Wordfence Intelligence Weekly WordPress Vulnerability Report (February 10, 2025 to February 16 2025)
📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest.
Last week, there were 183 vulnerabilities disclosed in 146 WordPress Plugins and 8 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 58 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 22,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WAF-RULE-807 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-808 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-809 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-810 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 128 |
| Unpatched | 55 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 136 |
| High Severity | 34 |
| Critical Severity | 13 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 70 |
| Cross-Site Request Forgery (CSRF) | 29 |
| Missing Authorization | 27 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 14 |
| Exposure of Sensitive Information to an Unauthorized Actor | 5 |
| Unrestricted Upload of File with Dangerous Type | 5 |
| Improper Control of Generation of Code ('Code Injection') | 4 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 4 |
| Authorization Bypass Through User-Controlled Key | 3 |
| Deserialization of Untrusted Data | 3 |
| Authentication Bypass Using an Alternate Path or Channel | 2 |
| Improper Authorization | 2 |
| Incorrect Privilege Assignment | 2 |
| Relative Path Traversal | 2 |
| Server-Side Request Forgery (SSRF) | 2 |
| Authentication Bypass by Spoofing | 1 |
| Generation of Error Message Containing Sensitive Information | 1 |
| Improper Access Control | 1 |
| Improper Authentication | 1 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 1 |
| Improper Privilege Management | 1 |
| Insecure Storage of Sensitive Information | 1 |
| Insertion of Sensitive Information into Externally-Accessible File or Directory | 1 |
| Protection Mechanism Failure | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 19 | |
| 14 | |
| 10 | |
| 10 | |
| 8 | |
| 8 | |
| 8 | |
| 6 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 360 Product Rotation | 360-product-rotation |
| 4 author cheer up donate | 4-author-cheer-up-donate |
| aDirectory – WP Business Directory Plugin and Classified Ads Listings Directory | adirectory |
| Admin and Site Enhancements (ASE) | admin-site-enhancements |
| Admire Extra | admire-extra |
| AForms Eats | aforms-eats |
| All-Images.ai – IA Image Bank and Custom Image creation | all-images-ai |
| Alphabetic Pagination | alphabetic-pagination |
| Analytify – Google Analytics Dashboard For WordPress (GA4 analytics tracking) | wp-analytify |
| Aparat Responsive | aparat-responsive |
| Apus Framework | apus-framework |
| Avada (Fusion) Builder | fusion-builder |
| Badgearoo | badgearoo |
| BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net | woo-bulk-editor |
| Book a Room | book-a-room |
| Booking Calendar | booking |
| Bootstrap collapse | bootstrap-collapse |
| Brizy – Page Builder | brizy |
| Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP | videowhisper-live-streaming-integration |
| Calculator Builder – Create an Online Calculator | calculator-builder |
| Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist | bit-assist |
| Chaty Pro | chaty-pro |
| ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages | clickwhale |
| CM Map Locations – Visualize and share your locations in a few clicks | cm-map-locations |
| CodeBard Help Desk | codebard-help-desk |
| Content Snippet Manager | content-snippet-manager |
| ConvertPlus | convertplug |
| Customer Email Verification for WooCommerce | emails-verification-for-woocommerce |
| DethemeKit for Elementor | dethemekit-for-elementor |
| DirectoryPress Frontend | directorypress-frontend |
| Distance Based Shipping Calculator | distance-based-shipping-calculator |
| DL Leadback | dl-leadback |
| DX-auto-publish | dx-auto-publish |
| Easy Amazon Product Information | easy-amazon-product-information |
| Easy Booked – Appointment Booking and Scheduling Management System for WordPress | easy-booked |
| Easy Elementor Addons – Addons Pack for Elementor Page Builder | easy-elementor-addons |
| Easy Gallery | simple-gallery-odihost |
| Easy Popups – Beautiful, Responsive Popups for Lead Capture & Announcements | easy-popups |
| Easy Quiz Maker | n-media-wp-simple-quiz |
| Ebook Downloader | ebook-downloader |
| ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor | elementskit-lite |
| Email Keep | email-keep |
| Embed Google Map | embed-google-map |
| Event Tickets and Registration | event-tickets |
| Eventer - WordPress Event & Booking Manager Plugin | eventer |
| Events Planner | events-planner |
| Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export | wp-ultimate-exporter |
| Filled In | filled-in |
| Font Awesome WP | font-awesome-wp |
| Front End Users | front-end-only-users |
| FuseDesk | fusedesk |
| gallery | gallery |
| GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | geodirectory |
| Give – Divi Donation Modules | give-donation-modules-for-divi |
| Glance That | glance-that |
| Global Gallery - WordPress Responsive Gallery | global-gallery |
| Global Meta Keyword & Description | global-meta-keyword-and-description |
| Google Drive WP Media | google-drive-wp-media |
| GS WooCommerce Brands – Product Brands Slider, Grid, Filter & Carousel | gs-woo-brands |
| Houzez Property Feed | houzez-property-feed |
| HT Mega Addons for Elementor – Elementor Widgets & Template Builder | ht-mega-for-elementor |
| HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce | hurrytimer |
| IE CSS3 Support | ie-css3-support |
| iNET Webkit | inet-webkit |
| JS Help Desk – AI-Powered Support & Ticketing System | js-support-ticket |
| Keep Backup Daily | keep-backup-daily |
| Leyka | leyka |
| Liveticker (by stklcode) | stklcode-liveticker |
| LTL Freight Quotes – Estes Edition | ltl-freight-quotes-estes-edition |
| LTL Freight Quotes – For Customers of FedEx Freight | ltl-freight-quotes-fedex-freight-edition |
| LTL Freight Quotes – FreightQuote Edition | ltl-freight-quotes-freightquote-edition |
| LTL Freight Quotes – Unishippers Edition | ltl-freight-quotes-unishippers-edition |
| LTL Freight Quotes – Worldwide Express Edition | ltl-freight-quotes-worldwide-express-edition |
| LTL Freight Quotes – XPO Edition | ltl-freight-quotes-xpo-edition |
| Magic the Gathering Card Tooltips | magic-the-gathering-card-tooltips |
| Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin | majestic-support |
| Marekkis Watermark-Plugin | marekkis-watermark |
| Marketing Automation | marketing-automation |
| Media Library Folders | media-library-plus |
| Mobile Plugin | rocket-wp-mobile |
| My Login Logout Plugin | my-loginlogout |
| Naver Syndication V2 | badr-naver-syndication |
| NGG Smart Image Search | ngg-smart-image-search |
| Notif Bell | notif-bell |
| Oliver POS – WooCommerce POS for iPhone, iPad & Android | oliver-pos |
| Page/Post Specific Social Share Buttons | pagepost-specific-social-share-buttons |
| Pallet Packaging for WooCommerce | pallet-packaging-for-woocommerce |
| Post Thumbs | post-thumbs |
| Prezi Embedder | prezi-embedder |
| Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker | wedevs-project-manager |
| Qubely – Advanced Gutenberg Blocks | qubely |
| Quizzin | quizzin |
| Rank Math SEO – AI SEO Tools to Dominate SEO Rankings | seo-by-rank-math |
| Read More & Accordion | expand-maker |
| Related Posts Line-up-Exactly by Milliard | related-posts-line-up-exactry-by-milliard |
| Responsive Starter Templates – Elementor Templates & Starter Sites | responsive-add-ons |
| Return Refund and Exchange For WooCommerce | woo-refund-and-exchange-lite |
| Rise Blocks – A Complete Gutenberg Page Builder | rise-blocks |
| RSS Filter | rss-filter |
| RTMKit | rometheme-for-elementor |
| s2Member Pro | s2member-pro |
| Security Plugin, Firewall & Malware Scanner with Auto Removal | security-malware-firewall |
| ShipEngine Shipping Quotes | shipengine-shipping-quotes |
| sidebarTabs | sidebartabs |
| Simple Documentation | client-documentation |
| Simple Google Calendar Outlook Events Widget | simple-google-icalendar-widget |
| Simple Responsive Menu | simple-responsive-menu |
| SKT Blocks – Gutenberg based Page Builder | skt-blocks |
| Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider | ml-slider |
| Small Package Quotes – Purolator Edition | small-package-quotes-purolator-edition |
| Small Package Quotes – UPS Edition | small-package-quotes-ups-edition |
| Spotlight Social Feeds – Block, Shortcode, and Widget | spotlight-social-photo-feeds |
| StaffList | stafflist |
| Stream | stream |
| SuperSaaS – online appointment scheduling | supersaas-appointment-scheduling |
| Team – Team Members Showcase Plugin | tlp-team |
| Timeline Block – Beautiful Timeline Builder | timeline-block-block |
| TinyMCE Advanced qTranslate fix editor problems | tinymce-advanced-qtranslate-fix-editor-problems |
| Track Page Scroll | track-page-scroll |
| ts-tree | ts-tree |
| TTT Crop | ttt-crop |
| URL Shortener | Conversion Tracking | AB Testing | WooCommerce | easy-broken-link-checker |
| Vertex Addons for Elementor | addons-for-elementor-builder |
| Vitepos – Point of Sale (POS) for WooCommerce | vitepos-lite |
| Waymark | waymark |
| Welcart e-Commerce | usc-e-shop |
| what3words Address Field | 3-word-address-validation-field |
| Wibiya Toolbar | wibiya |
| Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets | widget-options |
| WooCommerce Pricing – Product Pricing | woo-pricing-table |
| WP Abstracts | wp-abstracts-manuscripts-manager |
| WP Activity Log | wp-security-audit-log |
| WP Airbnb Review Slider | wp-airbnb-review-slider |
| WP Directorybox Manager | wp-directorybox-manager |
| WP Easy Post Mailer | wp-mailer |
| WP Extended – The Ultimate WordPress Toolkit | wpextended |
| WP Foodbakery | wp-foodbakery |
| WP Ghost (Hide My WP Ghost) – Security & Firewall | hide-my-wp |
| WP Html Page Sitemap | wp-html-page-sitemap |
| WP Job Board Pro | wp-job-board-pro |
| WP PHPList | phplist-form-integration |
| WP Social Links | wp-social-links |
| WP Table Manager | wp-table-manager |
| WP-PManager | wp-programmmanager |
| WPSyncSheets For WPForms – Google Sheets Connector for WPForms & Real‑Time Data Export | wpsyncsheets-wpforms |
| YouTube Gallery – YouTube Channel | yottie-lite |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Avada | Website Builder For WordPress & WooCommerce | Avada |
| Campress | campress |
| Click Mag - Viral WordPress News Magazine/Blog Theme | click-mag |
| Listivo - Classified Ads WordPress Theme | listivo |
| Puzzles | WP Magazine / Review with Store WordPress Theme + RTL | puzzles |
| Real Estate 7 WordPress | realestate-7 |
| Zox News | zox-news |
| ZoxPress - The All-In-One WordPress News Theme | zoxpress |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Brizy – Page Builder [brizy]
Researcher
Affected Software
Campress [campress]
Researcher
Affected Software
Researcher
Affected Software
Real Estate 7 WordPress [realestate-7]
Researcher
Affected Software
s2Member Pro [s2member-pro]
Researcher
Affected Software
Security Plugin, Firewall & Malware Scanner with Auto Removal [security-malware-firewall]
Researcher
Affected Software
WP Directorybox Manager [wp-directorybox-manager]
Researcher
Affected Software
WP Foodbakery [wp-foodbakery]
Researcher
WP Foodbakery <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validation
9.8
Affected Software
WP Foodbakery [wp-foodbakery]
Researcher
Affected Software
WP Foodbakery [wp-foodbakery]
Researcher
Affected Software
WP Job Board Pro [wp-job-board-pro]
Researcher
Affected Software
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP [videowhisper-live-streaming-integration]
Researcher
Affected Software
All-Images.ai – IA Image Bank and Custom Image creation [all-images-ai]
Researcher
Apus Framework <= 2.4 - Authenticated (Subscriber+) Arbitrary Options Update in import_page_options
8.8
Affected Software
Apus Framework [apus-framework]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Calculator Builder – Create an Online Calculator <= 1.6.2 - Unauthenticated Local File Inclusion
8.1
Affected Software
Calculator Builder – Create an Online Calculator [calculator-builder]
Researcher
Affected Software
Researcher
Affected Software
ConvertPlus [convertplug]
Researcher
Affected Software
Researcher
Affected Software
WP Abstracts [wp-abstracts-manuscripts-manager]
Researcher
Affected Software
Researcher
Affected Software
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP [videowhisper-live-streaming-integration]
Researcher
Affected Software
Customer Email Verification for WooCommerce [emails-verification-for-woocommerce]
Researcher
Affected Software
Ebook Downloader [ebook-downloader]
Researcher
Affected Software
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export [wp-ultimate-exporter]
Researcher
Affected Software
JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]
Researcher
Affected Software
LTL Freight Quotes – Worldwide Express Edition [ltl-freight-quotes-worldwide-express-edition]
Researcher
Affected Software
LTL Freight Quotes – Estes Edition [ltl-freight-quotes-estes-edition]
Researcher
Affected Software
LTL Freight Quotes – For Customers of FedEx Freight [ltl-freight-quotes-fedex-freight-edition]
Researcher
Affected Software
LTL Freight Quotes – FreightQuote Edition [ltl-freight-quotes-freightquote-edition]
Researcher
Affected Software
LTL Freight Quotes – Unishippers Edition [ltl-freight-quotes-unishippers-edition]
Researcher
Affected Software
LTL Freight Quotes – XPO Edition [ltl-freight-quotes-xpo-edition]
Researcher
Affected Software
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support]
Researcher
Affected Software
ShipEngine Shipping Quotes [shipengine-shipping-quotes]
Researcher
Affected Software
Small Package Quotes – Purolator Edition [small-package-quotes-purolator-edition]
Researcher
Affected Software
Small Package Quotes – UPS Edition [small-package-quotes-ups-edition]
Researcher
Affected Software
Avada (Fusion) Builder [fusion-builder]
Researcher
Affected Software
Researcher
Affected Software
Magic the Gathering Card Tooltips [magic-the-gathering-card-tooltips]
Researcher
Affected Software
Researcher
Affected Software
Welcart e-Commerce [usc-e-shop]
Researcher
Affected Software
WooCommerce Pricing – Product Pricing [woo-pricing-table]
Researcher
Affected Software
WP Activity Log [wp-security-audit-log]
Researcher
Affected Software
WP Html Page Sitemap [wp-html-page-sitemap]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Customer Email Verification for WooCommerce [emails-verification-for-woocommerce]
Researcher
Affected Software
Qubely – Advanced Gutenberg Blocks [qubely]
Researcher
Affected Software
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker [wedevs-project-manager]
Researcher
Affected Software
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker [wedevs-project-manager]
Researcher
Affected Software
Admire Extra [admire-extra]
Researcher
Affected Software
Aparat Responsive [aparat-responsive]
Researcher
Affected Software
Brizy – Page Builder [brizy]
Researcher
Affected Software
CodeBard Help Desk [codebard-help-desk]
Researcher
Affected Software
DethemeKit for Elementor [dethemekit-for-elementor]
Researcher
Affected Software
DethemeKit for Elementor [dethemekit-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Easy Elementor Addons – Addons Pack for Elementor Page Builder [easy-elementor-addons]
Researcher
Affected Software
Easy Quiz Maker [n-media-wp-simple-quiz]
Researcher
Affected Software
Researcher
Affected Software
Embed Google Map [embed-google-map]
Researcher
Affected Software
Font Awesome WP [font-awesome-wp]
Researcher
Affected Software
Front End Users [front-end-only-users]
Researcher
Affected Software
gallery [gallery]
Researcher
Affected Software
Researcher
Affected Software
Google Drive WP Media [google-drive-wp-media]
Researcher
Affected Software
HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]
Researcher
HurryTimer <= 2.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Name
6.4
Affected Software
Researcher
Affected Software
Leyka [leyka]
Researcher
Affected Software
Liveticker (by stklcode) [stklcode-liveticker]
Researcher
Affected Software
NGG Smart Image Search [ngg-smart-image-search]
Researcher
Affected Software
Prezi Embedder [prezi-embedder]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Qubely – Advanced Gutenberg Blocks [qubely]
Researcher
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Affected Software
Rise Blocks – A Complete Gutenberg Page Builder [rise-blocks]
Researcher
Affected Software
Simple Google Calendar Outlook Events Widget [simple-google-icalendar-widget]
Researcher
Affected Software
SKT Blocks – Gutenberg based Page Builder [skt-blocks]
Researcher
Affected Software
Timeline Block – Beautiful Timeline Builder [timeline-block-block]
Researcher
Affected Software
Vertex Addons for Elementor [addons-for-elementor-builder]
Researcher
Affected Software
Waymark [waymark]
Researcher
Affected Software
360 Product Rotation [360-product-rotation]
Researcher
Affected Software
4 author cheer up donate [4-author-cheer-up-donate]
Researcher
Affected Software
Alphabetic Pagination [alphabetic-pagination]
Researcher
Affected Software
Badgearoo [badgearoo]
Researcher
Affected Software
Bootstrap collapse [bootstrap-collapse]
Researcher
Affected Software
CM Map Locations – Visualize and share your locations in a few clicks [cm-map-locations]
Researcher
Affected Software
Content Snippet Manager [content-snippet-manager]
Researcher
Affected Software
DL Leadback [dl-leadback]
Researcher
Affected Software
DX-auto-publish [dx-auto-publish]
Researcher
Easy Amazon Product Information <= 4.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
Affected Software
Easy Amazon Product Information [easy-amazon-product-information]
Researcher
Affected Software
Easy Gallery [simple-gallery-odihost]
Researcher
Affected Software
Email Keep [email-keep]
Researcher
Affected Software
Researcher
Affected Software
Events Planner [events-planner]
Researcher
Affected Software
Filled In [filled-in]
Researcher
Affected Software
Glance That [glance-that]
Researcher
Global Meta Keyword & Description <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
Affected Software
Global Meta Keyword & Description [global-meta-keyword-and-description]
Researcher
Affected Software
IE CSS3 Support [ie-css3-support]
Researcher
Affected Software
Listivo - Classified Ads WordPress Theme [listivo]
Researcher
Affected Software
LTL Freight Quotes – Unishippers Edition [ltl-freight-quotes-unishippers-edition]
Researcher
Affected Software
LTL Freight Quotes – Worldwide Express Edition [ltl-freight-quotes-worldwide-express-edition]
Researcher
Affected Software
Marekkis Watermark-Plugin [marekkis-watermark]
Researcher
Affected Software
Marketing Automation [marketing-automation]
Researcher
Affected Software
Mobile Plugin [rocket-wp-mobile]
Researcher
Affected Software
My Login Logout Plugin [my-loginlogout]
Researcher
Affected Software
Naver Syndication V2 [badr-naver-syndication]
Researcher
Affected Software
Page/Post Specific Social Share Buttons [pagepost-specific-social-share-buttons]
Researcher
Affected Software
Post Thumbs [post-thumbs]
Researcher
Affected Software
Quizzin [quizzin]
Researcher
Affected Software
Related Posts Line-up-Exactly by Milliard [related-posts-line-up-exactry-by-milliard]
Researcher
Affected Software
Researcher
Affected Software
RSS Filter [rss-filter]
Researcher
Affected Software
sidebarTabs [sidebartabs]
Researcher
Affected Software
Simple Documentation [client-documentation]
Researcher
Affected Software
Simple Responsive Menu [simple-responsive-menu]
Researcher
Affected Software
TinyMCE Advanced qTranslate fix editor problems [tinymce-advanced-qtranslate-fix-editor-problems]
Researcher
Affected Software
Track Page Scroll [track-page-scroll]
Researcher
Affected Software
TTT Crop [ttt-crop]
Researcher
Affected Software
URL Shortener | Conversion Tracking | AB Testing | WooCommerce [easy-broken-link-checker]
Researcher
Affected Software
what3words Address Field [3-word-address-validation-field]
Researcher
Affected Software
Wibiya Toolbar [wibiya]
Researcher
Affected Software
WP Easy Post Mailer [wp-mailer]
Researcher
Affected Software
WP Foodbakery [wp-foodbakery]
Researcher
Affected Software
WP PHPList [phplist-form-integration]
Researcher
Affected Software
WP Social Links [wp-social-links]
Researcher
Affected Software
Return Refund and Exchange For WooCommerce [woo-refund-and-exchange-lite]
Researcher
Affected Software
Give – Divi Donation Modules [give-donation-modules-for-divi]
Researcher
Affected Software
Researcher
Affected Software
YouTube Gallery – YouTube Channel [yottie-lite]
Researcher
Affected Software
Stream [stream]
Researcher
Affected Software
Global Gallery - WordPress Responsive Gallery [global-gallery]
Researcher
Affected Software
Responsive Starter Templates – Elementor Templates & Starter Sites [responsive-add-ons]
Researcher
Affected Software
Return Refund and Exchange For WooCommerce [woo-refund-and-exchange-lite]
Researcher
Affected Software
Admin and Site Enhancements (ASE) [admin-site-enhancements]
Researcher
Affected Software
AForms Eats [aforms-eats]
Researcher
Affected Software
Distance Based Shipping Calculator [distance-based-shipping-calculator]
Researcher
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Affected Software
WP Ghost (Hide My WP Ghost) – Security & Firewall [hide-my-wp]
Researcher
Affected Software
iNET Webkit [inet-webkit]
Researcher
Affected Software
LTL Freight Quotes – FreightQuote Edition [ltl-freight-quotes-freightquote-edition]
Researcher
Affected Software
LTL Freight Quotes – Unishippers Edition [ltl-freight-quotes-unishippers-edition]
Researcher
Affected Software
LTL Freight Quotes – Worldwide Express Edition [ltl-freight-quotes-worldwide-express-edition]
Researcher
Affected Software
Pallet Packaging for WooCommerce [pallet-packaging-for-woocommerce]
Researcher
Affected Software
Spotlight Social Feeds – Block, Shortcode, and Widget [spotlight-social-photo-feeds]
Researcher
Affected Software
WP Extended – The Ultimate WordPress Toolkit [wpextended]
Researcher
Affected Software
Booking Calendar [booking]
Researcher
Affected Software
Researcher
Affected Software
Keep Backup Daily [keep-backup-daily]
Researcher
Affected Software
SuperSaaS – online appointment scheduling [supersaas-appointment-scheduling]
Researcher
Affected Software
WP Airbnb Review Slider [wp-airbnb-review-slider]
Researcher
Affected Software
WP-PManager [wp-programmmanager]
Researcher
Affected Software
Badgearoo [badgearoo]
Researcher
Affected Software
Notif Bell [notif-bell]
Researcher
Affected Software
URL Shortener | Conversion Tracking | AB Testing | WooCommerce [easy-broken-link-checker]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Book a Room [book-a-room]
Researcher
Affected Software
Researcher
Affected Software
DethemeKit for Elementor [dethemekit-for-elementor]
Researcher
Affected Software
DirectoryPress Frontend [directorypress-frontend]
Researcher
Affected Software
Distance Based Shipping Calculator [distance-based-shipping-calculator]
Researcher
Affected Software
Researcher
Affected Software
Email Keep [email-keep]
Researcher
Affected Software
Houzez Property Feed [houzez-property-feed]
Researcher
Affected Software
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support]
Researcher
Affected Software
Media Library Folders [media-library-plus]
Researcher
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Affected Software
Read More & Accordion [expand-maker]
Researcher
Affected Software
RTMKit [rometheme-for-elementor]
Researcher
Affected Software
Team – Team Members Showcase Plugin [tlp-team]
Researcher
ts-tree <= 0.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
4.3
Affected Software
ts-tree [ts-tree]
Researcher
URL Shortener | Conversion Tracking | AB Testing | WooCommerce <= 9.0.2 - Cross-Site Request Forgery
4.3
Affected Software
URL Shortener | Conversion Tracking | AB Testing | WooCommerce [easy-broken-link-checker]
Researcher
Affected Software
Vitepos – Point of Sale (POS) for WooCommerce [vitepos-lite]
Researcher
Affected Software
WP Table Manager [wp-table-manager]
Researcher
Affected Software
WP-PManager [wp-programmmanager]
Researcher
Affected Software
WPSyncSheets For WPForms – Google Sheets Connector for WPForms & Real‑Time Data Export [wpsyncsheets-wpforms]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments
2:05 am
You all do some amazing work in an increasingly difficult field: thank you.
1:34 pm
Thank you for the kind words Kay!