Stylish buttons that get more clicks [button-block]
Researcher
Affected Software
CodeBard Help Desk [codebard-help-desk]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Data Tables Generator by Supsystic [data-tables-generator-by-supsystic]
Researcher
Affected Software
Download Manager [download-manager]
Researcher
Affected Software
EditionGuard for WooCommerce – eBook Sales with DRM [editionguard-for-woocommerce-ebook-sales-with-drm]
Researcher
Affected Software
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]
Researchers
Affected Software
ElementsReady Addons for Elementor [element-ready-lite]
Researcher
Affected Software
Event Espresso – Event Registration & Ticketing Sales [event-espresso-decaf]
Researcher
Affected Software
Events Addon for Elementor [events-addon-for-elementor]
Researcher
Affected Software
File Manager Pro – Filester [filester]
Researcher
Affected Software
Full Screen Menu for Elementor [full-screen-menu-for-elementor]
Researcher
Affected Software
gap-hub-user-role. [gap-hub-user-role]
Researcher
Affected Software
Hide Category by User Role for WooCommerce [hide-category-by-user-role-for-woocommerce]
Researcher
Affected Software
JSP Store Locator [jsp-store-locator]
Researcher
Affected Software
Researcher
Maintenance & Coming Soon Redirect Animation <= 2.1.3 - Missing Authorization to Settings Update
4.3
Affected Software
Maintenance & Coming Soon Redirect Animation [maintenance-coming-soon-redirect-animation]
Researcher
Affected Software
Member Directory and Contact Form [pta-member-directory]
Researcher
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]
Researcher
Affected Software
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder [the-plus-addons-for-block-editor]
Researcher
Affected Software
Photo Gallery Slideshow & Masonry Tiled Gallery [wp-responsive-photo-gallery]
Researcher
Affected Software
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates [premium-addons-for-elementor]
Researcher
Affected Software
Print Invoice & Delivery Notes for WooCommerce [woocommerce-delivery-notes]
Researcher
Affected Software
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
SearchIQ – The Search Solution [searchiq]
Researcher
Seraphinite Accelerator <= 2.22.15 (2.21.13 PRO) - Authenticated (Subscriber+) Information Exposure
4.3
Affected Software
Seraphinite Accelerator (Full, premium) [seraphinite-accelerator-ext]
Seraphinite Accelerator [seraphinite-accelerator]
Researcher
Affected Software
Smart Shopify Product [smart-shopify-product]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
VW Automobile Lite [vw-automobile-lite]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WP SecureSubmit [securesubmit]
Researcher
Affected Software
Super Backup & Clone - Migrate for WordPress [indeed-wp-superbackup]
Researcher
Affected Software
Researcher
Affected Software
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export [wp-ultimate-exporter]
Researcher
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Affected Software
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments