Wordfence Intelligence Weekly WordPress Vulnerability Report (March 10, 2025 to March 16, 2025)
📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest.
Last week, there were 160 vulnerabilities disclosed in 137 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 55 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 24,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WAF-RULE-813 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-814 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 78 |
| Unpatched | 82 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 123 |
| High Severity | 27 |
| Critical Severity | 10 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 51 |
| Cross-Site Request Forgery (CSRF) | 44 |
| Missing Authorization | 20 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 10 |
| Authorization Bypass Through User-Controlled Key | 5 |
| Authentication Bypass Using an Alternate Path or Channel | 4 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 4 |
| Deserialization of Untrusted Data | 3 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 3 |
| Improper Control of Generation of Code ('Code Injection') | 2 |
| Improper Privilege Management | 2 |
| Authentication Bypass by Alternate Name | 1 |
| Exposure of Private Personal Information to an Unauthorized Actor | 1 |
| Exposure of Sensitive Information to an Unauthorized Actor | 1 |
| Improper Access Control | 1 |
| Improper Input Validation | 1 |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | 1 |
| Incorrect Privilege Assignment | 1 |
| Relative Path Traversal | 1 |
| Server-Side Request Forgery (SSRF) | 1 |
| Unrestricted Upload of File with Dangerous Type | 1 |
| URL Redirection to Untrusted Site ('Open Redirect') | 1 |
| Use of Hard-coded Cryptographic Key | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 15 | |
| 13 | |
| 12 | |
| 10 | |
| 9 | |
| 9 | |
| 8 | |
| 6 | |
| 6 | |
| 5 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Accounting for WooCommerce | accounting-for-woocommerce |
| All-in-One WP Migration and Backup | all-in-one-wp-migration |
| AnalyticsWP | analyticswp |
| Another Events Calendar | another-events-calendar |
| Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin | simply-schedule-appointments |
| AppPresser – Mobile App Framework | apppresser |
| Appsero Helper | appsero-helper |
| ArielBrailovsky-ViralAd | arielbrailovsky-viralad |
| AS English Admin | as-english-admin |
| Awesome Surveys | awesome-surveys |
| Back To Top | backtotop |
| binlayerpress | binlayerpress |
| Block Spam By Math Reloaded | block-spam-by-math-reloaded |
| BlogBuzzTime for WP | blogbuzztime-for-wp |
| BP Email Assign Templates | bp-email-assign-templates |
| Builder for Contact Form 7 by Webconstruct – Drag & Drop Contact Form Builder | cf7-builder |
| Business Directory Plugin – Easy Listing Directories for WordPress | business-directory-plugin |
| CC-IMG-Shortcode | cc-img-shortcode |
| Church Admin | church-admin |
| CM FAQ – Simplify support with an intuitive FAQ management tool | cm-faq |
| Comment Date and Gravatar remover | remove-date-and-gravatar-under-comment |
| Contact Form 7 Select Box Editor Button | contact-form-7-select-box-editor-button |
| CRM and Lead Management by vcita | crm-customer-relationship-management-by-vcita |
| Custom Dashboard Page | custom-dashboard-page |
| Custom top bar | custom-top-bar |
| Delete Original Image | delete-original-image |
| DethemeKit for Elementor | dethemekit-for-elementor |
| Directory Listings WordPress plugin – uListing | ulisting |
| Display Template Name | display-template-name |
| Domain Theme | domain-theme |
| Download Manager | download-manager |
| DP ALTerminator – Missing ALT manager | dp-alterminator-missing-alt-manager |
| Easy Image Display | easy-image-display |
| Event Post | event-post |
| Featured Image Thumbnail Grid | thumbnail-grid |
| Featured Posts Grid | featured-posts-grid |
| Finale Lite – Sales Countdown Timer & Discount for WooCommerce | finale-woocommerce-sales-countdown-timer-discount |
| Frontpage category filter | frontpage-category-filter |
| FTP Sync – Theme, Media & Plugin Files | ftp-sync |
| GetSocial | getsocial |
| Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers | rafflepress |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| GNUCommerce | gnucommerce |
| GNUPress | gnupress |
| Go To Top | go-to-top |
| Google News Editors Picks Feed Generator | google-news-editors-picks-news-feeds |
| Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor | gutentor |
| HUSKY – Products Filter Professional for WooCommerce | woocommerce-products-filter |
| In Stock Mailer for WooCommerce | in-stock-mailer-for-woocommerce |
| Insert Code | insert-code |
| InstaWP Connect – 1-click WP Staging & Migration | instawp-connect |
| JobCareer | Job Board Responsive WordPress Theme | jobcareer |
| Lana Downloads Manager | lana-downloads-manager |
| Lava Ajax Search | lava-ajax-search |
| Layer Slider | bee-layer-slider |
| List MixCloud | list-mixcloud |
| List of Posts from each Category plugin for WordPress | list-posts-by-category |
| Login Logger | login-logger |
| LoginPress | wp-login Custom Login Page Customizer | loginpress |
| Lunar – Sell photos online | lunar-sell-photos-online |
| Maintenance Notice | maintenance-notice |
| MapPress Maps for WordPress | mappress-google-maps-for-wordpress |
| Maps – Google Maps | robo-maps |
| MaxA/B | maxab |
| Members page only for logged in users | members-page-only-for-logged-in-users |
| MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet | paid-membership |
| NEX-Forms – Ultimate Forms Plugin for WordPress | nex-forms-express-wp-form-builder |
| No Disposable Email | no-disposable-email |
| Omnipress | omnipress |
| Page Builder: Pagelayer – Drag and Drop website builder | pagelayer |
| Photo Gallery by 10Web – Mobile-Friendly Image Gallery | photo-gallery |
| PHP/MySQL CPU performance statistics | mywebtonet-performancestats |
| Picture Gallery – Frontend Image Uploads, AJAX Photo List | picture-gallery |
| pipDisqus – Lightweight Disqus Comments | pipdisqus |
| pixelstats | pixelstats |
| Plugin Name: amoCRM WebForm | amocrm-webform |
| PluginPass – WordPress PRO Plugin/Theme Licensing (Public Alpha) | pluginpass-pro-plugintheme-licensing |
| Plugins Last Updated Column | plugins-last-updated-column |
| Post Read Time | post-read-time |
| price-calc | price-calc |
| ProductDyno | productdyno |
| Qubely – Advanced Gutenberg Blocks | qubely |
| Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker | quiz-master-next |
| Rankchecker.io Integration | rankchecker-io-integration |
| Realteo | realteo |
| ReportAttacks — Brute Force & Login Protection | reportattacks |
| Responsive Google Map | responsive-google-map |
| REST API TO MiniProgram | rest-api-to-miniprogram |
| Robo Gallery – Photo & Image Slider | robo-gallery |
| Schema Engine AI – AI Schema Markup, Reviews & Rich Snippets for SEO | review-schema |
| School Management System – WPSchoolPress | wpschoolpress |
| Search & Filter Pro | search-filter-pro |
| SecuPress with Simple SSL – Simple and Performant Security | secupress |
| ShareThis Dashboard for Google Analytics | googleanalytics |
| ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | woolentor-addons |
| Simple Amazon Affiliate | simple-amazon-affiliate |
| Skitter Slideshow | wp-skitter-slideshow |
| Skrill – WooCommerce | official-skrill-woocommerce |
| SoundRise Music | soundrise-music |
| spam-byebye | spam-byebye |
| Tabbed Login Widget | tabbed-login |
| TabGarb Pro | tabgarb |
| TBTestimonials | tb-testimonials |
| ThemeEgg ToolKit | themeegg-toolkit |
| Thumbnail carousel slider | wp-responsive-thumbnail-slider |
| Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin | uncanny-automator |
| Video Share VOD – Turnkey Video Site Builder Script | video-share-vod |
| VidoRev Extensions | vidorev-extensions |
| W3Counter Free Real-Time Web Stats | blog-stats-by-w3counter |
| WATI Chat and Notification | wati-chat-and-notification |
| WC Affiliate – WooCommerce Affiliate Plugin | wc-affiliate |
| WooCommerce | woocommerce |
| WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto | tripetto |
| WordPress Hashtags | wp-hashtags |
| wordpress login form to anywhere | wp-show-login-form |
| WordPress Mobile Themes | wp-mobile-themes |
| Workreap | workreap |
| WP Add Active Class To Menu Item | wp-add-active-class-to-menu-item |
| WP Bulk Post Duplicator | wp-bulk-post-duplicator |
| WP Compare Tables | wp-compare-tables |
| WP Crowdfunding | wp-crowdfunding |
| WP Ghost (Hide My WP Ghost) – Security & Firewall | hide-my-wp |
| WP Hide Admin Bar | wp-hide-admin-bar |
| WP JobHunt | wp-jobhunt |
| WP jQuery Persian Datepicker | wpjqp-datepicker |
| WP Last Modified | wp-last-modified |
| WP Multistore Locator — WP Store Locator Plugin: Effortless Integration With Snazzy Maps | wp-multi-store-locator |
| WP No-Bot Question | wp-no-bot-question |
| WP Performance Pack | wp-performance-pack |
| WP Recipe Maker | wp-recipe-maker |
| WP Simple Slideshow | wp-simple-slideshow |
| WP Test Email | wp-test-email |
| WP01 – Speed, Security, SEO consultant | wp01 |
| WPCOM Member | wpcom-member |
| WPCS – WordPress Currency Switcher Professional | currency-switcher |
| ZipList Recipe Plugin | ziplist-recipe-plugin |
| Zoorum Comments | zoorum-comments |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Civi - Job Board & Freelance Marketplace WordPress Theme | civi |
| CiyaShop - Multipurpose WooCommerce Theme | ciyashop |
| Eco Nature - Environment & Ecology WordPress Theme | eco-nature |
| Industrial | industrial |
| Resido - Real Estate WordPress Theme | resido |
| Travel Booking WordPress Theme | traveler |
| Zegen - Church WordPress Theme | zegen |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Researcher
Affected Software
CiyaShop - Multipurpose WooCommerce Theme [ciyashop]
Researcher
Affected Software
HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter]
Researcher
Realteo - Real Estate Plugin by Purethemes <= 1.2.8 - Authentication Bypass via 'do_register_user'
9.8
Affected Software
Travel Booking WordPress Theme [traveler]
Researcher
Affected Software
WP JobHunt [wp-jobhunt]
Researcher
Affected Software
WP JobHunt [wp-jobhunt]
Researcher
Affected Software
WP JobHunt [wp-jobhunt]
Researcher
Affected Software
PluginPass – WordPress PRO Plugin/Theme Licensing (Public Alpha) [pluginpass-pro-plugintheme-licensing]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Industrial <= 1.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
8.8
Affected Software
Industrial [industrial]
Researcher
Affected Software
InstaWP Connect – 1-click WP Staging & Migration [instawp-connect]
Researcher
Affected Software
JobCareer | Job Board Responsive WordPress Theme [jobcareer]
Researcher
Affected Software
Researcher
Affected Software
School Management System – WPSchoolPress [wpschoolpress]
Researcher
Affected Software
SoundRise Music [soundrise-music]
Researcher
Affected Software
Eco Nature - Environment & Ecology WordPress Theme [eco-nature]
Researcher
Affected Software
PHP/MySQL CPU performance statistics [mywebtonet-performancestats]
Researcher
Affected Software
All-in-One WP Migration and Backup [all-in-one-wp-migration]
Researcher
Affected Software
AnalyticsWP [analyticswp]
Researcher
Affected Software
ArielBrailovsky-ViralAd [arielbrailovsky-viralad]
Researcher
Affected Software
ArielBrailovsky-ViralAd [arielbrailovsky-viralad]
Researcher
Affected Software
Church Admin [church-admin]
Researcher
Affected Software
HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter]
Researcher
Affected Software
LoginPress | wp-login Custom Login Page Customizer [loginpress]
Researcher
Affected Software
WP Ghost (Hide My WP Ghost) – Security & Firewall [hide-my-wp]
Researcher
Affected Software
WP JobHunt [wp-jobhunt]
Researcher
Affected Software
WPCOM Member [wpcom-member]
Researcher
Affected Software
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin [simply-schedule-appointments]
Researcher
Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Sensitive Information Exposure
7.3
Affected Software
Researcher
Affected Software
WPCS – WordPress Currency Switcher Professional [currency-switcher]
Researcher
Affected Software
AppPresser – Mobile App Framework [apppresser]
Researcher
Affected Software
ThemeEgg ToolKit [themeegg-toolkit]
Researcher
Affected Software
Researcher
Affected Software
WP Test Email [wp-test-email]
Researcher
Affected Software
BP Email Assign Templates [bp-email-assign-templates]
Researcher
Affected Software
Researcher
Affected Software
School Management System – WPSchoolPress [wpschoolpress]
Researcher
Affected Software
School Management System – WPSchoolPress [wpschoolpress]
Researcher
Affected Software
WC Affiliate – WooCommerce Affiliate Plugin [wc-affiliate]
Researcher
Affected Software
Researcher
Affected Software
Plugin Name: amoCRM WebForm [amocrm-webform]
Researcher
Affected Software
Layer Slider [bee-layer-slider]
Researcher
Affected Software
CC-IMG-Shortcode [cc-img-shortcode]
Researcher
Affected Software
DethemeKit for Elementor [dethemekit-for-elementor]
Researcher
Affected Software
Easy Image Display [easy-image-display]
Researcher
Affected Software
Event Post [event-post]
Researcher
Affected Software
Featured Image Thumbnail Grid [thumbnail-grid]
Researcher
Affected Software
Finale Lite – Sales Countdown Timer & Discount for WooCommerce [finale-woocommerce-sales-countdown-timer-discount]
Researcher
Affected Software
List MixCloud [list-mixcloud]
Researcher
MapPress Maps for WordPress <= 2.94.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
MapPress Maps for WordPress [mappress-google-maps-for-wordpress]
Researcher
Affected Software
Maps – Google Maps [robo-maps]
Researcher
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Affected Software
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]
Researcher
Affected Software
Tabbed Login Widget [tabbed-login]
Researcher
Affected Software
WP Recipe Maker [wp-recipe-maker]
Researcher
Affected Software
Another Events Calendar [another-events-calendar]
Researcher
Affected Software
Appsero Helper [appsero-helper]
Researcher
Affected Software
Researcher
Affected Software
Featured Posts Grid [featured-posts-grid]
Researcher
Affected Software
FTP Sync – Theme, Media & Plugin Files [ftp-sync]
Researcher
Affected Software
GetSocial [getsocial]
Researcher
Affected Software
GNUCommerce [gnucommerce]
Researcher
Affected Software
GNUPress [gnupress]
Researcher
Affected Software
Go To Top [go-to-top]
Researcher
Affected Software
Google News Editors Picks Feed Generator [google-news-editors-picks-news-feeds]
Researcher
Affected Software
WordPress Hashtags [wp-hashtags]
Researcher
Affected Software
In Stock Mailer for WooCommerce [in-stock-mailer-for-woocommerce]
Researcher
Affected Software
Insert Code [insert-code]
Researcher
Affected Software
List of Posts from each Category plugin for WordPress [list-posts-by-category]
Researcher
Affected Software
MaxA/B [maxab]
Researcher
Affected Software
Members page only for logged in users [members-page-only-for-logged-in-users]
Researcher
Affected Software
Researcher
Affected Software
No Disposable Email [no-disposable-email]
Researcher
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]
Researcher
Affected Software
Picture Gallery – Frontend Image Uploads, AJAX Photo List [picture-gallery]
Researcher
Affected Software
pixelstats [pixelstats]
Researcher
Affected Software
price-calc [price-calc]
Researcher
Affected Software
ProductDyno [productdyno]
Researcher
Affected Software
Rankchecker.io Integration [rankchecker-io-integration]
Researcher
Affected Software
Simple Amazon Affiliate [simple-amazon-affiliate]
Researcher
Affected Software
TabGarb Pro [tabgarb]
Researcher
Affected Software
TBTestimonials [tb-testimonials]
Researcher
Affected Software
Travel Booking WordPress Theme [traveler]
Researcher
Affected Software
Video Share VOD – Turnkey Video Site Builder Script [video-share-vod]
Researcher
Affected Software
WATI Chat and Notification [wati-chat-and-notification]
Researcher
Affected Software
WP Compare Tables [wp-compare-tables]
Researcher
WP jQuery Persian Datepicker <= 0.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
Affected Software
WP jQuery Persian Datepicker [wpjqp-datepicker]
Researcher
Affected Software
WP Simple Slideshow [wp-simple-slideshow]
Researcher
Affected Software
Zoorum Comments [zoorum-comments]
Researcher
Affected Software
Researcher
Affected Software
Awesome Surveys [awesome-surveys]
Researcher
Affected Software
BP Email Assign Templates [bp-email-assign-templates]
Researcher
Affected Software
Researcher
Affected Software
Custom top bar [custom-top-bar]
Researcher
Affected Software
Download Manager [download-manager]
Researcher
Affected Software
AS English Admin [as-english-admin]
Researcher
Affected Software
Block Spam By Math Reloaded [block-spam-by-math-reloaded]
Researcher
Affected Software
Business Directory Plugin – Easy Listing Directories for WordPress [business-directory-plugin]
Researcher
Affected Software
NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]
Researcher
Affected Software
Resido - Real Estate WordPress Theme [resido]
Researcher
Affected Software
Responsive Google Map [responsive-google-map]
Researcher
Affected Software
ShareThis Dashboard for Google Analytics [googleanalytics]
Researcher
VidoRev Extensions <= 2.9.9.9.9.9.5 - Missing Authorization to Unauthenticated Youtube Video Import
5.3
Affected Software
VidoRev Extensions [vidorev-extensions]
Researcher
Affected Software
WP Crowdfunding [wp-crowdfunding]
Researcher
Affected Software
Researcher
Affected Software
Lana Downloads Manager [lana-downloads-manager]
Researcher
Affected Software
Thumbnail carousel slider [wp-responsive-thumbnail-slider]
Researcher
Affected Software
ReportAttacks — Brute Force & Login Protection [reportattacks]
Researcher
Affected Software
Accounting for WooCommerce [accounting-for-woocommerce]
Researcher
Affected Software
binlayerpress [binlayerpress]
Researcher
Block Spam By Math Reloaded <= 2.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
Affected Software
Block Spam By Math Reloaded [block-spam-by-math-reloaded]
Researcher
Affected Software
BlogBuzzTime for WP [blogbuzztime-for-wp]
Researcher
Affected Software
DP ALTerminator – Missing ALT manager [dp-alterminator-missing-alt-manager]
Researcher
Affected Software
Researcher
Affected Software
Lava Ajax Search [lava-ajax-search]
Researcher
Affected Software
Lunar – Sell photos online [lunar-sell-photos-online]
Researcher
Affected Software
pipDisqus – Lightweight Disqus Comments [pipdisqus]
Researcher
Affected Software
Post Read Time [post-read-time]
Researcher
Affected Software
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker [quiz-master-next]
Researcher
Affected Software
Skitter Slideshow [wp-skitter-slideshow]
Researcher
Affected Software
WooCommerce [woocommerce]
Researcher
wordpress login form to anywhere <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
Affected Software
wordpress login form to anywhere [wp-show-login-form]
Researcher
Affected Software
WP Last Modified [wp-last-modified]
Researcher
Affected Software
Back To Top [backtotop]
Researcher
Affected Software
Researcher
Affected Software
Comment Date and Gravatar remover [remove-date-and-gravatar-under-comment]
Researcher
Affected Software
Contact Form 7 Select Box Editor Button [contact-form-7-select-box-editor-button]
Researcher
Affected Software
CRM and Lead Management by vcita [crm-customer-relationship-management-by-vcita]
Researcher
Affected Software
Custom Dashboard Page [custom-dashboard-page]
Researcher
Affected Software
Delete Original Image [delete-original-image]
Researcher
Affected Software
Display Template Name [display-template-name]
Researcher
Affected Software
Domain Theme [domain-theme]
Researcher
Affected Software
Frontpage category filter [frontpage-category-filter]
Researcher
Affected Software
Login Logger [login-logger]
Researcher
Affected Software
Maintenance Notice [maintenance-notice]
Researcher
Affected Software
WordPress Mobile Themes [wp-mobile-themes]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Plugins Last Updated Column [plugins-last-updated-column]
Researcher
Affected Software
Qubely – Advanced Gutenberg Blocks [qubely]
Researcher
Affected Software
REST API TO MiniProgram [rest-api-to-miniprogram]
Researcher
Affected Software
School Management System – WPSchoolPress [wpschoolpress]
Researcher
Affected Software
Search & Filter Pro [search-filter-pro]
Researcher
Affected Software
Skrill – WooCommerce [official-skrill-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
W3Counter Free Real-Time Web Stats [blog-stats-by-w3counter]
Researcher
Affected Software
WP Add Active Class To Menu Item [wp-add-active-class-to-menu-item]
Researcher
Affected Software
WP Bulk Post Duplicator [wp-bulk-post-duplicator]
Researcher
Affected Software
WP Hide Admin Bar [wp-hide-admin-bar]
Researcher
Affected Software
WP Multistore Locator — WP Store Locator Plugin: Effortless Integration With Snazzy Maps [wp-multi-store-locator]
Researcher
Affected Software
WP No-Bot Question [wp-no-bot-question]
Researcher
Affected Software
WP Performance Pack [wp-performance-pack]
Researcher
Affected Software
Zegen - Church WordPress Theme [zegen]
Researcher
Affected Software
ZipList Recipe Plugin [ziplist-recipe-plugin]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments